MS Defender causes Gather Logs to show error message and doesn't show UI to user

[adalbertblawatt]

Once MS Defender is installed the app shows an error when clicking on "Gather Logs". The Logs are created in /private/tmp but the User is not getting the UI to save the logs at a different location. On a device without MS Defender installed, same management configuration, the Gather Logs functionality works fine.

Error Log Message:
Error gathering logs: Error Domain=ExecutionServiceError Code=18 "Command '/bin/sh' failed with status 18: zip warning: Permission denied
zip warning: Permission denied
zip warning: Permission denied
zip warning: Permission denied
zip warning: Permission denied
zip warning: Permission denied
" UserInfo={NSLocalizedDescription=Command '/bin/sh' failed with status 18: zip warning: Permission denied
zip warning: Permission denied
zip warning: Permission denied
<…>

I have tried to exclude several paths, files and processes in Defender but with no success.

[almenscorner]

For my understanding, is the actual zip file that is to be moved to the user specified location created in /tmp but the UI does not show up?

[adalbertblawatt]

Yes, the zip file is getting created in /tmp.
and Yes, the UI does not show up. In the app the user gets this error message:

[almenscorner]

Does the zip contain data or is it just an empty zip?

[adalbertblawatt]

the zip contains all the data of the paths I provided via the configuration.
/Library/logs/
/var/log/

[almenscorner]

Are you absolutely sure that all logs you want is in the zip? why I'm asking is because it seems like defender is interfering with some of the files that should be zipped

[adalbertblawatt]

Indeed not the whole content gets zipped. After inspecting with diff -r /Library/Logs ~/Desktop/supportcompanion_logs/Library/Logs I noticed that all Defender logs are not in the zip file

Only in /Library/Logs/Microsoft/mdatp: install.log
Only in /Library/Logs/Microsoft/mdatp: microsoft_defender.log
Only in /Library/Logs/Microsoft/mdatp: microsoft_defender_core.log
Only in /Library/Logs/Microsoft/mdatp: microsoft_defender_diagnostic.log
Only in /Library/Logs/Microsoft/mdatp: microsoft_defender_enterprise.log
Only in /Library/Logs/Microsoft/mdatp: microsoft_defender_enterprise_telemetryd.log
Only in /Library/Logs/Microsoft/mdatp: microsoft_defender_mplog.log
Only in /Library/Logs/Microsoft/mdatp: microsoft_defender_network_protection.log

So for a fast test I removed /Library/Logs/ from the configuration to gather logs from and now the error is gone and the UI appears again to save the zip file at a different location.
I will exclude the defender folder and list all explicit folders which i need.
Maybe an info in the wiki could help others to avoid the same issue.
If possible an exclude option in the configuration profile of specific files or folders would also be great.

[almenscorner]

I'm working on a option to add folders to exempt from the log gathering. I'll add it in the next beta for testing.

[almenscorner]

I have added the exclusion config to the latest pre-release, please test this version and provide feedback: https://github.com/macadmins/SupportCompanion/releases/tag/v2.2.2.81022

[adalbertblawatt]

I tested the new version with the exclusion and this works fine - makes it easier to avoid MS Defender. I am still getting mixed behaviors trying to collect logs. Sometimes it works and sometimes it doesn't. Is it required to be admin to collect logs or should a standard user also be able to use it? We are using SAP Privileges App to demote our local users to standard users.

[almenscorner]

Standard users can collect logs but they must have permissions to them as the command is not running privileged. Is there any temp logs created a standard user does not have access to when this happens maybe?