Microsoft RDGateway Sensors

Hello,

Thank you for using our PRTG Network Monitor.

Unfortunately we do not have a native sensor that to do all of that in RDGateway monitoring, nor do we have any in the script world. Parts of the requirement should be possible with the Eventlog Sensor.

In case the Event Log Sensor does not work, and also for the rest of the requirements, to be honest with you, we simply have to recommend a self-written [[: https://www.paessler.com/manuals/prtg/exe_script_sensor.htm|Custom Exe/Script-Sensor]].

Please let us know if you need anything else.

Hi Chad,

Honestly - what you want can't really be done by PRTG - at least not the way you requested it.

• Logon success
  • grab public IP and user
• Logon error
  • grab public IP and user
• performance data of current session
  • session latency
  • gateway resources consumed by user
• login time to logon to the GW/RDS farm

What you want there are multiple things and partly have no really to do with the GW.

A simulated logon would need either the gateway being able to process internal requests or the probe contacting it externally. How ever, this is going through the RDP protocol and would simulate a complete logon of a user / to have this accurate this logon session would need to be logged of afterwards and then you have additional factors like the CPU load of the casually targeted session host etc. that might influence the recorded time or GPOs that need to be processed etc...

Honestly - this is almost not possible to simulate - there are so many parts to it and this would mean you need to develop against the RDP protocol and then simulate various interactions and find out if the logon process actually finished at all..

The session latency is relative between the client and the target session host - while the GW interacts as a man in the middle. I am not aware that the GW knows about any of the latency of an ongoing session and eventually you have the issue that the client might be behind a weak internet connection or e.g. the GW resides in USA while the client resides in Germany - this would mean the distance comes to play and adding a huge latency (I would expect a minimum of 120ms delay) etc... - this is therefor a way to relative value that would be very hard to interpret. If at all, you might get it from the session on the host rather then from the GW - never looked in to that specific value though, see reasons mentioned already.

Gateway resources consumed? Yeah - non? This is so minimal - eventually the bandwidth of your internet connection and possibly IDS/IPS (CPU/RAM) of your FW are more affected by this then the GW itself. Simply monitor CPU/RAM of the GW server - you will see it remains pretty bored...

About you logon-success and logon-failures.. Now it becomes interesting...

The GW interacts with a NPS/RADIUS servers. Now RADIUS will interact with the Eventlog - more or less - the events you mention are going to be recorded in the Security Log of the RADIUS server - this might or might not be the GW. How ever - RADIUS can report to a SQL database - you then can create a script that runs against the SQL database and this script e.g. looks for logon success/failure entries - I am right now not sure if the GW will do an RADIUS accounting like procedure where you can see if a session is still ongoing - possibly - therefor you would be able to get information about how many sessions are ongoing right now.

https://www.it-admins.com/microsoft-radius-nps-sql-logging/ - this link should help you here...

There might also be a PowerShell command or WMI query that could give you the amount of ACTIVE sessions.

Won't promise I dig a bit deeper in to this - I always meant to do something with the GW in regards to ongoing sessions and failures but it never happened.. so I might.. but for now I wait for you and what you come up with :-)

Regards

- a fellow PRTG user -

Florian Rossmark

www.it-admins.com