Logs and health

DPLens reports on itself in four places. Knowing which to look at saves time.

The console

Overview is the health page. The indicator in the header opens a breakdown: which component is unhealthy and why.

Quarantine is deliberate isolation. One badly-configured source does not take the agent down with it — but it also will not recover by itself once quarantined.

The Windows event log

The service's own start, stop and failure-to-start records are where Windows puts them, under Windows Logs → System, from the Service Control Manager.

If the service will not start at all, this is the place to look first. A configuration file it cannot read or cannot parse is the usual cause; check it before restarting:

"C:\Program Files\DPLens\dplens.exe" --validate-only --config "C:\ProgramData\DPLens\config\agent.yaml"

The audit log

C:\ProgramData\DPLens\state\audit\audit.jsonl

One record per line, append-only, each chained to the one before it with a cryptographic hash. A record cannot be changed or removed without breaking the chain, and the console tells you whether the chain verifies.

Read it in the console under Settings and audit → Audit, or collect the file itself into your SIEM — it is one JSON object per line, so any collector that reads NDJSON can take it. You can even point a DPLens file source at it.

It records changes, not health: sign-ins and failures, configuration applies and rollbacks, password changes, certificate installation, licence changes, masking policy changes, re-baselining, and the agent's own start-up checks.

If the chain does not verify, the file has been altered or truncated since it was written. That is worth investigating: the folder is protected so that only administrators and the service can write there.

The diagnostics file

Off by default. Turn it on in Settings and audit → Resources → Diagnostics capture, or in configuration:

settings:
  diagnostics:
    file_log: true
    max_file_mb: 16
    keep: 4

Written to:

C:\ProgramData\DPLens\state\logs\dplens-core.log

with rotations beside it. Size limit × files kept is the most disk it can ever use — with the defaults, 64 MB.

This is the agent's own output: start-up, component lifecycle, delivery errors. It is not your log data. Secrets are never written to it.

It applies when DPLens runs as a Windows service. Run from a command prompt, the output goes to the console instead.

Turn it on when you are investigating something, and off again afterwards.

What "healthy" does not tell you

The health indicator says components are running. It does not say you are collecting what you meant to. Two things on Overview answer that:

• Collection coverage — whether the channels and paths you asked for actually exist and are producing. A mistyped path shows here.
• The pipeline funnel — where events are going. A filter that turns out to drop everything looks perfectly healthy; the funnel shows a stage with a lot in and nothing out.

Signals worth alerting on