View Security Servers

[sorensen44]

We've recently implemented Horizon View Security Servers in our DMZ. Before our Perimeter team will open them to the outside world, they want logging that will show them detailed connection information. For example, client source IP address, user name, VDI VM the user is connecting to. I've found Connection Manager logs provide the majority of this information, but I cannot find any source IP information from logs.

Can anyone tell me how I can obtain the source IP address of a connecting client from the View security server or connection manager logs?

[mittim12]

Would it work if you could get source IP from the registry of the VDI machine or does it have to be from Security Server and Connection broker?   If it doesn't matter then check the HKCU/Volatile Environment/ of the virtual machine the users are connected too.   There is a lot of client/user information contained in that section.

[vcpguy]

Thanks for the info. I don't want to hijack OP question - but out of curiosity what happens if the user logs off OR every time they connect to different desktop (floating pool) ? How can we still get that data?

Thanks

[PaulAGreen]

We've been writing this to the debug log of connection servers and security servers for a good while now. If you're using View 5.1.3 or later, or 4.6.2 or 4.6.3, look for this pattern in the debug log:

Request from <address>: <method> <path>

As mittim12 points out, it's also available in the user's environment on the guest, but there's a difference: the information on the guest is provided by the client, whereas the debug log entry is determined from the network connection. In the simplest of environments, these will be the same, but typically there'll be various layers of network translation between client and server.

[sorensen44]

I appreciate the info. The only place I've found the source IP info is where mittim12 mentioned...in the registry under HKCU/Volatile Environment/. We've gone through quite a few View versions and the logs have changed with each upgrade. We're currently running 5.2 and I can't find source IP information in either debug or events log.

We've just implemented Log Insight and I'm wondering if I can collect this info from the VDI VMs through either Log Insight or vCOps for View. I understand future View releases will provide this information in the events log.

[PaulAGreen]

Actually we already do. If you have View 5.2 or later, you will find the IP address in the event database, attached to the user login entry. This is the right place to go for such information, but if you haven't configured an event database, we write the same information to the connection server's debug log:

2014-01-24T11:40:32.238Z DEBUG (1144-1580) <TP-Processor3>  [EventLogger] (SESSION:a7c2-***-684c) Info_Event:[BROKER_USERLOGGEDIN] "User TESTDOM\tesuser1 has logged in":ClientIpAddress=10.20.30.40, Severity=AUDIT_SUCCESS, [more stuff...]

[mittim12]

Thanks for the information Paul.   I didn't know that 5.2 started putting that in the event database.

[sorensen44]

So...from the Connection Managers I enabled syslog output to a UNC share. We used our Arcsight server to collect those logs and sure enough, source IP info from Security Server connections are there along with internal connections. I appreciate the info guys.