Looking for a MetaFrame tool for enhanced user activity logging

[chrisbc]

I am a newbie, and I am not even the Citrix admin or the Windows admin. I am a firewall/VPN/security admin and I'm trying to get a comfort level with a proposal to provide external access to MetaFrame. My firewall log can tell me precisely the userid and source ip of the entity hitting the server, so I'm ok with access to the MetaFrame server. I need a way to determine where a user goes from the MetaFrame server. What I've seen in the logs is userX at x.x.x.x authenticates to MetaFrame and gets a list of published apps-ABC, DEF, XYZ, TTU; later x.x.x.x launches published app ABC. But x.x.x.x could be a proxy server, which means when a user at x.x.x.x launches an app, I don't know for sure who it was, nor do I know where they went. Is there a feature or 3rd party product that can provide info like: MM/DD/YYYY hh:mm:ss userX src x.x.x.x launched app ABC to dst y.y.y.y? It would be nice to know what port they used as well, but that would be a bonus. Thanks!

 

[balage0]

Hi Chris,

the standard ICA port is 1494, and you can use AUDITLOG tool in citrix server to list users and connection informations.

Cheers,
Balage

 

[Binkie]

Chrisbc,

You may want to take a look at a third party tool from Lakeside Software, called SysTrack.(

http://www.lakesidesoftware.com)

SysTrack reports who logged in to the system, when, what applications they ran, for how long, etc. It is a pretty easy to use tool, and can be installed in minutes!

Good luck!

 

[Chambers]

How do I enable auditlog? I opened up a command prompt and typed in auditlog but only get the following;

DOMAIN\USERNAME EVENT TIME
Clear Log 8/18/2004 15:43

Do I need to enable it somewhere?