Configure event response policies
This policy setting lets you send email alerts and start screen recording immediately in response to logged events in recorded sessions. If you record only specific events without capturing any screens, you can configure an event trigger to start screen recording immediately when a specific event occurs. This feature is called event-triggered dynamic screen recording.
The only system-defined event response policy is Do not respond. You can create custom event response policies as needed. Only one event response policy can be active at a time.
For an example email alert, see the following screen capture:
Tip:
Clicking the playback URL opens the playback page of the recorded session in the web player. Clicking here opens the All recordings page in the web player.
System-defined event response policy
Session Recording provides one system-defined event response policy:
- Do not respond. By default, neither email alerts nor dynamic screen recording is provided in response to logged events in your recordings.
Create a custom event response policy
-
Log on as an authorized policy administrator to the server where the Session Recording policy console is installed.
-
Start the Session Recording policy console. By default, there is no active event response policy.
-
Select Event Response Policies in the left pane. From the menu bar, choose Add New Policy.
-
(Optional) Right-click the new event response policy and rename it.
-
Right-click the new event response policy and select Add Rule.
-
Select Email alert when a session start is detected or Use event triggers to specify how to respond when a session event is detected.
-
(Optional) Set email recipients and the email sender properties.
-
Type email addresses for the alert recipients in the Rules wizard.
-
Configure outgoing email settings in the Session Recording Server Properties.
Note:
If you select more than two options in the Email title section, a warning dialog appears, saying that the email subject might be too long. After you select Allow sending email notifications and click Apply, Session Recording sends an email to verify your email settings. If any setting is incorrect, for example, an incorrect password or port, Session Recording returns an error message with the error details.
Your email settings need about five minutes to take effect. To have your email settings take effect immediately or fix the issue that emails are not sent according to the settings, restart the Storage Manager (
CitrixSsRecStorageManager) service. Also, restart the Storage Manager service if you upgrade to the current release from Version 2006 and earlier. -
Edit registry for accessing the web player.
To make the playback URLs in your alert emails work as expected, browse to the registry key at
HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\SmartAuditor\Serverand do the following:-
Set the value data of LinkHost to the URL of the domain you use to access the web player. For example, to access a web player at
https://example.com/webplayer/#/player/, set the value data of LinkHost tohttps://example.com. -
Add a value, EmailThreshold, and set its value data to a number in the range of 1 through 100. The value data determines the maximum number of alert emails that an email sending account sends within a second. This setting helps slow down the number of emails that are being sent and thus reduces the CPU usage. If you leave the value data unspecified or set it to a number out of range, the value data falls back to 25.
Note:
-
Your email server might treat an email sending account as a spam bot and thus prevent it from sending emails. Before an account is allowed to send emails, an email client such as Outlook might request you to verify that the account is used by a human user.
-
There is a limit for sending emails within a given period. For example, when the daily limit is reached, you cannot send emails until the start of the next day. In this case, ensure that the limit is more than the number of sessions being recorded within the period.
-
-
-
(Optional) Configure event triggers.
After you select Use event triggers to specify how to respond when a session event is detected, the Configure Event Triggers button becomes available. Click it to specify logged events that can trigger email alerts, dynamic screen recording, or both.
Note:
You must select the event types that the active event detection policy logs. Click Confirm when you are finished.
Select event types from the drop-down list and set event rules through the two dimensions that are combined using the logical AND operator. You can set up to seven event rules. You can also define your event triggers in the Description column or leave the column empty. Your defined description of an event trigger is provided in the alert emails if you have Send email selected and events of the type are logged. If you have Start screen recording selected, dynamic screen recording automatically starts when certain events occur during an event-only recording. Set the time span for dynamic screen recording. If you leave the time span unspecified, screen recording continues until the recorded session ends.
For a complete list of supported event types, see the following table.
Event type Dimension Option App Start App name Full command line App End App name Top Most App name Windows title Web Browsing URL Tab title Browser name File Create Path File size(MB) File Rename Path Name File Move Source path Destination path File size(MB) File Delete Path File size(MB) CDM USB Drive letter Generic USB Device name Idle idle duration(Hrs) -
Click Next to select and edit the rule criteria.
Similar to when creating a custom recording policy, you can choose one or more rule criteria: Users or Groups, Published Applications or Desktop, Delivery Groups or Machines, and IP Address or IP Range. For more information, see the instructions in the Create a custom recording policy section.
Note:
When a session or an event meets more than one rule in a single event response policy, the oldest rule takes effect.
- Follow the wizard to complete the configuration.
- Activate the new event response policy.