Application Behaviour Analysis – Citrix GoToMeeting

This is a detailed analysis report on Application Behaviour Analysis – Citrix GoToMeeting.  From this report, you’ll be able to understand how GoToMeeting works in Windows environment and possible configuration options for customizing the application behaviour to your requirements.

I am splitting the major configuration details into Logs, File System, Processes and Registry.

Logs:

At every run of the GTM, it logs all the Terse level events to the log file created in %temp% folder with dynamic path as shown below:

• Log Location: %temp%\citrixlogs\gotomeeting\<buildnumber>\log<randomstring>.tmp\GoToMeeting[\d+]_00.log
• Example: “C:\Users\TESTUSR\AppData\Local\Temp\2\citrixlogs\gotomeeting\1468\log5933.tmp\GoToMeeting1_00.log”
• All log statements are written with timestamp in PST format (UTC – 8).  So, pay attention to the timestamp values in case if your are comparing the logs.
• The Log level setting is saved in below User Registry and is by default configured to “Terse” value

C:\>reg query “HKEY_CURRENT_USER\Software\Citrix\GoToMeeting” /v LogLevel

HKEY_CURRENT_USER\Software\Citrix\GoToMeeting
LogLevel    REG_SZ    Terse

C:\>

• You can delete the Log files at any time, GTM generates a fresh log at every run and maintains the previous logs for records in the same folder

Processes:

• From the logs (sample below), it’s clear that GoToMeeting is developed in (C++) C Plus Plus language

2014-07-21 03:48:16.143 PST d: [g2mlauncher] <8802> Debug message at , g2mlaunchermain.cpp:90
(2008) “ECError::eNotFound”
Error returned at , g2menvironment.cpp:43

• Citrix GoToMeeting StartMenu shortcut always runs with command line: “C:\Program Files (x86)\Citrix\GoToMeeting\<buildnumber>\g2mstart.exe” “/Action Host” “/Trigger Shortcut” “/Product G2M”
• The g2mstart.exe initiates the child processes upon start up and showing the icon in the Systray

+ g2mstart.exe    “C:\program files (x86)\citrix\gotomeeting\1468\g2mstart.exe” /Action Host” “/Trigger Shortcut” “/Product G2M
+ g2mcomm.exe    “C:\Users\Testusr\AppData\Local\Citrix\GoToMeeting\1468\g2mcomm.exe” “Debug=On&Digest=af41e43d22d93d782e00ff126ea2445ce&Dir=C:\Users\Testusr\AppData\Local\Citrix\GoToMeeting\1468\&LoaderPath=C:\Users\Testusr\AppData\Local\Citrix\GoToMeeting\1468\g2mstart.exe&LogLevel=Terse&LogName=c:\users\Testusr\appdata\local\temp\4\citrixlogs\gotomeeting\1468\log7DF1.tmp\GoToMeeting.log&Path=g2mlauncher.exe&Plugin=G2MLauncher&PluginDebug=On&PluginStat=On&PluginStatDb=Off&Stat=On&StatDb=Off&Trigger=RunAtLogon&UniqueId=1da4”
– g2mlauncher.exe    “C:\Users\Testusr\AppData\Local\Citrix\GoToMeeting\1468\g2mlauncher.exe” “StartID={611D51C3-905D-41F3-A8C3-42354DBBC8B0}&Debug=On&Stat=On&StatDb=Off&Index=0”

• When you click on Join Or Meet Now, g2mstart.exe triggers the respective child processes as shown below:

+ g2mstart.exe    “C:\Users\Testusr\AppData\Local\Citrix\GoToMeeting\1468\g2mstart.exe” “/Action Host” “/Trigger Shortcut” “/Product G2M”
   + g2mcomm.exe    “C:\Users\Testusr\AppData\Local\Citrix\GoToMeeting\1468\g2mcomm.exe” “Debug=On&Digest=af41e43d22d93d782e00ff126ea2445ce&Dir=C:\Users\Testusr\AppData\Local\Citrix\GoToMeeting\1468\&LoaderPath=C:\Users\Testusr\AppData\Local\Citrix\GoToMeeting\1468\g2mstart.exe&LogLevel=Terse&LogName=c:\users\Testusr\appdata\local\temp\4\citrixlogs\gotomeeting\1468\log7DF1.tmp\GoToMeeting.log&Path=g2mlauncher.exe&Plugin=G2MLauncher&PluginDebug=On&PluginStat=On&PluginStatDb=Off&Stat=On&StatDb=Off&Trigger=RunAtLogon&UniqueId=1da4”
– g2mlauncher.exe    “C:\Users\Testusr\AppData\Local\Citrix\GoToMeeting\1468\g2mlauncher.exe” “StartID={611D50C3-905D-41F3-A8C3-42354DBBC09B0}&Debug=On&Stat=On&StatDb=Off&Index=0”
– g2mui.exe    “c:\Program Files (x86)\Citrix\gotomeeting\1468\g2mui.exe”  “StartID={F89BE9AC-6F37-49A4-8C07-5C25e16(8FCA}&Debug=On&Stat=On&StatDb=Off&Index=0”
– g2mvideoconference.exe   “c:\Program Files (x86)\Citrix\gotomeeting\1468\g2mvideoconference.exe”  “StartID={E1B7O1C2-7EAA-4B56-A15D-41A7D7E589EE}&Debug=On&Stat=On&StatDb=Off&Index=0”

