System Log Events Reference

To view all System Log events data for your Citrix Cloud account, you can:

• Download a CSV file of all events that occurred during the previous 30, 60, or 90 days.
• Use the SystemLog API to retrieve events for a specific time period.

See Event data descriptions in this article for descriptions of the data that are captured when you retrieve System Log events. See Cloud components and services that generate events for event-specific values such as event message text, event types, and whether object field data is recorded before and after events occur.

Cloud components and services that generate events

System Log records events for the following Citrix Cloud entities, components, and services:

• Citrix Cloud platform: Events related to Citrix Cloud administrators, administrator groups, device resets for Workspace subscribers, and Azure AD tenants.
• Connectors: Events related to registering and updating Citrix Cloud Connectors and Connector Appliances.
• Licensing: Events related to registering on-premises License Servers, managing assigned licenses for cloud services, and exporting licensing data.
• Secure Private Access service: Events related to Secure Private Access service configurations.
• Citrix Workspace: Events related to Workspace Configuration settings.

Event data descriptions

When you download system log events or retrieve them using the SystemLog API, the following data are included:

• RecordID: The unique identifier for the event.
• UtcTimestamp: The date and UTC time at which the event occurred.
• CustomerID: The unique organization identifier of the Citrix Cloud account.
• EventType: The identifier for the type of event that was recorded. The event type is recorded using the format OriginatingService/Actor/Action. For example, the event type for creating an administrator is platform/administrator/create.
• TargetID: The ID of the system object that was impacted or changed.
• TargetDisplayName: The display name of the system object that was impacted or changed. For example, the name of an administrator that was created.
• TargetEmail: The email address of the system object. For example, the email address of an administrator that was created.
• TargetUserID: The user ID of the system object that was impacted or changed. For example, when creating an administrator, the target user ID is the user ID of the administrator that was created.
• TargetType: The target category for the event.

• BeforeChanges and AfterChanges: The contents of object fields before and after the event occurred, respectively. For some events, these object fields include:

  • CustomerID
  • User principal
  • UserID
  • Administrator access type, such as Custom or Full
  • CreatedDate
  • UpdatedDate
  • DisplayName
• AgentID: The event category.
• ActorID: The ID of the system object that initiated the event. For example, for creating an administrator, this is the object ID of the administrator who invited another user to the Citrix Cloud account.
• ActorDisplayName: The display name of the person or entity that initiated the event. For example, the name of the administrator who invited another user to the Citrix Cloud account.
• ActorType: The service that generated the event.
• EventMessage: The brief description of the event that occurred.