Log events

Session Recording can log events and tag events in recordings for later search and playback. You can easily search for events of interest from large amounts of recordings and can locate the events during playback in the Session Recording Player.

Events that can be logged

Session Recording can log the following events:

  • Insertion of USB mass storage devices

  • Application starts and ends

  • File renaming, creation, deletion, and moving operations

Insertion of USB mass storage devices

Session Recording can log the insertion of a Client Drive Mapping (CDM) mapped or generic redirected USB mass storage device in a client device where Citrix Workspace app for Windows or for Mac is installed, and can tag the event in the recording.

Note:

Currently, only the insertion of USB mass storage devices (USB Class 08) can be logged. To make the feature work as expected:

Upgrade both Session Recording and the VDA to Version 7.17 or later if you use this feature by editing the registry, or

Upgrade the Session Recording Administration components and the Session Recording Agent to Version 1811 or later if you configure an event logging policy in the Session Recording Policy Console. For more information, see Event logging policies.

Application starts and ends

Session recording supports the logging of both application starts and ends.

Note:

To make the feature work as expected:

Upgrade both the Session Recording Agent and the Session Recording Player to Version 1808 or later if you use this feature by editing the registry, or

Upgrade the Session Recording Administration components and the Session Recording Agent to Version 1811 or later if you configure an event logging policy in the Session Recording Policy Console. For more information, see Event logging policies.

To specify applications to monitor through the registry filter AppMonitorList:

  1. Log on as an administrator to the machine where you installed the Session Recording Agent.
  2. Open the Registry Editor.
  3. Browse to HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\SmartAuditor\SessionEvents.
  4. Add the process names of target applications in the AppMonitorList.

    image of appmonitorlist

Note:

  • To capture the start and end of an application, add the process name of the application in the AppMonitorList. For example, to capture the start of Remote Desktop Connection, add the process name mstsc.exe in the AppMonitorList.
  • AppMonitorList is a multi-string registry. Each string added must end with a CRLF.
  • Only exact match is supported. Wildcards are not supported.
  • Process names you add are case-insensitive.
  • To avoid an excessive number of events from flooding the recordings, do not add any system process names (for example, explorer.exe) and web browsers in the registry.

File renaming, creation, deletion, and moving operations

You can log file or subfolder renaming, creation, deletion, and moving operations in target folders, and tag the events in the recording.

Note:

To make the feature work as expected, upgrade all Session Recording components including the Session Recording Administration components, the Session Recording Agent, and the Session Recording Player to Version 1811 or later.

On the Session Recording Agent, a registry key EnableFileOperationMonitorEvents is added for enabling or disabling the feature. The registry key is set to 0 by default, which means the feature is disabled by default.

Note:

Currently, file operations are captured through registry settings only.

Enable or disable the logging feature

To enable or disable the feature:

  1. After the Session Recording installation is complete, log on as an administrator to the machine where you installed the Session Recording Agent.
  2. Open the Registry Editor.
  3. Browse to HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\SmartAuditor\SessionEvents.
  4. Set the value of EnableSessionEvents to 1 or use the default value, 0.
    1: enable event logging globally
    0: disable event logging globally
  5. Set the value of EnableFileOperationMonitorEvents to 1 or use the default value, 0.
    1: enable the logging of file renaming, creation, deletion, and moving operations
    0: disable the logging of file renaming, creation, deletion, and moving operations

    To enable the logging of file renaming, creation, deletion, and moving operations, set both EnableSessionEvents and EnableFileOperationMonitorEvents to 1.

  6. Restart the Session Recording Agent to make your settings take effect.
    If you are using MCS or PVS for deployment, change the settings on your master image and perform an update to make your change take effect.

Warning:

Incorrectly editing the registry can cause serious problems that might require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. Be sure to back up the registry before you edit it.

Specify target folders to monitor

A registry filter named FileOperationMonitorList is available for you to specify target folders to monitor and to avoid an excessive number of events from flooding the recordings. No folder is specified by default, which means no file is captured by default.

To specify folders to monitor, do the following:

  1. Log on as an administrator to the machine where you installed the Session Recording Agent.
  2. Open the Registry Editor.
  3. Browse to HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\SmartAuditor\SessionEvents.
  4. Add the path strings of target folders in the FileOperationMonitorList.

    image of fileoperationmonitorlist

    Note:

    • To capture renaming, creation, deletion, or moving operations on a file, add the path string of the file folder (not the file name or the root path of the file folder) in the FileOperationMonitorList. For example, to capture renaming, creation, deletion, and moving operations on the sharing.ppt file in C:\User\File, add the path string C:\User\File in the FileOperationMonitorList.
    • Both local file paths and remote shared folder paths are supported. For example, to capture operations on the RemoteDocument.txt file in the \\remote.address\Documents folder, add the path string \\remote.address\Documents in the FileOperationMonitorList.
    • FileOperationMonitorList is a multi-string registry. Each string added must end with a CRLF. The maximum length of each string is 247 characters. Strings exceeding the maximum length are ignored.
    • Only exact match is supported. Wildcards are not supported.
    • Path strings you add are case-insensitive.
  5. Restart the Session Recording Agent Service to make your setting take effect.
    If you are using MCS or PVS for deployment, change the setting on your master image and perform an update to make your change take effect.

Limitations

  • Moving files or folders from an unmonitored local folder to a monitored local folder cannot be captured.
  • When the length of a file or folder path including the file or folder name exceeds the maximum length (260 characters), operations on the file or folder cannot be captured.
  • Pay attention to the database size and back up or delete the “Event” table regularly to avoid massive numbers of events being captured.
  • When massive numbers of events are captured at time intervals, the Player displays and the database stores only one event item for each event type to avoid storage expansion.

Search for and play back recordings with tagged events

Search for recordings with tagged events

The Session Recording Player allows you to perform advanced searches for recordings with tagged events.

  1. In the Session Recording Player, click Advanced Search on the tool bar or choose Tools > Advanced Search.
  2. Define your search criteria in the Advanced Search dialog box.

The Events tab allows you to search for tagged events in sessions by Event text and/or Event type. You can use the Events, Common, Data/Time, and Other filters in combination to search for recordings that meet your criteria.

image of file renaming log search

Note:

  • The Event type list itemizes all event types that have been logged by Citrix Session Recording. You can select any one of the event types to search. Selecting Any Citrix-defined event means to search for all recordings with any type of events logged by Citrix Session Recording.
  • The Event text filter supports partial match. Wildcards are not supported.
  • The Event text filter is case-insensitive when matching.
  • For the Citrix.EventMonitor.AppStart, Citrix.EventMonitor.AppEnd, Citrix.EventMonitor.CDMUSBDriv, Citrix.EventMonitor.FileCreate, Citrix.EventMonitor.FileDelete, Citrix.EventMonitor.FileMove, and Citrix.EventMonitor.FileRename events, the words App Start, App End, Client drive mapping, and File Rename do not participate in matching when you search by Event text. Therefore, when you type App Start, App End, Client drive mapping, or File Rename in the Event text box, no result can be found.

Play back recordings with tagged events

When you play back a recording with events tagged, the events are present in the Events and Bookmarks panel and show as yellow dots in the lower part of the Session Recording Player as follows:

image of playbackrecordingswithtaggedevents

You can use events to navigate through a recorded session, or skip to the points where the events are tagged.

Version

Log events