Service Control 6.7.2 is not respecting custom log path location for all ServiceControl logs

[luizbon]

Describe the bug

Description

After upgrading to Service Control 6.7.2 in a VM hosting, the error and audit instances stopped working and could not start.

When checking the logs, the latest exception indicate RavenBD was not available, not accepting connections.

When checking Windows event logs, there were entries about ServiceControl trying to access /ImportErrors/Audit and /ImportErrors/Errors folders in the C: drive.

Because my instances are configured to use E: drive, the instances were failing to start.

Expected behavior

Service Control Error/Audit instance should start normally.

Actual behavior

Service Control Error/Audit instance start and stop after a few seconds.

Versions

6.7.2

Steps to reproduce

• Setup a Service Control instance (Error or Audit)
  • Point the logs path to a different drive other than C:
  • Run instance as service account
• Remove access to C:\Program Files (x86)\Particular Software\Particular.ServiceControl.Audit\.logs\FailedImports
• Attempt to start the instance.
  • Open the Event Viewer. You should see an error similar to System.UnauthorizedAccessException: Access to the path 'C:\Program Files (x86)\Particular Software\Particular.ServiceControl-Servicing.Audit\.logs\FailedImports\Audit' is denied.
  • The instance does not start

Relevant log output

Logs from log file (misleading error)

2025-08-08T03:04:47.8047183Z, 20, Operations, Server/TCP, Raven.Server.RavenServer, Failed to accept new tcp connection again, will wait 1 seconds before retrying, EXCEPTION: System.InvalidOperationException: Not listening. You must call the Start() method before calling this method.
   at System.Net.Sockets.TcpListener.AcceptSocketAsync(CancellationToken cancellationToken)
   at System.Net.Sockets.TcpListener.AcceptTcpClientAsync()
   at Raven.Server.RavenServer.AcceptTcpClientAsync(TcpListener listener) in /_/62039/src/Raven.Server/RavenServer.cs:line 2543
2025-08-08T03:04:47.8046379Z, 17, Operations, Server/TCP, Raven.Server.RavenServer, Failed to accept new tcp connection again, will wait 1 seconds before retrying, EXCEPTION: System.InvalidOperationException: Not listening. You must call the Start() method before calling this method.
   at System.Net.Sockets.TcpListener.AcceptSocketAsync(CancellationToken cancellationToken)
   at System.Net.Sockets.TcpListener.AcceptTcpClientAsync()
   at Raven.Server.RavenServer.AcceptTcpClientAsync(TcpListener listener) in /_/62039/src/Raven.Server/RavenServer.cs:line 2543
2025-08-08T03:04:47.8046841Z, 5, Operations, Server/TCP, Raven.Server.RavenServer, Failed to accept new tcp connection again, will wait 1 seconds before retrying, EXCEPTION: System.InvalidOperationException: Not listening. You must call the Start() method before calling this method.
   at System.Net.Sockets.TcpListener.AcceptSocketAsync(CancellationToken cancellationToken)
   at System.Net.Sockets.TcpListener.AcceptTcpClientAsync()
   at Raven.Server.RavenServer.AcceptTcpClientAsync(TcpListener listener) in /_/62039/src/Raven.Server/RavenServer.cs:line 2543
2025-08-08T03:04:47.8055722Z, 20, Operations, Server/TCP, Raven.Server.RavenServer, Failed to accept new tcp connection again, will wait 1 seconds before retrying, EXCEPTION: System.InvalidOperationException: Not listening. You must call the Start() method before calling this method.
   at System.Net.Sockets.TcpListener.AcceptSocketAsync(CancellationToken cancellationToken)
   at System.Net.Sockets.TcpListener.AcceptTcpClientAsync()
   at Raven.Server.RavenServer.AcceptTcpClientAsync(TcpListener listener) in /_/62039/src/Raven.Server/RavenServer.cs:line 2543
2025-08-08T03:04:47.8046313Z, 19, Operations, Server/TCP, Raven.Server.RavenServer, Failed to accept new tcp connection again, will wait 1 seconds before retrying, EXCEPTION: System.InvalidOperationException: Not listening. You must call the Start() method before calling this method.
   at System.Net.Sockets.TcpListener.AcceptSocketAsync(CancellationToken cancellationToken)
   at System.Net.Sockets.TcpListener.AcceptTcpClientAsync()
   at Raven.Server.RavenServer.AcceptTcpClientAsync(TcpListener listener) in /_/62039/src/Raven.Server/RavenServer.cs:line 2543
2025-08-08T03:04:47.8056179Z, 17, Operations, Server/TCP, Raven.Server.RavenServer, Failed to accept new tcp connection again, will wait 1 seconds before retrying, EXCEPTION: System.InvalidOperationException: Not listening. You must call the Start() method before calling this method.
   at System.Net.Sockets.TcpListener.AcceptSocketAsync(CancellationToken cancellationToken)
   at System.Net.Sockets.TcpListener.AcceptTcpClientAsync()
   at Raven.Server.RavenServer.AcceptTcpClientAsync(TcpListener listener) in /_/62039/src/Raven.Server/RavenServer.cs:line 2543
2025-08-08T03:04:47.9305053Z, 1, Operations, Server, Raven.Server.Program, Server has shut down
2025-08-08T03:04:47.9308884Z, 2, Operations, Server, Raven.Server.Program, Server is about to shut down (interactive mode)


