Can User-ID Agent Monitor a Citrix Farm security logs same like it can Exchange (API integration or future extension to the TSAgent?)

[ucteam]

Is it possible for the UIA to monitor a Citrix farm/ cluster security logs in order to gather the user-to-ip mappings required for the firewall. Similar to how the UIA can monitor Exchange servers security logs for the same effect.

I'm NOT refering to the TS-Agent which is used to identify users within a network dekstop/ Terminal server session.

What I'm refering to is generating username-to-ip mappings for fat clients/ users physical dekstop which happen to all have installed the "pnagent" /"Citrix Online Plugin" etc.. as this client already runs at logon (and in the background constantly) and authenticates to the central Citrix Farm regardless if the user actually uses the Citrix services or not. The same affect could be achieved by configuring all users AD profiles to automatically start Outlook at logon and then using UIA to monitor the Exchange Sec logs, but it would be more seamless if could use the citrix agent/client which already exsits and performs the same auth events.

What I was aiming for was either

• An integration via the API (perhaps forward the windows auth logs to central Syslog and then handle from there via the API)
• Or that the current Exchange log monitoring system would also function on the Citrix server if the auth event Ids/ information where similar enough
• Or an extension/ feature request for the TS-Agent to handle it.

[rmonvon]

Hi...The UserID agent can only detect logon events from the security logs of AD Domain Controllers and Exchange.  I don't believe it can detect Citrix logon events unless Citrix can write to AD security logs with the same event IDs.  Also, we would need Citrix client running on other network device like servers, Unix workstations, smart devices like iPad/iPhone and Andriod phones to catch users logging in via these devices.

As you have indicated, if all users would login to Exchange we certainly can generate username-to-ip mapping from there.  If you can export the Citrix logon event to syslog, then our API can be customized to look for logon events.

Thanks.