View administrator logging
Session Recording Administrator Logging logs the following activities:
-
Changes to policies on the Session Recording Policy Console or Citrix Director.
-
Changes in Session Recording Server Properties.
-
Playback of recordings.
-
Policy query before a session is recorded.
-
Unauthorized attempts to access the Administrator Logging service.
Warning:
Editing the registry incorrectly can cause serious problems that might require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of the Registry Editor can be solved. Use the Registry Editor at your own risk. Be sure to back up the registry before you edit it.
Disable or enable Administrator Logging
After installation, you can disable or enable the Session Recording Administrator Logging feature in Session Recording Server Properties.
- As an administrator, log on to the machine where Session Recording Administrator Logging is installed.
- From the Start menu, choose Session Recording Server Properties.
- Click the Logging tab.
When Session Recording Administrator Logging is disabled, no new activities are logged. You can query the existing logs from the web-based UI.
When mandatory blocking is enabled, the following activities are blocked if the logging fails. A system event is also logged with an Event ID 6001:
- Changes to recording policies on the Session Recording Policy Console or Citrix Director.
- Changes in Session Recording Server Properties.
The mandatory blocking setting does not impact the recording of sessions.
Configure an Administrator Logging service account
By default, Administrator Logging is running as a web application in Internet Information Services (IIS), and its identity is Network Service. To enhance the security level, you can change the identity of this web application to a service account or a specific domain account.
- As an administrator, log on to the machine hosting the Session Recording Server.
- In IIS Manager, click Application Pools.
- In Application Pools, right-click SessionRecordingLoggingAppPool and choose Advanced Settings.
- Change the attribute identity to the specific account that you want to use.
- Grant the db_owner permission to the account for the database CitrixSessionRecordingLogging on the Microsoft SQL Server.
- Grant the read permission to the account for the registry key at HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\SmartAuditor\Server.
Disable or enable the recording action logging
By default, Administrator Logging logs every recording action after the policy query completes. This case might generate a large amount of loggings. To improve the performance and save the storage, disable this kind of logging in the registry.
- As an administrator, log on to the machine hosting the Session Recording Server.
- Open the Registry Editor.
- Browse to HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\SmartAuditor\Server.
-
Set the value of EnableRecordingActionLogging to:
0: disable the recording action logging
1: enable the recording action logging
Query the Administrator Logging data
Session Recording provides a web-based UI to query all Administrator Logging data.
On the computer hosting the Session Recording Server:
- From the Start menu, choose Session Recording Administrator Logging.
-
Type the credentials of a LoggingReader user.
The Administrator Logging webpage integrated with the web player appears.
On other machines:
- Open a web browser and visit the webpage for Administrator Logging.
-
For HTTPS:
https://servername/WebPlayer/#/logging/configandhttps://servername/WebPlayer/#/logging/record, whereservernameis the name of the machine hosting the Session Recording Server. -
For HTTP:
http://servername/WebPlayer/#/logging/configandhttp://servername/WebPlayer/#/logging/record, whereservernameis the name of the machine hosting the Session Recording Server.
-
For HTTPS:
- Type the credentials of a LoggingReader user.
Administrator Logging integrated with the web player
The web player integrates the Administrator Logging webpage. An administrator assigned to both the LoggingReader and the Player roles can view the administrator activity logs in the web player.
Note:
The language set for the web player browser must match the language you selected when you installed the Session Recording Administration components.
-
Configuration logging:
-
Recording reason logging:
Ensure that your SessionRecordingLoggingWebApplication site in IIS and the web player have the same SSL settings. Otherwise, 403 errors occur when you request to access the administrator activity logs.
