How to identify end user Client Browser, OS, Device and IP address in Qlik Sense

[Sonja_Bauernfeind]

Is there any option to find out, which Browser, OS, Device and IP address of our users using to log in to Qlik Sense production system? Can this data be found in the Qlik Sense monitoring apps or Qlik Sense logs?

Note that this article covers the historic analysis of data and does not include how to identify access live and have Sense react accordingly. 


Environments:

Qlik Sense any version 

Method 1, using the Qlik Sense Proxy logs

This method requires for the Proxy log files logging level to be increased, and for Extended Security Environment to be enabled. Extended Security Environment has consequences in the environment, such as disabling the potential of sharing sessions across multiple devices. See the Qlik Online help for details. 

Settings to Enable:

• In the Qlik Sense Management Console, select the required Proxy
• Navigate to Logging
• Set the Audit Log level to Debug
• In the Qlik Sense Management Console, select the required Virtual Proxy
• Navigate to Advanced
• Enable "Extended Security Environment"

The proxy will now log additional information in: 
C:\ProgramData\Qlik\Sense\Log\Proxy\Trace\[Server_Name]_Audit_Proxy

Example Output:

Audit.Proxy.Proxy.Core.Connection.ConnectionData [X-Qlik-Security, OS=Windows; Device=Default; Browser=Chrome 67.0.3396.99; IP=::ffff:172.16.16.100; ClientOsVersion=10.0; SecureRequest=true; LicenseContext=UserAccess; Context=AppAccess; ] || [X-Qlik-User, UserDirectory=DOMAIN; UserId=administrator]

For more information on where to find the logs see
How To Collect Qlik Sense Log Files

Method 2, using the Qlik Sense HubService logs

A much more lighter-weight approach than method 1 would be to parse the HubService logs in C:\ProgramData\Qlik\Sense\Log\HubService. No additional settings are required. 

Example Output:

::ffff:192.168.56.1 - - [31/May/2019:12:36:40 +0000] "GET /about HTTP/1.1" 304 - "https://SERVERNAME/hub/?qlikTicket=9mDlmVfE-E1Nc3RT" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36"