Log events

Session Recording can log events and tag events in recordings for later search and playback. You can easily search for events of interest from large amounts of recordings and can locate the events during playback in the Session Recording Player.

Log insertion of USB mass storage devices

Session Recording can log the insertion of a Client Drive Mapping (CDM) mapped or generic redirected USB mass storage device in a client device where Citrix Workspace app for Windows or for Mac is installed, and can tag the event in the recording.

Note:

Currently, only the insertion of USB mass storage devices (USB Class 08) can be logged. To make the feature work as expected, upgrade both Session Recording and the VDA to Version 7.17 or later.

Enable or disable the logging feature

On the Session Recording Agent, three registry keys are added for enabling or disabling the feature. The keys are set to 0 by default, which means the feature is disabled by default.

To enable or disable the feature, do the following:

  1. After the Session Recording installation is complete, log on as an administrator to the machine where you installed the Session Recording Agent.
  2. Open the Registry Editor.
  3. Browse to HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\SmartAuditor\SessionEvents.
  4. Set the value of EnableSessionEvents to 1 or use the default value, 0.
    1: enable event logging globally
    0: disable event logging globally
  5. Set the value of EnableCDMUSBDriveEvents to 1 or use the default value, 0.
    1: enable logging the insertion of CDM mapped USB mass storage devices
    0: disable logging the insertion of CDM mapped USB mass storage devices
  6. Set the value of EnableGenericUSBDriveEvents to 1 or use the default value, 0.
    1: enable logging the insertion of generic redirected USB mass storage devices
    0: disable logging the insertion of generic redirected USB mass storage devices
  7. (Optional) In Citrix Studio, configure the CDM mapping policy (enabled by default) and the USB redirection policy (disabled by default) as required.

The following table describes the usage scenarios and the corresponding registry key settings.

Scenario Registry Key Setting
To log the insertion of both CDM mapped and generic redirected USB mass storage devices EnableSessionEvents = 1; EnableCDMUSBDriveEvents = 1; EnableGenericUSBDriveEvents = 1
To log the insertion of only CDM mapped USB mass storage devices EnableSessionEvents = 1;EnableCDMUSBDriveEvents = 1; EnableGenericUSBDriveEvents = 0
To log the insertion of only generic redirected USB mass storage devices EnableSessionEvents = 1; EnableCDMUSBDriveEvents = 0; EnableGenericUSBDriveEvents = 1
To disable event logging globally EnableSessionEvents = 0; EnableCDMUSBDriveEvents = 0; EnableGenericUSBDriveEvents = 0

Warning:

Incorrectly editing the registry can cause serious problems that might require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. Be sure to back up the registry before you edit it.

Log application starts and ends

Session recording supports the logging of both application starts and ends. This feature extends the diversity of events that Session Recording can capture.

Note:

To make the feature work as expected, upgrade both the Session Recording Agent and the Session Recording Player to Version 1808 or later.

Enable or disable the logging feature

On the Session Recording Agent, a registry key EnableAppLaunchEvents is added for enabling or disabling the feature. The registry key is set to 0 by default, which means the feature is disabled by default.

To enable or disable the feature, do the following:

  1. After the Session Recording installation is complete, log on as an administrator to the machine where you installed the Session Recording Agent.
  2. Open the Registry Editor.
  3. Browse to HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\SmartAuditor\SessionEvents.
  4. Set the value of EnableSessionEvents to 1 or use the default value, 0.
    1: enable event logging globally
    0: disable event logging globally
  5. Set the value of EnableAppLaunchEvents to 1 or 2 or use the default value, 0.
    1: enable the logging of only application starts
    2: enable the logging of both application starts and ends
    0: disable the logging of application starts and ends
Scenario Registry Key Setting
To enable the logging of only application starts EnableSessionEvents = 1; EnableAppLaunchEvents = 1
To enable the logging of both application starts and ends EnableSessionEvents = 1; EnableAppLaunchEvents = 2
To disable the logging of application starts and ends Set either or both of the following two registries to 0: EnableSessionEvents = 0; EnableAppLaunchEvents = 0

Warning:

Incorrectly editing the registry can cause serious problems that might require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. Be sure to back up the registry before you edit it.

Specify target applications to monitor

A registry filter named AppMonitorList is available for you to specify target applications to monitor and to avoid excessive amount of events from flooding the recordings. No application is specified by default, which means no application is captured by default.

