{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-273-inspect-telemetry-offline-storage-under-the-application-s-actual-user-context/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-273-inspect-telemetry-offline-storage-under-the-application-s-actual-user-context/", "slug": "dse-20260909-273-inspect-telemetry-offline-storage-under-the-application-s-actual-user-context", "url": "https://update.dsesecurity.com/updates/dse-20260909-273-inspect-telemetry-offline-storage-under-the-application-s-actual-user-context/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-273-inspect-telemetry-offline-storage-under-the-application-s-actual-user-context.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-273-inspect-telemetry-offline-storage-under-the-application-s-actual-user-context/" }, "title": "Inspect telemetry offline storage under the application's actual user context", "summary": "Why should a Node.js or Python telemetry-cache review include application identity and directory?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:27:23+00:00", "modified_at": "2026-09-10T01:23:48+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 245, "potentially_affected": "Node.js and Python applications using Azure Monitor OpenTelemetry exporter offline storage.", "dse_recommendation": "Review the effective offline-storage location under the same user and application context that runs the service.", "primary_source": { "name": "Configuring OpenTelemetry in Application Insights - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/opentelemetry-configuration", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure Monitor OpenTelemetry caches disconnected telemetry and retries for up to 48 hours, but time or file-size limits can still cause loss. The documented Node.js and Python default cache paths contain a unique identifier derived from attributes including instrumentation key, process name, username and application directory. This separates storage locations for different user contexts. Both implementations allow a configured storage-directory override. Microsoft Learn.

\n

Applicability

\n

Use this check for the Node.js or Python implementation actually deployed. Establish whether offline storage is enabled and whether the application overrides the default path. Do not transfer a cache-location assumption from another language or from an interactive administrator session.

\n

DSE recommendation

\n

Review the effective offline-storage location under the same user and application context that runs the service. Ask the application owner to include that path in the approved handling and access review for telemetry. Before changing an account, process layout or deployment directory, determine how the intended cache configuration will be preserved. Treat the cache as temporary delivery support, not a guaranteed historical archive.

\n

Verification

\n

In a controlled nonproduction disconnection test, inspect the configured cache location and subsequent delivery after connectivity returns. Record the running identity and effective storage configuration with the observed result. Check any intentional directory override using the service’s permissions, without copying sensitive telemetry into the review report. Document losses or unverified behavior explicitly rather than assuming a retry window guarantees complete recovery.

\n

Official references

\n

Microsoft Learn: Configure Azure Monitor OpenTelemetry. Source reviewed September 9, 2026.

