Console
    Start free

    Collect Citrix Receiver logs

    Supported in:

    This document explains how to ingest Citrix Receiver logs to Google Security Operations using the Bindplane agent.

    Citrix Receiver (now Citrix Workspace app) is a client-side application that provides access to virtual desktops, applications, and data from Citrix Virtual Apps and Desktops environments. The logs capture session events, authentication, and client-side activity.

    Before you begin

    Make sure you have the following prerequisites:

    • A Google SecOps instance
    • Windows Server 2016 or later, or Linux host with systemd
    • Network connectivity between the Bindplane agent and the Citrix Receiver host
    • If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements
    • Privileged access to the Citrix environment with administrator permissions
    • Access to Citrix Receiver log files on the server or client file system

    Get Google SecOps ingestion authentication file

    1. Sign in to the Google SecOps console.
    2. Go to SIEM Settings > Collection Agents.
    3. Download the Ingestion Authentication File.

    4. Save the file securely on the system where Bindplane will be installed.

    Get Google SecOps customer ID

    1. Sign in to the Google SecOps console.
    2. Go to SIEM Settings > Profile.

    3. Copy and save the Customer IDfrom the Organization Detailssection.

    Install the Bindplane agent

    Install the Bindplane agent on your Windows or Linux operating system according to the following instructions.

    Windows installation

    1. Open Command Promptor PowerShellas an administrator.

    2. Run the following command:

        msiexec 
  
 / 
 i 
  
 "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" 
  
 / 
 quiet

    3. Wait for the installation to complete.

    4. Verify the installation by running:

       sc query observiq-otel-collector

      The service should show as RUNNING.

    Linux installation

    1. Open a terminal with root or sudo privileges.

    2. Run the following command:

       sudo  
sh  
-c  
 " 
 $( 
curl  
-fsSlL  
https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh ) 
 " 
  
install_unix.sh

    3. Wait for the installation to complete.

    4. Verify the installation by running:

       sudo  
systemctl  
status  
observiq-otel-collector

      The service should show as active (running).

    Additional installation resources

    For additional installation options and troubleshooting, see the Bindplane agent installation guide .

    Configure the Bindplane agent to ingest logs and send to Google SecOps

    Locate the configuration file

    • Linux:

       sudo  
nano  
/opt/observiq-otel-collector/config.yaml

    • Windows:

       notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"

    Edit the configuration file

    • Replace the entire contents of config.yaml with the following configuration:

        receivers 
 : 
  
 filelog 
 : 
  
 include 
 : 
  
 - 
  
 'C:\Users\*\AppData\Local\Citrix\Receiver\*.log' 
  
 start_at 
 : 
  
 beginning 
  
 poll_interval 
 : 
  
 5s 
 exporters 
 : 
  
 chronicle/citrix_rx 
 : 
  
 compression 
 : 
  
 gzip 
  
 creds_file_path 
 : 
  
 'C:\Program 
  
 Files\observIQ 
  
 OpenTelemetry 
  
 Collector\ingestion-auth.json' 
  
 customer_id 
 : 
  
 '<customer_id>' 
  
 endpoint 
 : 
  
 malachiteingestion-pa.googleapis.com 
  
 log_type 
 : 
  
 CSG_CITRIX_RX 
  
 raw_log_field 
 : 
  
 body 
  
 ingestion_labels 
 : 
  
 env 
 : 
  
 production 
 service 
 : 
  
 pipelines 
 : 
  
 logs/citrix_rx_to_chronicle 
 : 
  
 receivers 
 : 
  
 - 
  
 filelog 
  
 exporters 
 : 
  
 - 
  
 chronicle/citrix_rx

    Configuration parameters

    Replace the following placeholders:

    • Receiver configuration:

      • include : Paths to Citrix Receiver log files:
        • Windows: C:\Users\*\AppData\Local\Citrix\Receiver\*.log
        • Centralized collection: Adjust the path if logs are collected to a central share
      • start_at : Set to beginning to read existing logs, or end to read only new entries
      • poll_interval : How often to check for new log data (default: 5s )