To specify applications to monitor, do the following:

  1. Log on as an administrator to the machine where you installed the Session Recording Agent.
  2. Open the Registry Editor.
  3. Browse to HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\SmartAuditor\SessionEvents.
  4. Add the process names of target applications in the AppMonitorList.

localized image

Note:

  • To capture the start and end of an application, add the process name of the application in the AppMonitorList. For example, to capture the start of Remote Desktop Connection, add the process name mstsc.exe in the AppMonitorList.
  • AppMonitorList is a multi-string registry. Each string added must end with a CRLF.
  • Only exact match is supported. Wildcards are not supported.
  • Process names you add are case-insensitive.
  • To avoid excessive amount of events from flooding the recordings, do not add any system process names (for example, explorer.exe) and web browsers in the registry.

Log file renaming operations (experimental feature)

You can log file renaming operations in target folders and tag the event in the recording.

Note:

To make the feature work as expected, upgrade all Session Recording components including the Session Recording Administration components, the Session Recording Agent, and the Session Recording Player to Version 1808 or later.

Enable or disable the logging feature

On the Session Recording Agent, a registry key EnableFileOperationMonitorEvents is added for enabling or disabling the feature. The registry key is set to 0 by default, which means the feature is disabled by default.

To enable or disable the feature, do the following:

  1. After the Session Recording installation is complete, log on as an administrator to the machine where you installed the Session Recording Agent.
  2. Open the Registry Editor.
  3. Browse to HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\SmartAuditor\SessionEvents.
  4. Set the value of EnableSessionEvents to 1 or use the default value, 0.
    1: enable event logging globally
    0: disable event logging globally
  5. Set the value of EnableFileOperationMonitorEvents to 1 or use the default value, 0.
    1: enable the logging of file renaming operations
    0: disable the logging of file renaming operations

    To enable the logging of file renaming operations, set both EnableSessionEvents and EnableFileOperationMonitorEvents to 1.

  6. Restart the Session Recording Agent to make your settings take effect.
    If you are using MCS or PVS for deployment, change the settings on your master image and perform an update to make your change take effect.

Warning:

Incorrectly editing the registry can cause serious problems that might require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. Be sure to back up the registry before you edit it.

Specify target folders to monitor

In the experimental phase, a registry filter named FileOperationMonitorList is available for you to specify target folders to monitor and to avoid excessive amount of events from flooding the recordings. No folder is specified by default, which means no file is captured by default.

To specify folders to monitor, do the following:

  1. Log on as an administrator to the machine where you installed the Session Recording Agent.
  2. Open the Registry Editor.
  3. Browse to HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\SmartAuditor\SessionEvents.
  4. Add the path strings of target folders in the FileOperationMonitorList.

    localized image

    Note:

    • To capture renaming operations on a file, add the path string of the file folder in the FileOperationMonitorList. For example, to capture renaming operations on the sharing.ppt file in C:\User\File, add the path string C:\User\File in the FileOperationMonitorList.
    • FileOperationMonitorList is a multi-string registry. Each string added must end with a CRLF.
    • Only exact match is supported. Wildcards are not supported.
    • Path strings you add are case-insensitive.
  5. Restart the Session Recording Agent Service to make your setting take effect.
    If you are using MCS or PVS for deployment, change the setting on your master image and perform an update to make your change take effect.

Search for and play back recordings with tagged events

Search for recordings with tagged events

The Session Recording Player allows you to perform advanced searches for recordings with tagged events.

  1. In the Session Recording Player, click Advanced Search on the tool bar or choose Tools > Advanced Search.
  2. Define your search criteria in the Advanced Search dialog box.

The Events tab allows you to search for tagged events in sessions by Event text and/or Event type. You can use the Events, Common, Data/Time, and Other filters in combination to search for recordings that meet your criteria.

localized image

Note:

  • The Event type drop-down list itemizes all event types that have been logged by Citrix Session Recording. You can select any one of the event types to search. Selecting Any Citrix-defined event means to search for all recordings with any type of events logged by Citrix Session Recording.
  • The Event text filter supports partial match. Wildcards are not supported.
  • The Event text filter is case-insensitive when matching.
  • For the Citrix.EventMonitor.AppStart, Citrix.EventMonitor.AppEnd, Citrix.EventMonitor.CDMUSBDriveAttach, and Citrix.EventMonitor.FileRename events, the words App Start, App End, Client drive mapping, and File Rename do not participate in matching when you search by Event text. Therefore, when you type App Start, App End, Client drive mapping, or File Rename in the Event text box, no result can be found.

Play back recordings with tagged events

When you play back a recording with events tagged, the events are present in the Events and Bookmarks panel and show as yellow dots in the lower part of the Session Recording Player as follows:

localized image

You can use events to navigate through a recorded session, or skip to the points where the events are tagged.