All Apps and Add-ons

Template for Citrix XenApp: What is the best way to capture user and session data in a read-only only Citrix environment?

joshk2005
Explorer

I have installed the Template app, and have information coming in from the ZDC, XML, and licensing servers. The issue I have revolves around capturing user and session data. Our Citrix environment from a session server standpoint is almost entirely read-only. What is the best way to capture information in this case, if it is even possible?

0 Karma
1 Solution

jconger
Splunk Employee
Splunk Employee

User and session data come from the Citrix PowerShell cmdlets. Whatever account is used for the "Logon as" account for the Splunk Universal Forwarder Windows service needs to be able to run these cmdlets. This is controlled by permissions set within the XenApp console for the Citrix administrators.

What you can do is run PowerShell as the account used for the Splunk UF. Then try to execute the following from the PowerShell command line:

Get-PSSnapin -Registered "Citrix.XenApp.Commands" | Add-PSSnapin
Get-XASession -Full -ServerName $env:COMPUTERNAME

This should run as a Citrix read-only admin. If this errors out, post back here to get help troubleshooting. The Template for Citrix XenApp won't completely work unless these PowerShell cmdlets run correctly.

View solution in original post

jconger
Splunk Employee
Splunk Employee

User and session data come from the Citrix PowerShell cmdlets. Whatever account is used for the "Logon as" account for the Splunk Universal Forwarder Windows service needs to be able to run these cmdlets. This is controlled by permissions set within the XenApp console for the Citrix administrators.

What you can do is run PowerShell as the account used for the Splunk UF. Then try to execute the following from the PowerShell command line:

Get-PSSnapin -Registered "Citrix.XenApp.Commands" | Add-PSSnapin
Get-XASession -Full -ServerName $env:COMPUTERNAME

This should run as a Citrix read-only admin. If this errors out, post back here to get help troubleshooting. The Template for Citrix XenApp won't completely work unless these PowerShell cmdlets run correctly.

joshk2005
Explorer

The issue is that the servers themselves are read-only, not the account access. They use provisioning to deploy the app servers, creating a master then spinning the read-only servers from there. We have 100's of those servers deployed. Wasn't sure if anyone else had deployed widely in a large Citrix environment like that.

0 Karma

jconger
Splunk Employee
Splunk Employee

Oh - my bad.

The answer to your question is "yes". You can make the UF part of a system image for use in things like Citrix PVS or MCS (which are read only shared images). Documentation here -> http://docs.splunk.com/Documentation/Splunk/6.2.6/Forwarding/Makeadfpartofasystemimage

You will need to get the correct TA deployed to these servers. You can either make the TA part of the system image, or use the Splunk deployment console to distribute the TA's to the servers at startup. Most of the installations I have seen use the former so they do not have to wait for the extra step of deploying the package. The only drawback is updating the master image if you want to make changes to what the TA collects.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...