Has anyone deployed Always On Tracing yet? If so, I'd be curious to see if anyone has looked at being able to forward the information to another source

I setup both the Cloud Connector and Docker version. Worked pretty good getting it into Director, but I did not work on setting up on forwarding it out of that as of yet. They did release a new version for Docker, but I am having install issues with it right now.

Same, I've set up the Connector Appliance version, but have not setup forwarding

If you are running your own version on Docker, I would recommend sticking with the 2507 version. The 2603 sets up opensearch for clustering, but it hard configures for 9200 and 9300 and doesn't provide a good avenue to adjust it as it does the actual logserver portion.

No it's not possible to forward the logs to the SIEM or any other destination. We already asked for an RFE about that.

Thanks for the info everyone. I was wondering as its OpenSearch based if we could use something like Logstash to pull the info into Sentinel for example. I'm keen to get security related activities into a SIEM but now that the Security Analytics stuff is gone I'm trying to work on an alternative. I can gather availability type information from Event Logs but need to capture session and configuration logging/audit info including authentication, published resource used, admin changes etc

UberAgent can do that. We are forwarding to Azure Log Monitor, and then will use Sentinel to get that security information. That will give you more detail, as the AOT is more the Citrix under the hood communication.

Thanks Jeff, that would require the customer to have UberAgent. Might have to look at an uplift