Logs from Windows Event Viewer > Windows Logs > Applications > .Net Runtime Source

Log Name:      Application
Source:        .NET Runtime
Date:          8/8/2025 3:19:18 AM
Event ID:      1026
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      vm-*******
Description:
Application: ServiceControl.Audit.exe
CoreCLR Version: 8.0.1825.31117
.NET Version: 8.0.18
Description: The process was terminated due to an unhandled exception.
Exception Info: System.UnauthorizedAccessException: Access to the path 'C:\Program Files (x86)\Particular Software\Particular.ServiceControl-Servicing.Audit\.logs\FailedImports\Audit' is denied.
   at System.IO.FileSystem.CreateDirectory(String fullPath, Byte[] securityDescriptor)
   at System.IO.Directory.CreateDirectory(String path)
   at ServiceControl.Audit.Auditing.AuditIngestionFaultPolicy..ctor(IFailedAuditStorage failedAuditStorage, LoggingSettings settings, Func`3 onCriticalError, IngestionMetrics metrics, ILogger logger) in /_/src/ServiceControl.Audit/Auditing/AuditIngestionFaultPolicy.cs:line 35
   at ServiceControl.Audit.Auditing.AuditIngestion..ctor(Settings settings, ITransportCustomization transportCustomization, TransportSettings transportSettings, IFailedAuditStorage failedImportsStorage, State ingestionState, AuditIngestor auditIngestor, IAuditIngestionUnitOfWorkFactory unitOfWorkFactory, IHostApplicationLifetime applicationLifetime, IngestionMetrics metrics, ILogger`1 logger) in /_/src/ServiceControl.Audit/Auditing/AuditIngestion.cs:line 58
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Void** arguments, Signature sig, Boolean isConstructor)
   at System.Reflection.MethodBaseInvoker.InvokeWithManyArgs(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitConstructor(ConstructorCallSite constructorCallSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitRootCache(ServiceCallSite callSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSite(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitIEnumerable(IEnumerableCallSite enumerableCallSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitRootCache(ServiceCallSite callSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSite(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.Resolve(ServiceCallSite callSite, ServiceProviderEngineScope scope)
   at Microsoft.Extensions.DependencyInjection.ServiceProvider.CreateServiceAccessor(ServiceIdentifier serviceIdentifier)
   at System.Collections.Concurrent.ConcurrentDictionary`2.GetOrAdd(TKey key, Func`2 valueFactory)
   at Microsoft.Extensions.DependencyInjection.ServiceProvider.GetService(ServiceIdentifier serviceIdentifier, ServiceProviderEngineScope serviceProviderEngineScope)
   at Microsoft.Extensions.DependencyInjection.ServiceProvider.GetService(Type serviceType)
   at Microsoft.Extensions.DependencyInjection.ServiceProviderServiceExtensions.GetRequiredService(IServiceProvider provider, Type serviceType)
   at Microsoft.Extensions.DependencyInjection.ServiceProviderServiceExtensions.GetRequiredService[T](IServiceProvider provider)
   at Microsoft.Extensions.Hosting.Internal.Host.StartAsync(CancellationToken cancellationToken)
   at Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.RunAsync(IHost host, CancellationToken token)
   at Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.RunAsync(IHost host, CancellationToken token)
   at ServiceControl.Audit.Infrastructure.Hosting.Commands.RunCommand.Execute(HostArguments args, Settings settings) in /_/src/ServiceControl.Audit/Infrastructure/Hosting/Commands/RunCommand.cs:line 27
   at ServiceControl.Audit.Infrastructure.Hosting.Commands.CommandRunner.Execute(HostArguments args, Settings settings) in /_/src/ServiceControl.Audit/Infrastructure/Hosting/Commands/CommandRunner.cs:line 12
   at Program.<Main>$(String[] args) in /_/src/ServiceControl.Audit/Program.cs:line 40
   at Program.<Main>(String[] args)

