# Secure Log Capture Workflow (High-Level Overview)

When diagnosing application issues in production, logs like GC logs, thread dumps,heap dumps and system-level logs can contain sensitive information such as memory contents, credentials, or internal application data. To protect this information, the yc-360 script supports secure end-to-end encryption.

With this feature, all captured diagnostic data is encrypted immediately, ensuring it remains protected during transfer and storage. Only the intended server (yCrash server), equipped with the correct private key, can decrypt and analyze the logs.

This is particularly valuable in scenarios where end users do not have access to the yCrash server but need to securely share diagnostic data with a primary user or support team for further analysis. This feature allows to collect logs from restricted or customer-controlled environments and transfer them to centralized analysis systems without exposing sensitive information.

The steps below describe what both the primary user and their end user need to do in order to securely collect and analyze logs using
the yc-360 script.

# Primary User (You)

1. Generate RSA Key Pair

Run the following command using the yc-codec.jar utility:

java -jar yc-codec.jar gen-keypair
1

This will:

  • Generate a secure RSA public/private key pair.
  • Save the keys in a rsa-keypair/ folder.
  • Print the public key in PEM format to the console.

2.Export Public Key

Copy the printed public key and save it to a file named public-key.pem.

3. Securely Store the Private Key

The private key (private_key.pkcs8) should be stored in a secure location, such as a PKCS#12 keystore, and only accessible to the yc-server.

# End User (Your Customer)

4.Place the Public Key

Place the public-key.pem file in any directory on the application server.

5.Run the Log Capture Script

Instruct the end user to run the following command with the public key file path to securely capture logs:

./yc -onlyCapture -publicKeyPath /path/to/public-key.pem ...
1

This will:

  • Capture logs from the local application/system.
  • Encrypt the logs using AES-256 GCM.
  • Encrypt the AES key using the provided RSA public key.
  • Package the encrypted logs and keys into a zip file (e.g., yc-<timestamp>.zip), ready for secure sharing.

# Final Step (Back to Primary User)

Once the end user shares the encrypted zip file:

  • The primary user manually uploads the zip file to the yCrash application.
  • The yc-server uses the stored private key to decrypt and analyze the logs securely.

Note: Detailed step-by-step instructions will be added soon.

← Docker Container →