How to write klserver and klnagent trace to a custom location + rotation [KSC for Windows]

[Antipova Anna]

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.

Article applies to KSC13-14.2 versions. 

Sometimes you need to keep KSC tracing on for a long period of time to catch the error and there is little disk space left on the system disk.

Step-by-step guide

There is a way to change the default location of $klserver-1093.log file - use klscflag.exe utility"

1. klscflag.exe -tset -pv "klserver" -l 4 -d O:\Temp

2. O:\temp can be changed to any existing folder name in file system. Remember to create this folder before running the command. 
3. In order to revert trace file location to default value, delete the value TraceDir from HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\Components\34\1093\1.0.0.0\Debug:

Same applies to klnagent trace - custom settings should be written to the following registry branch:

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab\Components\34\1103\1.0.0.0\Debug]

Additional option:

TraceMaxSizeMB is an optional value that enables trace files rotation for all services of the Kaspersky Security Center. The value of it variable determines the total size of trace files in MB. The absence of the variable or its zero value means that rotation is disabled. Maximum variable value is 102400 (0x19000), which means 100 GB.

Example of reg file:

    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\1093\1.0.0.0\Debug]

    "TraceDir"="O:\\Temp"

    "TraceLevel"=dword:00000004
    "TraceMaxSizeMB"=dword:00002000

In this example, trace files rotation is enabled and total trace file size of 8192 MB (8 GB). Logs will be saved to O:\temp. 

Note: in KSC14, klscflag.exe utility can be found in KSC installation folder, no need to copy the tool.