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name=".NET Runtime" />
    <EventID Qualifiers="0">1026</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2025-08-08T03:19:18.8785420Z" />
    <EventRecordID>668333</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>vm-*******</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Application: ServiceControl.Audit.exe
CoreCLR Version: 8.0.1825.31117
.NET Version: 8.0.18
Description: The process was terminated due to an unhandled exception.
Exception Info: System.UnauthorizedAccessException: Access to the path 'C:\Program Files (x86)\Particular Software\Particular.ServiceControl-Servicing.Audit\.logs\FailedImports\Audit' is denied.
   at System.IO.FileSystem.CreateDirectory(String fullPath, Byte[] securityDescriptor)
   at System.IO.Directory.CreateDirectory(String path)
   at ServiceControl.Audit.Auditing.AuditIngestionFaultPolicy..ctor(IFailedAuditStorage failedAuditStorage, LoggingSettings settings, Func`3 onCriticalError, IngestionMetrics metrics, ILogger logger) in /_/src/ServiceControl.Audit/Auditing/AuditIngestionFaultPolicy.cs:line 35
   at ServiceControl.Audit.Auditing.AuditIngestion..ctor(Settings settings, ITransportCustomization transportCustomization, TransportSettings transportSettings, IFailedAuditStorage failedImportsStorage, State ingestionState, AuditIngestor auditIngestor, IAuditIngestionUnitOfWorkFactory unitOfWorkFactory, IHostApplicationLifetime applicationLifetime, IngestionMetrics metrics, ILogger`1 logger) in /_/src/ServiceControl.Audit/Auditing/AuditIngestion.cs:line 58
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Void** arguments, Signature sig, Boolean isConstructor)
   at System.Reflection.MethodBaseInvoker.InvokeWithManyArgs(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitConstructor(ConstructorCallSite constructorCallSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitRootCache(ServiceCallSite callSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSite(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitIEnumerable(IEnumerableCallSite enumerableCallSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitRootCache(ServiceCallSite callSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSite(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.Resolve(ServiceCallSite callSite, ServiceProviderEngineScope scope)
   at Microsoft.Extensions.DependencyInjection.ServiceProvider.CreateServiceAccessor(ServiceIdentifier serviceIdentifier)
   at System.Collections.Concurrent.ConcurrentDictionary`2.GetOrAdd(TKey key, Func`2 valueFactory)
   at Microsoft.Extensions.DependencyInjection.ServiceProvider.GetService(ServiceIdentifier serviceIdentifier, ServiceProviderEngineScope serviceProviderEngineScope)
   at Microsoft.Extensions.DependencyInjection.ServiceProvider.GetService(Type serviceType)
   at Microsoft.Extensions.DependencyInjection.ServiceProviderServiceExtensions.GetRequiredService(IServiceProvider provider, Type serviceType)
   at Microsoft.Extensions.DependencyInjection.ServiceProviderServiceExtensions.GetRequiredService[T](IServiceProvider provider)
   at Microsoft.Extensions.Hosting.Internal.Host.StartAsync(CancellationToken cancellationToken)
   at Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.RunAsync(IHost host, CancellationToken token)
   at Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.RunAsync(IHost host, CancellationToken token)
   at ServiceControl.Audit.Infrastructure.Hosting.Commands.RunCommand.Execute(HostArguments args, Settings settings) in /_/src/ServiceControl.Audit/Infrastructure/Hosting/Commands/RunCommand.cs:line 27
   at ServiceControl.Audit.Infrastructure.Hosting.Commands.CommandRunner.Execute(HostArguments args, Settings settings) in /_/src/ServiceControl.Audit/Infrastructure/Hosting/Commands/CommandRunner.cs:line 12
   at Program.&lt;Main&gt;$(String[] args) in /_/src/ServiceControl.Audit/Program.cs:line 40
   at Program.&lt;Main&gt;(String[] args)
</Data>
  </EventData>
</Event>

Additional Information

Workarounds

Give the instance service account write permissions to the default log path

Possible solutions

Fix the code where it is checking for FailedImports to follow the configured logs path.

Additional information

[mikeminutillo]

Thanks @luizbon. We will set up an environment to try and reproduce this. We will report back here with our findings.

[jpalac]

Hi @luizbon. We have reviewed this bug and added it to our bug fix queue. However, there is no ETA for when we will get to this bug as it may be prioritized behind other, more urgent, bugs. We will update this issue when it has a team assigned and work begins.