Vantage
Licensing portal ↗Free trial

Data analytics

What the gateways and VDAs already send, decoded on your host: sign-ins, launches, sessions, HDX metrics; the syslog underneath, and the estate map over all of it.

HDX Insight
AppFlow
decoded on your own host, no cloud
Sessions
per VDA
round trip, CPU, memory, bandwidth per user
Syslog
1M+ a month
on one gateway pair, read in seconds
Round trip
48 ms
against the 150 ms line
Estate map
one model
appliances, pools and servers joined at the member's address

Read first

Three pages explain how these modules are used on a Citrix estate: Citrix session-performance monitoring (what the VDA agent and the gateway each collect and how the views join), Troubleshooting failed launches (the stages and the record for each) and VDA and NetScaler session diagnostics (both perspectives on one row). The walkthroughs show real cases.

Data analytics

HDX Insight

Vantage listens for the AppFlow (IPFIX) export the gateways already know how to send, sets the appliance up for it in one dialog, and decodes what arrives: gateway sign-ins, ICA launches, sessions, and per-session HDX metrics — round trip and bandwidth each way, minute by minute. Search by user, sort any column, and see which appliance and gateway each session went through.

  • Sign-ins, launches, sessions and ICA sessions, newest first
  • Round trip against the 150 ms line, traffic to and from the client
  • Reconnects counted, closed connections marked, the raw capture kept for download
HDX Insight data: sign-ins, launches, sessions and ICA sessions
Click to zoom
Data analytics

Session performance

For servers with the Citrix VDA role, the agent reads each signed-in session’s CPU, memory and disk, the ICA round trip and bandwidth from the VDA’s own counters, and the logon duration — the view an uberAgent user expects, without another product. Pick a user to narrow every chart to their session.

  • Sessions across every VDA, with the worst round trip one click away
  • Charts over 1 hour to 7 days per user
  • Director’s Session Logon Duration per logon, from the VDA’s own event logs
  • Launch analysis: pick who is on now or type a name, and get a verdict with the evidence across the gateway, StoreFront and the VDA
  • Says plainly when a counter or list could not be read, and why
Session performance across VDAs, with Director's logon breakdown
Click to zoom
Launch analysis: one attempt picked out of the window, with the verdict and the evidence across the gateway, StoreFront and the VDA
Click to zoom
Protection

Security for the gateways

Data analytics › Security is the NetScaler gateways’ investigation page, drawn by the same component as the Windows servers’ so the two read alike. Four questions come first: are the gateways under attack, are the protections stopping it, did a sign-in get through after failing, and are the appliances enforcing. Then the attack map with lines to your servers’ place, the attack sources with the accounts they tried, their location and the syslog lines behind them, the block list, and an event explorer. The enforcement rules and what each one dropped, from which source and at which virtual server, sit on the same page.

  • IP reputation databases: Vantage’s own self-learned and hand-added lists, the list the Vantage licensing portal publishes, and any list you add by URL — each external list on its own sync, in Block or Watch mode
  • Look up one address in every database, or in the one you pick, and see which list names it
  • An address the Application Firewall blocked, or one sending a forged SAML response, is a source like a failed sign-in
  • Without the module the page says which one adds it, rather than drawing an empty page
Vantage — Data analytics › Security for the gateways: a card per rule with what it holds and dropped, by source address and virtual server
Click to zoom
Vantage — Security integrations: the IP lookup and the reputation databases, Vantage's own self-learned and hand-added lists first
Click to zoom
Logging

Syslog

A built-in receiver for your appliances and servers, with a searchable message view, retention you set, and one-click push configuration from a NetScaler’s page. The same store feeds the Security page, the restart analysis and the reports, so the syslog you already send does more than sit in a file.

  • Central listener on the standard port, its firewall rule opened by the installer
  • Severity- and source-tagged stream, full message on demand
  • Indexed for the reports; a million messages a day is fine
  • Filter by time, module, address and text a line must not contain, over a full-text index
Syslog messages: sources, events, users and severity
Click to zoom
Correlation

Estate map

One model of the three layers Vantage already reads — the appliances’ virtual servers, groups and members, the XenServer pools’ hosts and VMs, the Windows servers and the Hyper-V guests — joined at the member’s address, with provenance on every link. Ask what a host would take down, or what a virtual server rests on, and the answer names each hop, how sure it is (the product itself said so, a second observation confirmed it, or it was matched by address alone) and what observed it. Built from the last poll, scan and report: nothing is contacted, and the page says how fresh each source is. A module of its own, which presumes none of the others and reads whatever you have licensed.

  • A member address nothing here explains stays on the page and is counted — that is itself the finding
  • “Nothing depends on this” is never said while a source could not be read: the unread sources come first in every answer
  • The manufacturer behind a MAC, from the IEEE registry held on your own server — no address is sent to a lookup service
  • Where no registry can cover an address, the hypervisor that made it up is named instead
The estate map: what is in the model, where each source came from and how fresh it is, and the picker
Click to zoom
Blast radius for a hypervisor host: every affected thing with its hops, how sure each step is and what observed it, and the sources that could not be read first
Click to zoom