Just in time logging
Previous Top Next


Just-in-time (JIT) logging

 When just-in-time logging is enabled, Logging can be used "on-demand" on an end-user's machine. You can control when logged is enabled by setting environment variables, registry keys, or running log monitor.
Logging all Thinstall Processes for a specific Application and all child processes
Set the environment variable TS_TRACE=1 before running the application in question. The application and all child processes will generate .trace files.

Logging all Thinstall Processes for a specific user
Set HKEY_CURRENT_USER\Software\Thinstall_Diagnostics\trace_all=1 (DWORD value)

Logging a specific Thinstall Processes for a specific user
Set HKEY_CURRENT_USER\Software\Thinstall_Diagnostics\EXE_NAME.EXE=1 (DWORD value)
Note: EXE_NAME should be the name of the Thinstall EXE without the path.

Logging all Processes for the entire machine
Set HKEY_LOCAL_MACHINE\Software\Thinstall_Diagnostics\trace_all=1 (DWORD value)

Logging a specific Thinstall Processes for on the entire machine
Set HKEY_LOCAL_MACHINE\Software\Thinstall_Diagnostics\EXE_NAME.EXE=1 (DWORD value)
Note: EXE_NAME should be the name of the Thinstall EXE without the path.

Logging all Thinstall processes for a single Terminal Server Session
Run the log_monitor utility. Note: the version of log_monitor must match the version of the Thinstall Virtual OS the application was built with or logging will not occur.


What are the advantages of leaving JIT logging on or off?

- JIT logging does not consume any additional memory or CPU when it is not active. When JIT logging is enable, additional memory is required and application performance can decrease slightly or significantly depending on the application design and how heavily it calls Win32 API functions.

- For developers interested in protecting their application from reverse engineering, JIT logging could represent a security threat since end users could watch the application's internal workings. Because .trace files in their native binary format are not readable or comprehensiable, an attacker would first need access to Thinstall's log_monitor application.

- JIT logging requires a slightly smaller disk size when deploying ~50k.