Context
The customer’s audit team needed to know who opens Citrix sessions through NetScaler Gateway, from which address and for how long, and to receive that information every day in a form only they could read. NetScaler knows all of this, but it sends it as raw AppFlow records: there are no sessions yet, no complete usernames, no files to deliver.
I designed and built the service, N.U.S.A. (NetScaler User Session Auditor), and wrote the operations manual for first- and second-level support.
The challenge
- From records to sessions. IPFIX records have to be correlated into sessions with login, logout and duration, telling closed sessions apart from those that never got a close event and from the technical placeholders NetScaler generates.
- Incomplete usernames. NetScaler truncates longer usernames and sometimes loses the domain: the username has to be rebuilt before it goes into the file.
- A contractual format. Columns, order, separator and the meaning of every field are agreed with the customer: the file must not change by mistake.
- Confidentiality and proof of delivery. Only the customer may read the package, and it must be possible to prove whether and when it was collected.
- Five years of history. The disk has to last for the whole retention period, and the service has to run on its own, looked after by a support team that does not write software.
The architecture
On a dedicated Linux server, RHEL or Rocky Linux 9, every link in the chain is a separate systemd service. The ipfixcol2 collector receives the records from NetScaler on UDP port 4739 and writes them as JSON; the session tracker correlates them into sessions; every night at 00:30 UTC the export turns the previous day’s closed sessions into a CSV, compresses it, encrypts it with the customer’s public PGP key and files it by year and month.
The customer collects the packages with a dedicated SFTP account, read-only and limited to the archive, and a calendar in the portal shows for each day whether the package was produced and whether it was collected. The web portal, over HTTPS with administrator and user roles, brings together session lookup, file format, PGP keys, VPN subnets, username correction rules, disk space forecast and service status.
Key decisions
- The database is not the archive. The session database is a working window of a few days; the history lives only in the encrypted packages, which no maintenance operation touches.
- Only the public key on the server. Packages are encrypted with the customer’s key: once produced, only the customer can open them. Changing the key follows a procedure with a fingerprint check over a separate channel and a test package.
- Independent links. If the portal stops, collection and export carry on. Every service has its own page and its own symptom, and the manual leads from the symptom to the fix.
- The agreed configuration is a contract. File format, VPN subnets and username rules change what gets delivered: they change only at the customer’s request, and the default format is the agreed one.
- Disk space forecast, not discovered. Raw data stops at 30 days, the archive grows for five years: the portal estimates when the disk would fill up and whether it lasts for the whole retention period.
- Updates without surprises. A single package with a SHA-256 fingerprint, an idempotent script that keeps database, archive and configuration, and a six-step check that closes only with the first successful nightly export.
A product today
The same software is now NetScaler-UserLogging, one of the solutions of Corellix Software Engineering, the startup I co-founded.
01
Solution, layer by layer
Pick a layer involved to read what was done.
L1 · Secure access
NetScaler Gateway sends the IPFIX records of ICA sessions through AppFlow, with AAA username, domain and connection chaining enabled. The portal prepares the commands to apply on the appliance and the ones to verify them.
L4 · Data
Every night the sessions become a CSV in the format agreed with the customer: pipe separator, one row for the login and one for the logout, username rebuilt as user@domain and a field that flags access from the corporate VPN. Compressed and encrypted with the customer's PGP key, it stays in the archive for five years.
AI · Automation and AI
The service runs without human intervention: systemd timers for export, raw data cleanup and SFTP collection tracking, a periodic watchdog, a healthcheck script and an idempotent update with SHA-256 fingerprint verification. Support has a one-minute daily checklist.
02
Results
- 1
- encrypted archive every night, with the previous day's sessions
- 5
- years of archive retention
- 30
- days of raw data, then cleaned up automatically
- 8
- systemd services and timers, one per link in the chain
03