Serilog in ASP.NET Core Windows Service cannot write file as Local System

Question

I am running an ASP.NET Core web server as a Windows service and am using Serilog to log to a file in %PROGRAMDATA%. When I run the service as Local System, nothing is logged.

I am using .Net Core 2.2 on Windows 10. I am testing by triggering an error in my service that writes a log event at the error level. I've tried running the service as my own administrative account and the logging works fine; the issue only occurs when running as Local System.

I have other Windows Services using .Net Framework that run as Local System and have no problem logging to %PROGRAMDATA% with Serilog, but this is the first time I have tried it on .Net Core. I can manually create and write to the log file within the service with Directory.CreateDirectory and File.AppendText and that works while running as Local System, but the Serilog logging does not.

Here is my Program.Main:

public static async Task Main(string[] args)
{
    var isService = !(Debugger.IsAttached || args.Contains("--console"));       
    if (isService)
    {
        var pathToExe = Process.GetCurrentProcess().MainModule.FileName;
        var pathToContentRoot = Path.GetDirectoryName(pathToExe);
        Directory.SetCurrentDirectory(pathToContentRoot);
    }

    var host = WebHost.CreateDefaultBuilder(args.Where(arg => arg != "--console").ToArray())
        .UseStartup<Startup>()
        .UseSerilog((hostingContext, loggerConfiguration) => loggerConfiguration
            .ReadFrom.Configuration(hostingContext.Configuration)
            .Enrich.FromLogContext())
        .Build();

    // additional async initialization omitted

    if (isService)
    {
        host.RunAsService();
    }
    else
    {
        host.Run();
    }
}

And here is the Serilog section of my appsettings.json:

"Serilog": {
  "MinimumLevel": {
    "Default": "Verbose",
    "Override": {
      "Microsoft": "Warning",
      "System": "Warning"
    }
  },
  "WriteTo": [
    {
      "Name": "File",
      "Args": {
        "path": "%PROGRAMDATA%/foo/bar baz/logs/qux.log",
        "fileSizeLimitBytes": 1048576,
        "rollOnFileSizeLimit": "true",
        "retainedFileCountLimit": 99,
        "flushToDiskInterval": "00:00:01",
        "outputTemplate": "[{Timestamp:yyyy-MM-dd HH:mm:ss.fff} {Level:u3}] {Message:lj} [{SourceContext}]{NewLine}{Exception}"
      }
    },
    {
      "Name": "Console",
      "Args": {
        "outputTemplate": "[{Timestamp:HH:mm:ss.fff} {Level:u3}] {Message:lj} [{SourceContext}]{NewLine}{Exception}"
      }
    }
  ]
}

I expected logging to be written to the file in %PROGRAMDATA% when the service is running as Local System, but nothing happens. Logging is written without issue when the service is run as any other administrative account.

Answer 1

If i dont miss-understood it is nteresting with account system permissions:

A local system account of "local admin" is the same as an admin account.

if you have a Domain admin and you have a local admin. Both pretty much have the same function.

If you are part of a domain you typically do not want to log into your computer as the domain admin.

You always want to use the local admin account if you can. The reason behind this is that your computer may have a virus on it and you log in as domain admin you have just opened the door for to virus across your entire network

If you need to write to %PROGRAMDATA% then you should give the permission and use like this https://stackoverflow.com/a/30792263/914284