", "content_text": "Source facts\nAzure Monitor OpenTelemetry caches disconnected telemetry and retries for up to 48 hours, but time or file-size limits can still cause loss. The documented Node.js and Python default cache paths contain a unique identifier derived from attributes including instrumentation key, process name, username and application directory. This separates storage locations for different user contexts. Both implementations allow a configured storage-directory override. Microsoft Learn.\nApplicability\nUse this check for the Node.js or Python implementation actually deployed. Establish whether offline storage is enabled and whether the application overrides the default path. Do not transfer a cache-location assumption from another language or from an interactive administrator session.\nDSE recommendation\nReview the effective offline-storage location under the same user and application context that runs the service. Ask the application owner to include that path in the approved handling and access review for telemetry. Before changing an account, process layout or deployment directory, determine how the intended cache configuration will be preserved. Treat the cache as temporary delivery support, not a guaranteed historical archive.\nVerification\nIn a controlled nonproduction disconnection test, inspect the configured cache location and subsequent delivery after connectivity returns. Record the running identity and effective storage configuration with the observed result. Check any intentional directory override using the service’s permissions, without copying sensitive telemetry into the review report. Document losses or unverified behavior explicitly rather than assuming a retry window guarantees complete recovery.\nOfficial references\nMicrosoft Learn: Configure Azure Monitor OpenTelemetry. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nAzure Monitor OpenTelemetry caches disconnected telemetry and retries for up to 48 hours, but time or file-size limits can still cause loss. The documented Node.js and Python default cache paths contain a unique identifier derived from attributes including instrumentation key, process name, username and application directory. This separates storage locations for different user contexts. Both implementations allow a configured storage-directory override. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/app/opentelemetry-configuration).\n\n## Applicability\n\nUse this check for the Node.js or Python implementation actually deployed. Establish whether offline storage is enabled and whether the application overrides the default path. Do not transfer a cache-location assumption from another language or from an interactive administrator session.\n\n## DSE recommendation\n\nReview the effective offline-storage location under the same user and application context that runs the service. Ask the application owner to include that path in the approved handling and access review for telemetry. Before changing an account, process layout or deployment directory, determine how the intended cache configuration will be preserved. Treat the cache as temporary delivery support, not a guaranteed historical archive.\n\n## Verification\n\nIn a controlled nonproduction disconnection test, inspect the configured cache location and subsequent delivery after connectivity returns. Record the running identity and effective storage configuration with the observed result. Check any intentional directory override using the service’s permissions, without copying sensitive telemetry into the review report. Document losses or unverified behavior explicitly rather than assuming a retry window guarantees complete recovery.\n\n## Official references\n\n[Microsoft Learn: Configure Azure Monitor OpenTelemetry](https://learn.microsoft.com/en-us/azure/azure-monitor/app/opentelemetry-configuration). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-273-inspect-telemetry-offline-storage-under-the-application-s-actual-user-context/", "url": "https://update.dsesecurity.com/updates/dse-20260909-273-inspect-telemetry-offline-storage-under-the-application-s-actual-user-context/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-273-inspect-telemetry-offline-storage-under-the-application-s-actual-user-context/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Inspect telemetry offline storage under the application's actual user context", "item": "https://update.dsesecurity.com/updates/dse-20260909-273-inspect-telemetry-offline-storage-under-the-application-s-actual-user-context/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-273-inspect-telemetry-offline-storage-under-the-application-s-actual-user-context/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-273-inspect-telemetry-offline-storage-under-the-application-s-actual-user-context/", "url": "https://update.dsesecurity.com/updates/dse-20260909-273-inspect-telemetry-offline-storage-under-the-application-s-actual-user-context/", "headline": "Inspect telemetry offline storage under the application's actual user context", "description": "Why should a Node.js or Python telemetry-cache review include application identity and directory?", "abstract": "Why should a Node.js or Python telemetry-cache review include application identity and directory?", "articleBody": "Source facts\nAzure Monitor OpenTelemetry caches disconnected telemetry and retries for up to 48 hours, but time or file-size limits can still cause loss. The documented Node.js and Python default cache paths contain a unique identifier derived from attributes including instrumentation key, process name, username and application directory. This separates storage locations for different user contexts. Both implementations allow a configured storage-directory override. Microsoft Learn.\nApplicability\nUse this check for the Node.js or Python implementation actually deployed. Establish whether offline storage is enabled and whether the application overrides the default path. Do not transfer a cache-location assumption from another language or from an interactive administrator session.\nDSE recommendation\nReview the effective offline-storage location under the same user and application context that runs the service. Ask the application owner to include that path in the approved handling and access review for telemetry. Before changing an account, process layout or deployment directory, determine how the intended cache configuration will be preserved. Treat the cache as temporary delivery support, not a guaranteed historical archive.\nVerification\nIn a controlled nonproduction disconnection test, inspect the configured cache location and subsequent delivery after connectivity returns. Record the running identity and effective storage configuration with the observed result. Check any intentional directory override using the service’s permissions, without copying sensitive telemetry into the review report. Document losses or unverified behavior explicitly rather than assuming a retry window guarantees complete recovery.\nOfficial references\nMicrosoft Learn: Configure Azure Monitor OpenTelemetry. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:27:23+00:00", "dateModified": "2026-09-10T01:23:48+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-273-inspect-telemetry-offline-storage-under-the-application-s-actual-user-context/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-273-inspect-telemetry-offline-storage-under-the-application-s-actual-user-context/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Inspect telemetry offline storage under the application's actual user context" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 245, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configuring OpenTelemetry in Application Insights - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/opentelemetry-configuration" } } ] } }