Hi Marvin,
You can use this procedure from this Knowledgebase article:
linkHow to change the location of the agent log files?
This can be done by using the parameter <logger-dir>.Under: Main > Setup > AgentsSetting TABAdvanced configuration section (click the arrow to expand)Below text appears:
<agent-config>
<logger-level>log_warning</logger-level>
<logger-dir>.</logger-dir>
...
You should refer to the <logger-dir> tags, the value of dot refers to the default location where the agent is installed.
To change it, fill in the desired location, for example:
<logger-dir>F:\some\desired\dir</logger-dir>
See the screenshot below for a change example. Changing the location of the agent data queue files could be done by using parameter <files-dir>.
IMPORTANT NOTE - this parameter is used for data queue local storage path when the agent is disconnected from Gateway. When the connection restored, the data file (pcap) is sent to the Gateway.
Under: Main > Setup > Agents
Setting TAB
Advanced configuration section (click the arrow to expand)
Below text appears:
<agent-config>
<logger-level>log_warning</logger-level>
<files-dir>.</files-dir>
...
You should refer to the <files-dir> tags, the value of dot refers to the location where the agent is installed.
To change it, fill in the desired location, for example:
<files-dir>F:\some\desired\dir</files-dir>
Restart the agent after changing the settings.
Best,
------------------------------
Ira Miga
Imperva
Knowledge Engineer
------------------------------