Where to Find Logs

AppProfileSafe writes two independent log streams to separate folders. This page explains where each log type is stored, how files are named, and how rotation works.


Application Log Location

The application log is stored in the folder configured by <LogFolder> in settings.xml. If no value is set, it falls back to the application's base directory.

Item Value
Default path %ProgramFiles%\IT-Consulting Kinner\AppProfileSafe\Log
Active file app.csv
Rotated files app.1.csv, app.2.csv, … app.N.csv
Format CSV (RFC 4180), UTF-8 without BOM
CSV columns Timestamp, LogLevel, Component, Message

Timestamps are in ISO 8601 UTC format. The Component column identifies the class or service that produced the entry.


Application Log Rotation

When app.csv would exceed MaxLogSizeBytes (default: 10 MB), rotation occurs automatically:

  1. The oldest rotated file (app.N.csv where N = MaxLogFiles) is deleted if it exists.
  2. Each remaining rotated file shifts up by one number: app.1.csvapp.2.csv, etc.
  3. The current app.csv is renamed to app.1.csv.
  4. A new app.csv is created with a fresh CSV header row.

Rotation settings are configured in settings.xml under the <Logging> element. See Logging & Diagnostics for the available settings.


Audit Log Location

Audit logs are stored in the folder configured by <AuditFolder> in settings.xml.

Item Value
Default path %ProgramData%\IT-Consulting Kinner\AppProfileSafe\Audit
File naming audit_YYYY-MM.csv (one file per calendar month, e.g. audit_2026-02.csv)
Detail files Audit\Details\audit_NNNNNNNNNN.json (per-entry detailed info with file paths and registry values)
Retention Configured via <Audit><RetentionDays>. Default: 365 days.

Unlike the application log, audit logs are not rotated by size. Instead, a new file is created automatically at the start of each month. Old files are archived or deleted based on the retention policy.


Audit Log CSV Columns

Each audit CSV file contains one header row followed by pipe-separated entries with the following columns:

TimestampUtc,SequenceNumber,UserId,UserSid,AuthMethod,MachineName,OsVersion,
ApplicationVersion,Interface,Action,Target,Success,Details,DurationMs,
FileCount,DataSize,RegistryValueCount,ErrorMessage,EntryHash,PreviousHash

The EntryHash and PreviousHash columns form a SHA-256 hash chain for tamper detection. For a full explanation, see Audit Logging.


Quick Reference

Log Type Default Folder File Pattern Rotation
Application log …\AppProfileSafe\Log app.csv, app.N.csv By size (MaxLogSizeBytes)
Audit log …\AppProfileSafe\Audit audit_YYYY-MM.csv Monthly (new file per month)