    • Exporter configuration:

      • citrix_rx : Descriptive name for the exporter
      • creds_file_path : Full path to ingestion authentication file:
        • Linux: /etc/bindplane-agent/ingestion-auth.json
        • Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
      • <customer_id> : Customer ID from the previous step
      • endpoint : Regional endpoint URL:
        • US: malachiteingestion-pa.googleapis.com
        • Europe: europe-malachiteingestion-pa.googleapis.com
        • Asia: asia-southeast1-malachiteingestion-pa.googleapis.com
        • See Regional Endpoints for complete list
      • CSG_CITRIX_RX : Log type exactly as it appears in Chronicle
      • ingestion_labels : Optional labels in YAML format (for example, env: production )

    • Pipeline configuration:

      • citrix_rx_to_chronicle : Descriptive name for the pipeline

    Save the configuration file

    • After editing, save the file:
      • Linux: Press Ctrl+O , then Enter , then Ctrl+X
      • Windows: Click File > Save

    Restart the Bindplane agent to apply the changes

    • To restart the Bindplane agent in Linux, run the following command:

       sudo  
systemctl  
restart  
observiq-otel-collector

      1. Verify the service is running:

         sudo  
systemctl  
status  
observiq-otel-collector

      2. Check logs for errors:

         sudo  
journalctl  
-u  
observiq-otel-collector  
-f

    • To restart the Bindplane agent in Windows, choose one of the following options:

      • Command Prompt or PowerShell as administrator:

         net stop observiq-otel-collector && net start observiq-otel-collector

      • Services console:

        1. Press Win+R , type services.msc , and press Enter.
        2. Locate observIQ OpenTelemetry Collector.
        3. Right-click and select Restart.

        4. Verify the service is running:

           sc query observiq-otel-collector

        5. Check logs for errors:

            type 
  
 "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"

    Enable Citrix Receiver logging and configure log collection

    Logging is disabled by default in Citrix Receiver. You must enable it using registry entries before log files are generated.

    Enable logging on Windows

    1. Open Registry Editor( regedit ) as an administrator on the Citrix Receiver client machine.
    2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Receiver .
    3. Create a new String Valuenamed EnableTracing and set it to true .

    4. Create a new String Valuenamed TracePath to specify the log output path. For example:

      • C:\CitrixLogs\
      • Alternatively, use the default path: %USERPROFILE%\AppData\Local\Citrix\Receiver\

    5. Restart the Citrix Receiver application for the changes to take effect.

    Verify log file generation

    1. After enabling logging, open the Citrix Receiver and connect to a published resource.
    2. Navigate to the log directory:
      • Default path: %USERPROFILE%\AppData\Local\Citrix\Receiver\
      • Custom path: The path specified in the TracePath registry value.
    3. Verify that .log files are being created and contain session event data.

    4. Ensure the Bindplane agent has read permissions on the log directory and files.

    UDM mapping table

    Log Field UDM Mapping Logic
    creationTime
    		metadata.event_timestamp Parsed as dd/M/yyyy HH:mm:ss
    timestamp
    		metadata.event_timestamp Parsed as MMM d HH:mm:ss
    has_principal
    		metadata.event_type Mapped: true → NETWORK_CONNECTION
    has_user
    		metadata.event_type Mapped: true → USER_UNCATEGORIZED
    logId
    		metadata.product_log_id Directly mapped
    srcip
    		principal.asset.ip Merged
    srcip
    		principal.ip Merged
    userId
    		principal.user.userid Directly mapped
    application
    		target.application Directly mapped
    targetip
    		target.asset.ip Merged
    targetip
    		target.ip Merged
    resourcename
    		target.resource.name Directly mapped
    N/A
    		 metadata.event_type Constant: NETWORK_CONNECTION
    N/A
    		 metadata.product_name Constant: CSG Citrix RX
    N/A
    		 metadata.vendor_name Constant: CSG Citrix RX

    Need more help? Get answers from Community members and Google SecOps professionals.

    Create a Mobile Website
    View Site in Mobile | Classic
    Share by: