Pick a pool, host, VM, storage repository or network in the tree on the left.
▾ Recent tasks
No operations yet.
Findings over time
Overall verdict over time
Host resources over time
Per-host CPU load, memory and disk use, one sample per health report, for the last 7 days.
Select a pool to load host history.
Pick a pool.
Notifications & Events
Important alerts from each pool and appliance.
Events from the health report
NetScaler overview
Select an appliance to explore its topology, virtual servers, and network configuration.
Manage certificate
Automated renewal
A workflow is one folder, the appliances it covers, how far ahead of expiry it renews and when it runs. An estate runs several, so they live on their own page — with every run kept there, and a report of what worked and what refused.
Nothing is written to the folder and no credential for it is stored: it is opened as the account this service runs as, which is what needs read access.
Migrate configuration
Copies an appliance's configuration onto a new one, line for line, from its own
show ns runningConfig. The new appliance's NSIP, hostname,
HA setup and licensing are never touched — it keeps its own identity. Nothing is
applied until you review the plan and confirm.
→
Build NetScaler report
Generate a history & stats report over a date range. Pick the appliances, time window, and sections to include, then export as HTML or PDF.
Today by default. A longer period reads every collection in it (a month is about 8,600 per appliance at the default poll) and takes a few minutes; what is being read is shown below while it runs.
Sections marked NITRO read live
from the appliance over its REST API and need NITRO enabled on it
(appliance view › NITRO ACCESS). An appliance without it is filled from
its last SSH poll instead, and the report says so.
NITRO access —
NITRO is the appliance's REST
API. It is used for certificate expiry, HA config-sync state and interface
error counters — the things
nscli does not report in a
form that can be parsed reliably. Routine collection still runs over SSH.Signs in
with the appliance's password credential, or the shared NetScaler service
account where the appliance uses an SSH key. Nothing extra is stored, and
the account only needs read access: collection only reads. Configuration
changes (a licensed feature) use a separate configuration account from
Settings, never this one.
Analyze
Pick an analysis and the appliances to run it on; every HA pair answers with its own verdict, from the records held here (Restart analysis reads both nodes of each pair).
Appliances
·
Workflows
What runs on a schedule, what it covers, and how the last run went.
Certificate converter
Extract a certificate, private key and CA chain from a PFX, P12 or PEM file (or a .p7b, or a single DER certificate).
- 1Select file
- 2Review certificate
- 3Export files
Select the certificate file
Neither password is stored and the file is not kept: the file’s password opens it once, the passphrase protects the key file that comes out, and both are used and dropped. A private key is a credential, so the page marks the file that carries one.
A .pfx / .p12, a .pem bundle (certificate, chain, key), a .p7b or a .crt / .cer, up to 4 MB. In a PEM the chain is worked out from the names, whatever order it is in.
A PFX’s password, or the passphrase of an encrypted key in a PEM. Used to open the file this once; never stored.
Trace analysis
Read a packet capture: where DNS, TCP or TLS failed, the packets that show it, and what Vantage recorded about the same addresses in the same minutes.
Select the capture
The capture is not kept. It is read in memory and dropped when the analysis is done; only the findings are held, for 60 minutes, so the report can be downloaded. A capture can hold anything that crossed the wire, so this is an administrator’s tool.
pcap or pcapng, up to 25 MB.
Taking a capturewhat this reads, and how to take one that shows the failureShow
Reads pcap and pcapng (Wireshark, tcpdump, dumpcap, pktmon etl2pcap). Start it, reproduce the failure once, stop it: a few minutes is plenty.
On a NetScaler, take it as pcap: start nstrace -size 0 -traceformat PCAP, then stop nstrace. NetScaler’s own trace format (nstrace) is not read yet.
A capture taken where the failing client is shows what it sent and what came back. TLS 1.3 encrypts the certificate, so the certificate is only readable in a TLS 1.2 handshake.
Support bundle analysis
Read the bundles show techsupport writes: why the appliance crashed or restarted,
what was using its resources, and whether anything points at a compromise. Every answer quotes the lines that show it.
Add the bundles
The bundles are not kept. They are uploaded in pieces, read on this server and deleted when the analysis ends. The analysis is kept (the newest 10) and quotes only the lines it needs, with the value after any password switch blanked. A bundle is the whole appliance, so this is an administrator’s tool.
Both nodes of a pair together tell a failure that followed the traffic from one that did not; two bundles of the same appliance from different days are read as a timeline of what changed between them.What to uploadthe bundle, whole or in parts, and what it readsShow
On each node: show techsupport. It writes /var/tmp/support/collector_<P|S>_<address>_<date>.tar.gz; copy it off with WinSCP or scp. Collect it before a reboot or a rebuild: the logs rotate within a day or two.
A bundle split for transfer (.part01, .001, .aa) is joined in order — add every part to the same appliance. A bundle that ends early is read up to where it ends and the missing files are named; a zip of the missing var/log files added to the same appliance completes it.
Read: , the show and stat answers, the process, socket and file listings, crontab and httpd.conf. The packet engine’s binary logs (var/nslog) are listed, not read.
