logcensor
You can use the logcensor program to replace sensitive data with their respective GUIDs. This can be used to sanitize your logs before sending them outside your organization.
Sanitizing your logs could result in a loss of information in the resulting output file. For example, if the same description is used in more than one place, the output file will not differentiate between the two. Please remember to review your outputs.
Usage
logcensor.exe [options] -log <log file> -out <output file>
The record separator character 0x1F will wrap all censored text in the output file.
Argument | Description |
|---|---|
-h --help | Print out the help usage. |
-v --version | Print out the version. |
-accounts | Censor account information. |
-acctattrkeys <Account attribute keys> | Only censor the values of specified account attributes. This argument requires acctattrs argument. |
-acctattrs | Censor account attribute values. |
-auto | Run in "easy" mode. Automatically choose what settings to use: Automatically finds the log directory and censors it. Strict mode is off. Log is generated in \<instance>\Logs\. Replacement log is generated in \<instance>\Logs_replaced\. Target replacement is off. Profle names are listed. Account names are listed. All account attributes are listed except those in default exlusion file (\<instance>\util\logcensor_ignoreacctattrkeys.txt). All profile attributes are listed except those in default exlusion file (\<instance>\util\logcensor_ignoreprofileattrkeys.txt). |
-excludeacctattrkeys <Account attribute keys to exclude> | Censor the values of account attributes not including these. This argument requires acctattrs argument. |
-excludeacctattrkeysfile <file> | File containing a newline-delimited list of account attribute keys to exclude. This argument requires acctattrs argument. |
-excludeprofileattrkeys <Profile attribute keys to exclude> | Censor the values of profile attributes not including these. This argument requires profileattrs argument. |
-excludeprofileattrkeysfile <file> | File containing a newline-delimited list of profile attribute keys to exclude. This argument requires profileattrs argument. |
-ignorecase | Perform censorship case-insensitively. |
-log <file> | Log file or directory to process. Defaults to instance log directory if unspecified. Supports wildcards (requires the out argument). |
-manual <file> | Manually specify replacements via a comma-separated-values file. |
-minlen <minlength> | Strings this many characters or less will only be censored if wrapped in square brackets. The default is 5 . |
-out <file> | Output file or directory. The default is <logfile>_replaced |
-profileattrkeys <profile attribute keys> | Only censor the values of these profile attributes. This argument requires profileattrs argument. |
-profileattrs | Censor profile attribute values. |
-profiles | Censor profile information. |
-q | Do not output progress messages or warnings about potentially uncensored information due to minimum length configuration. |
-replacementlog <replacement-file> | Output a log file that shows the replacements done. |
-strict | Use completely random replacement values. |
-targets <mode> | Censor target system information – desc — addr — full |
-warnings <file> | Output attribute length warnings to this file instead of stdout. |
Examples
The following examples assume that the utility is in the same directory as the log file to be censored. If not, simply include the path to the utility or file as appropriate.
To censor all account information from
idmsuite.log:logcensor.exe -log idmsuite.log -out outlog -accounts
To censor all account and profile information with minimum length:
logcensor.exe -log idmsuite.log -out outlog -accounts -profiles -minlen 4
To censor all target information with replacement log:
logcensor.exe -log idmsuite.log -out outlog -targets full -replacementlog
To censor specific profile attributes:
logcensor.exe -log idmsuite.log -out outlog -replacementlog replacelog.log -profileattrs -profileattrkeys OTHER_NAME FIRST_NAME -minlen 4
To censor a specific account attribute:
logcensor.exe -log c685ceab-18c3-4522-80e5-abfd7f1313eb_1523567367_214_rcv.txt -out outlog -acctattrs -acctattrkeys fn -minlen 4
To dump warning messages to a file:
logcensor.exe -log idmsuite.log -out output.log -accounts -warnings warn.log
To run in "easy" mode:
logcensor.exe -auto
To censor all account attributes excluding the "mail" account attribute:
logcensor.exe -log idmsuite.log -excludeacctattrkeys mail -acctattrs -out out2.log
To censor all profile attributes excluding those listed in a newline-delimited file:
logcensor.exe -log idmsuite.log -profileattrs -excludeprofileattrkeysfile logcensor_ignoreprofileattrkeys.txt
To use anonymous GUIDs when censoring accounts and profiles:
logcensor.exe -log idmsuite.log -out outlog -accounts -profiles -strict
To censor data using an input file containing the replacements to perform:
logcensor.exe -log idmsuite.log -out outlog -manual <file>
To censor all log files in a specific directory:
logcensor.exe -log "C:\path\to\directory" -out outlog -accounts
To censor all log files starting with "plugin" in the current directory:
logcensor.exe -log ".\plugin*" -out outlog -accounts