OpsGenie Edge Connector with Git config giving fatal error on launch

[Darren_Burrows]

Hey all, 

We've been trialling getting OEC built and configured for automated self healing actions. Initial trials have gone well, with locally hosted scripts running fine. However we need to now look to bring Git into play for version control of the scripts in use. 

After some playing about over the day to get this running, I've finally got it launching OK. However it near instantly crashes due to not being able to read a config file, which I believe is a temp copy of the data it pulls from git. 

The logs give the following message: 

Could not read configuration: open C:\Windows\TEMP\oec165461519\main\resources\OpsGenie\OEC\conf\config.json: The system cannot find the path specified.

I've actively watched the folder when launching OEC and have seen for a split second that a folder with the name the logs reference as not being there is created and is then instantly deleted. 

I cannot see anything in windows server itself that could be doing this, eg Storage Sense is off and other temp files seem to be present and happily sat in the temp director from a few weeks back, so I can only assume this is being deleted by OEC itself, but I cannot see anything in the logs to confirm this, or to confirm they were even deleted. 

Anyone encountered this issue and have any ideas for how to work around this? 

[Darren_Burrows]

To add to this - finally managed to get something back from the audit logs, which suggests this is being deleted by OEC itself. 

A handle to an object was requested.

Subject:

Security ID: SYSTEM

Account Name: WIN-GRC2VFFKLQG$

Account Domain: WORKGROUP

Logon ID: 0x3E7

Object:

Object Server: Security

Object Type: File

Object Name: C:\Windows\Temp\oec301842295\.github\vale

Handle ID: 0x2bc

Resource Attributes: -

Process Information:

Process ID: 0x1aec

Process Name: C:\opsgenie\OpsgenieEdgeConnector64.exe

Access Request Information:

Transaction ID: {00000000-0000-0000-0000-000000000000}

Accesses: DELETE

SYNCHRONIZE

ReadAttributes

Access Reasons: DELETE: Granted by D:(A;ID;FA;;;BA)

SYNCHRONIZE: Granted by D:(A;ID;FA;;;BA)

ReadAttributes: Granted by D:(A;ID;FA;;;BA)

Access Mask: 0x110080

Privileges Used for Access Check: -

Restricted SID Count: 0