# Inspect telemetry offline storage under the application's actual user context

> Why should a Node.js or Python telemetry-cache review include application identity and directory?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-273-inspect-telemetry-offline-storage-under-the-application-s-actual-user-context/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:27:23+00:00
- Modified: 2026-09-10T01:23:48+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Why should a Node.js or Python telemetry-cache review include application identity and directory?

## Potentially affected

Node.js and Python applications using Azure Monitor OpenTelemetry exporter offline storage.

## DSE recommendation

Review the effective offline-storage location under the same user and application context that runs the service.

## Article

## Source facts

Azure Monitor OpenTelemetry caches disconnected telemetry and retries for up to 48 hours, but time or file-size limits can still cause loss. The documented Node.js and Python default cache paths contain a unique identifier derived from attributes including instrumentation key, process name, username and application directory. This separates storage locations for different user contexts. Both implementations allow a configured storage-directory override. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/app/opentelemetry-configuration).

## Applicability

Use this check for the Node.js or Python implementation actually deployed. Establish whether offline storage is enabled and whether the application overrides the default path. Do not transfer a cache-location assumption from another language or from an interactive administrator session.

## DSE recommendation

Review the effective offline-storage location under the same user and application context that runs the service. Ask the application owner to include that path in the approved handling and access review for telemetry. Before changing an account, process layout or deployment directory, determine how the intended cache configuration will be preserved. Treat the cache as temporary delivery support, not a guaranteed historical archive.

## Verification

In a controlled nonproduction disconnection test, inspect the configured cache location and subsequent delivery after connectivity returns. Record the running identity and effective storage configuration with the observed result. Check any intentional directory override using the service’s permissions, without copying sensitive telemetry into the review report. Document losses or unverified behavior explicitly rather than assuming a retry window guarantees complete recovery.

## Official references

[Microsoft Learn: Configure Azure Monitor OpenTelemetry](https://learn.microsoft.com/en-us/azure/azure-monitor/app/opentelemetry-configuration). Source reviewed September 9, 2026.

## Primary reference

- Name: Configuring OpenTelemetry in Application Insights - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/app/opentelemetry-configuration
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Inspect telemetry offline storage under the application's actual user context,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-273-inspect-telemetry-offline-storage-under-the-application-s-actual-user-context/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.