• When you End Meeting for All, it’s only g2mui.exe and g2mvideoconference.exe processes gets closed and remaining three processes keeps running as long as you don’t exit the application from the Systray icon
• G2MLauncher process doesn’t run independently when you run it directly with respective parameters
• Once triggered the g2mcomm.exe manages all parameters and communication with the sub processes g2mlauncher.exe, g2mui.exe & g2mvideoconference.exe
• G2MComm.exe is the process that enumerates all the systems details needed/requested by the sub-process.

Registry:

GoToMeeting maintains most of the configuration data per user basis and auto generates with default values for the first time users logging on to the system.  The setting are saved under HKCU as shown below:
[code language=”text”]
C:\>reg query "HKEY_CURRENT_USER\Software\Citrix\GoToMeeting"

HKEY_CURRENT_USER\Software\Citrix\GoToMeeting
LatestVersion REG_DWORD 0x546
UninstallString REG_SZ C:\Users\testusr\AppData\Local\Citrix\GoToMeeting\1350\G2MUninstall.exe /uninstall
UserId REG_SZ dymT+72vKwc=
Role REG_DWORD 0x1
RecordingAudio REG_SZ true
RecordingInput REG_SZ VoIP
RecordingConvert REG_SZ G2M
RecordingPath REG_SZ C:\Users\testusr\Documents
RunAtLogon REG_SZ true
WebsiteUrl REG_SZ https://global.gotomeeting.com
WebsiteUrlWebinar REG_SZ https://global.gotowebinar.com
PerformAVC REG_SZ false
OutOfSessionHelp REG_SZ http://support.gotomeeting.com/
ActiveVersion REG_DWORD 0x5bc
IntegrationType REG_SZ None
Integration REG_SZ false
EGWAddress REG_SZ 216.115.208.230
EGWPort REG_SZ 8200,80,443
EGWDNS REG_SZ egwglobal.gotomeeting.com
MeetingEnabled REG_SZ true
MeetingEnabledForAccount REG_SZ true
WebinarEnabled REG_SZ false
WebinarEnabledForAccount REG_SZ false
TrainingEnabledForAccount REG_SZ false
CorporateAccount REG_SZ false
RecordMeetingDisabled REG_SZ false
AllowControlDisabled REG_SZ false
AttendeeListDisabled REG_SZ false
ChatDisabled REG_SZ false
ChatAndQADisabled REG_SZ false
WebsiteUrlTraining REG_SZ https://global.gototraining.com
Podio REG_SZ
Email REG_SZ gtmtesting@gmail.com
MSN REG_SZ true
Yahoo REG_SZ true
LogLevel REG_SZ Terse
EnableDebug REG_SZ true
EnableStat REG_SZ true
EnableStatDb REG_SZ false
EnableProbing REG_SZ true
rememberMe REG_SZ true
LatestBuild REG_DWORD 0x5bc
WebCamDisabled REG_SZ false
LatestMeetingID0 REG_SZ 1 Test Now
AudioInputDevice REG_SZ Remote Audio
AudioInputDeviceIndex REG_DWORD 0x0
AudioOutputDevice REG_SZ Remote Audio
AudioOutputDeviceIndex REG_DWORD 0x0
AudioAdjustSettings REG_SZ true

HKEY_CURRENT_USER\Software\Citrix\GoToMeeting\1259
HKEY_CURRENT_USER\Software\Citrix\GoToMeeting\Audio
HKEY_CURRENT_USER\Software\Citrix\GoToMeeting\AuthInfo
HKEY_CURRENT_USER\Software\Citrix\GoToMeeting\ConnectionInfo
HKEY_CURRENT_USER\Software\Citrix\GoToMeeting\IM
HKEY_CURRENT_USER\Software\Citrix\GoToMeeting\MSO
HKEY_CURRENT_USER\Software\Citrix\GoToMeeting\Secure
HKEY_CURRENT_USER\Software\Citrix\GoToMeeting\UI
HKEY_CURRENT_USER\Software\Citrix\GoToMeeting\UIForMeeting
HKEY_CURRENT_USER\Software\Citrix\GoToMeeting\Video

C:\>
[/code]