Citrix Access Gateway - Reading the Audit Log

Posted on 2015-02-11
Last Modified: 2015-02-24
Client has a Citrix Access Gateway (phyiscal) running software 5.0.4 (latest).

They want to be able to review the Audit Logs and report on what user came in from what IP.

I have setup the Audit Log transfer to an FTP server and that works fine. Now the client needs to be able to review those logs. The raw data is stored in TEXT files (annoyingly without column headings!!).

Here is a snip it from the log: - 8080874791657725504:user1\:: [11/Feb/2015:09:48:03 00400] "" - - "" "" Logout "Idle Timeout" - 3820405373289224011:user1\:: [11/Feb/2015:09:52:03 00400] "" - - "" "" Logout "Idle Timeout" - 3047373008680520109:user2\:: [11/Feb/2015:10:01:03 00400] "" - - "" "" Logout "Idle Timeout" - 1770602356344558806:user3\:: [11/Feb/2015:10:03:03 00400] "" - - "" "" Logout "Idle Timeout" - 4697676139107208028:user4\:: [11/Feb/2015:10:25:03 00400] "" - - "" "" Logout "Idle Timeout" - 155248044720429937:user5\:Access: [11/Feb/2015:10:43:14 00400] "" - - "" "" Login "NavUI"
- - -::[11/Feb/2015:10:47:19 00400]"" - - "" "" "STA-Validation" "STA740D751AFC39" "http://server:80/Scripts/CTXSta.dll" "STA Ticket validation SUCCESS" - user5::[11/Feb/2015:10:47:19 00400]"" - - "" "" "SG-Traffic" "Lotus Notes" "" "CGP" "ICA ACL Check SUCCESS" - domainname\user5::[11/Feb/2015:10:47:19 00400]"" - - "" "" "SG-Traffic" "Lotus Notes" "" "CGP" "Application launch SUCCESS" - 6956428814212440291:client1\:: [11/Feb/2015:11:14:03 00400] "" - - "" "" Logout "Idle Timeout" - 0:user6\:Access: [11/Feb/2015:11:18:11 00400] "" - - "" "" Login "Login failed" - 8259626861271587592:user6\:Access: [11/Feb/2015:11:18:15 00400] "" - - "" "" Login "NavUI"
- - -::[11/Feb/2015:11:21:31 00400]"" - - "" "" "STA-Validation" "STA740D751AFC39" "http://server:80/Scripts/CTXSta.dll" "STA Ticket validation SUCCESS"

Does any:
Know what all the headings should be?
Have any way of importing and sorting the data into a format the client can filter on?

Question by:Mark Galvin
  • 2
LVL 13

Accepted Solution

Mark Galvin earned 0 total points
Comment Utility
Using PowerQuery in Excel we were able to manipulate the data so that it was in a a format we could use and then report on.

LVL 13

Author Closing Comment

by:Mark Galvin
Comment Utility
Using PowerQuery in Excel we were able to manipulate the data so that it was in a a format we could use and then report on.


Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

After several days of searching and hunting for limited documentation, I wanted to share this guide to hopefully save someone the hassle of trying to figure this out on their own. I have tested this on Xendesktop 7.1 and PS 4.5 running simultaneous…
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
How to install and configure Citrix XenApp 6.5 - Part 1. In this video tutorial we have explained step by step installation of Citrix XenApp 6.5 Server on Windows Server 2008 R2 is explained in this video. We have explained the difference between…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now