Log events

Session Recording can log events and tag events in recordings for later search and playback. You can search for events of interest from large amounts of recordings and locate the events during playback in the Session Recording Player.

System-defined events

Session Recording can log the following system-defined events:

• Insertion of USB mass storage devices

• Application starts and ends

• File renaming, creation, deletion, and moving operations within sessions and file transfers between session hosts (VDAs) and client devices (including mapped client drives and generic redirected mass storage devices)

• Web browsing activities

• Top-most window activities

• Clipboard activities

Insertion of USB mass storage devices

Session Recording can log the insertion of a Client Drive Mapping (CDM) mapped or generic redirected USB mass storage device in a client where Citrix Workspace app for Windows or for Mac is installed. Session Recording tags these events in the recording.

Note:

To use an inserted USB mass storage device and log the insertion events, set the Client USB device redirection policy to Allowed in Citrix Studio.

Currently, only the insertion of USB mass storage devices (USB Class 08) can be logged. For more information, see Event detection policies.

Application starts and ends

Session Recording supports logging of both application starts and ends. When you add a process to the App monitoring list, apps driven by the added process and its child processes are monitored. Child processes of a parent process that starts before Session Recording runs can also be captured.

Session Recording adds the process names, cmd.exe, powershell.exe, and wsl.exe, to the App monitoring list by default. If you select Log app start events and Log app end events for an event logging policy, the starts and ends of the Command Prompt, PowerShell, and Windows Subsystem for Linux (WSL) apps are logged regardless of whether you manually add their process names to the App monitoring list. The default process names are not visible on the App monitoring list.

In addition, Session Recording provides a full command line for each app start event logged.

File renaming, creation, deletion, and moving operations within sessions and file transfers between session hosts (VDAs) and client devices

Session Recording can log renaming, creation, deletion, and moving operations on target files and folders that you specify in the File monitoring list. Session Recording can also log file transfers between session hosts (VDAs) and client devices (including mapped client drives and generic redirected mass storage devices). Selecting the Log sensitive file events option triggers the logging of file transfers, no matter whether or not you specify the File monitoring list. For more information, see Event detection policies.

Note:

To enable file drag and drop and capture the drag and drop events, set the Drag and Drop policy to Enabled in Citrix Studio.

Web browsing activities

You can log user activities on supported browsers and tag the events in the recording. The browser name, URL, and page title are logged. For an example, see the following screen capture.

When you move your cursor away from a webpage that has focus, your browsing of this webpage is tagged without showing the browser name. This feature can be used to estimate how long a user stays on a webpage. For an example, see the following screen capture.

List of supported browsers:

Top-most window activities

Session Recording can log top-most window activities and tag the events in the recording. The process name, title, and process number are logged.

Clipboard activities

Session Recording can log copy operations of text, images, and files using the clipboard. The process name and file path are logged for a file copy. The process name and title are logged for a text copy. The process name is logged for an image copy.

Note: Content of copied text is not logged by default. To log text content, go to the Session Recording Agent and set HKEY_LOCAL_MACHINE\SOFTWARE\ Citrix\SmartAuditor\Agent\CaptureClipboardContent to 1(the default value is 0).

Custom events

The Session Recording Agent provides the IUserApi COM interface that third-party applications can use to add application-specific event data into recorded sessions. Based on the event customization, Session Recording can block sensitive information and log the session pause and session resume events accordingly.

Sensitive information blocking

Session Recording lets you skip certain periods when recording the screen and blocks sensitive information in these periods during session playback. To use this feature, use Session Recording 2012 and later.

To use this feature, complete the following steps:

1. In Session Recording Agent Properties, select the Allow third party applications to record custom data on this VDA machine check box and click Apply.

   

2. Grant users permission to invoke the Session Recording Event API (IUserApi COM interface).

   Session Recording added access control to the event API COM interface in version 7.15. Only authorized users are allowed to invoke the functionality to insert event metadata into a recording.

   Local administrators are granted with this permission by default. To grant other users this permission, use the Windows DCOM configuration tool:

   1. Open the Windows DCOM configuration tool on the Session Recording Agent by running dcomcnfg.exe.

      

   2. Right-click Citrix Session Recording Agent and choose Properties.

      

   3. Select the Security tab, click Edit to add users with Local Activation permission in the Launch and Activation Permissions section.

      

      

   Note:

   DCOM configuration takes effect immediately. There is no need to restart any services or the machine.

3. Start a Citrix virtual session.

4. Start PowerShell and change the current drive to the <Session Recording Agent installation path>\Bin folder to import the SRUserEventHelperSnapin.dll module.

5. Run the Session-Pause and Session-Resume cmdlets to set parameters for triggering sensitive information blocking.

   Parameter	Description	Required or Optional
   -APP	The app name that calls the cmdlet.	Required
   -Reason	The reason that content is blocked. If you leave this parameter unspecified, the default setting shows, stating Content Blocked and Sensitive information exists and is blocked. If you set this parameter, the reason you specify shows when you navigate to the blocked period during session playback.	Optional

   For example, you can run Session-Pause similar to the following:

   

Search for and play back recordings with tagged events

Search for recordings with tagged events

The Session Recording Player allows you to perform advanced searches for recordings with tagged events.

1. In the Session Recording Player, click Advanced Search on the tool bar or choose Tools > Advanced Search.
2. Define your search criteria in the Advanced Search dialog box.

The Events tab allows you to search for tagged events in sessions by Event text or Event type or both. You can use the Events, Common, Data/Time, and Other filters in combination to search for recordings that meet your criteria.

Note:

• The Event type list itemizes all event types that have been logged by Citrix Session Recording. You can select any one of the event types to search. Selecting Any Citrix-defined event means to search for all recordings with any type of events logged by Citrix Session Recording.
• The Event text filter supports partial match. Wildcards are not supported.
• The Event text filter is case-insensitive when matching.
• For the types of events, the words App Start, App End, Client drive mapping, and File Rename do not participate in matching when you search by Event text. Therefore, when you type App Start, App End, Client drive mapping, or File Rename in the Event text box, no result can be found.

Play back recordings with tagged events

When you play back a recording with events tagged, the events are present in the Events and Bookmarks panel and show as yellow dots in the lower part of the Session Recording Player:

You can use events to navigate through a recorded session, or skip to the points where the events are tagged.