NetScaler-UserLogging
NetScaler-UserLogging collects the ICA sessions that go through NetScaler Gateway — user, client IP, published application, server, login and logout — from the IPFIX stream that AppFlow sends. Every night it writes them to a CSV in the format you choose, compresses it, encrypts it with your PGP key and archives it for five years, where your SIEM or your auditors collect it over SFTP.
A web console in the browser, for whoever has to answer «who was connected». Below, on sample data, sessions open and close in real time: follow them on the dashboard, search the session log by user and try «Archivia Adesso» on the archiving page.
The interface is the product's own, in its original language; the data are sample data and the simulation is not connected to any system.
Sooner or later someone asks: an audit, a security incident, a rule that wants access logs kept for years. The NetScaler knows who opened which Citrix session, but it does not keep years of history, and its logs are not made to answer by user, by application and by day.
Putting together logins and logouts from scattered logs, day after day, is not a job anyone can keep doing.
The NetScaler sends its AppFlow records over IPFIX to a Linux VM. There ipfixcol2 decodes the Citrix fields and NetScaler-UserLogging follows every ICA session from login to logout, closing on timeout the ones that never send a logout.
Every night the closed sessions become an encrypted archive. A web console shows the sessions as they happen, the archive of every day and the state of the services.
User, domain, client IP and host name, published application or desktop, server, login, logout and duration, from the Citrix fields of AppFlow. A session without a logout is closed after four hours without updates, and none stays open more than a day.
Pick and order the columns among 43 fields, with one row per session or one per login and logout; choose separator, encoding and file name, and mark the sessions that come from your VPN subnets.
Every night the closed sessions become a gzip or bzip2 file encrypted with OpenPGP, filed by year and month. An archive can also be started by hand from the console.
Read-only SFTP accounts in a chroot for the SIEM or the auditors, with the log of every download. A calendar shows, day by day, whether the archive was generated and whether it was collected.
Live dashboard, session log with filters and a per-user view, a legend of the values received, the NetScaler commands ready to copy, local users with or without administrator rights, HTTPS with your certificate.
systemd services, a watchdog every minute, database maintenance that takes a backup before every change, an installation script for Rocky Linux 9 and update packages.
A Rocky Linux 9 VM close to the NetScaler; the installation script sets up ipfixcol2, the services and the firewall.
Collector, action, a policy bound to ICA traffic and AppFlow logging on the Gateway's VPN virtual server: the console writes the commands with your addresses.
The public PGP key of whoever will read the logs, the CSV columns, the compression and the SFTP accounts.
Sessions appear in the console as they open and close; every night the archive is ready to be collected.
No. The NetScaler sends AppFlow straight to the collector over IPFIX; no other Citrix product is involved.
If the NetScaler stops sending updates, the session is closed as TIMEOUT after four hours; in any case none stays open more than 24 hours. Both limits are settings.
With PGP set up, only whoever holds the private key matching the public key you import: the server encrypts and never has that private key.
Yes. The collector is a VM of yours, the console needs nothing from the Internet, and the archives leave only through the SFTP accounts you create.
No. It is a product of Corellix Software Engineering that uses AppFlow, a NetScaler feature, and the open-source collector ipfixcol2. NetScaler and Citrix are trademarks of Cloud Software Group, Inc.
We will show you NetScaler-UserLogging on sample data and plan with you the AppFlow configuration and the delivery of the archives to your systems.
Rather write to us? Contact page
NetScaler-UserLogging is designed, built and supported by Corellix Software Engineering: the team behind the Corellix platform, which also builds custom software, infrastructure tools and data migrations.
About us All solutions