Analysis optionsthe defaultsChange
Earlier analyses
Run commands on NetScalers
Typed or from a template, on the appliances you choose, now. Nothing is saved; each run is kept in
Automation › Run history with its report. To run them on a schedule, save them as a workflow from the review.
NetScaler integrity check
Reads every node of the chosen appliances over SSH and looks for the signs of tampering seen on
NetScalers: a setuid /bin/sh, setuid files where none belong, the web server set to run
PHP on files that are not PHP or to serve a web shell behind an icon's address, a guard in
httpd.conf commented out, a web shell in the gateway's plug-in folders, the SLAPSHOT
tunneler's files and process, and the web server's account running other programs. Nothing is written to an appliance.
Choose the appliances
A pair is checked on both nodes: a backdoor on the secondary is still a backdoor. An imported configuration is not listed, since there is no appliance behind it.
What it runsfive read-only commands per node, judged hereShow
Earlier checks
Certificates
Every SSL certificate installed across the fleet, with what is about to expire first.
Appliance management
Connect NetScalers, configure collection, and manage appliance access.
Uptime monitor
Monitor any host or IP by ICMP ping, TCP port, UDP, SMTP or HTTP(S). Live status streams in real time; up/down and latency are tracked with a 24-hour uptime figure.
●
Loading…
Add target
Uptime report
Syslog messages
Receiver status…
Loading…
Launch analysis
Why a session took long to launch, or did not: a verdict with the evidence across the gateway, StoreFront and the VDA, from the records held here.
Type the user's name as the gateway logs it (or part of it), pick the window, and press Analyze. The verdict comes first; under it the stages of the launch, the timeline across the three sides and each side's records.
Estate map
Reading…
Ask the map
Pick a thing and ask what would be affected if it went away, or what it rests on. The answer says how sure each step is and what could not be read.
Session performance
What each Citrix session costs, how long its logon took and how it reached the VDA — from the VDAs' own agents and the gateways' syslog.
Reading…
HDX Insight data
Who connected through the gateway, how their session performed, and what needs looking at — decoded from the appliances' own AppFlow export.
Reading…
What this is
NetScaler exports its AppFlow (IPFIX) records to this host. The decoder reads gateway sign-ins, ICA launches and sessions as they arrive, written against one capture from a real gateway (2026-09-14) and nothing else: every field it names was named from that capture's values, and a record kind it has not seen is counted, not guessed at. The per-session HDX metrics (round trip and bandwidth, one record a minute) arrive once the AppFlow policy is bound at the gateway's ICA_REQUEST point as well, which Configure a NetScaler does (confirmed on 2026-09-15). The raw capture is kept untouched, and Decode the kept capture reads it into the tables again.
Configure a NetScaler to send HDX data here
Pushes an AppFlow collector aimed at this host's capture port, an action and a policy, binds the policy to the gateway virtual servers ticked below at both bind points (Request and ICA Request; the second is what carries the per-session HDX metrics) and turns their AppFlow logging on, sets the template refresh, then runs save ns config. Over SSH, one command at a time; each step's outcome is the appliance's own words. The capture here must be listening for anything to arrive.
Compare configurations
Compares two imported ns.conf configs line by line. Volatile and secret fields — passwords, keys, certificate material, sequence numbers, per-node IDs — are excluded so only meaningful differences show. System time is shown for reference.
Configure a NetScaler to send logs here
This pushes an audit syslog action, policy, and global bind onto the appliance over SSH, then runs save ns config. The appliance will start sending its logs to this dashboard.
Binds to audit syslogGlobal (the correct audit bind point), falling back automatically on old firmware. Tick “Force classic bind” only to force bind system global.
Configured Pools
Add, edit, or remove pools that this dashboard monitors.
Settings
Runtime values that take effect immediately — no service restart needed.
Collection
minutes
(1 to 1440)
minutes
(1 to 1440)
states every
min, full inventory every
min, not heard after
min
refusals in a row, try again every
min
hours
(1 to 168)
hours
(default 6; each agent asks Windows Update what is pending on this cadence, and at once when Scan now is pressed)
(default on; when this dashboard ships a newer agent, each agent from ag_b045 downloads it, checks it and restarts on it, waiting while its server is installing anything -- Windows Installer, Windows updates, a deploy or an install Vantage scheduled. The update scan script and nssm.exe still come with Update agents)
seconds
(default 300; the applications sweep, Citrix, RD Gateway and Hyper-V run on this cadence and carry their last result in between -- OS health and the event rules run every cycle; agents from ag_b032)
seconds
(5 to 300)
Data retention
days
(0 to 3650; 0 means forever)
days
(default 14; 0 means forever; the decoded HDX Insight records follow it)
MB
(default 64; 0 keeps the file growing to its 256 MB stop; the HDX records are decoded as they arrive, the file is for Download and Decode the kept capture)
Sign-in protection
When an address is blocked: at this many failed sign-ins, or this many different accounts tried, within the window; unblocked after that many quiet hours.
Windows servers block with a Windows Firewall rule written by the agent; NetScaler gateways with a responder policy on the appliance (enforcement is switched on under Identity threat).
Windows servers
NetScaler gateways
IP reputation databases
When this is off nothing is pulled and the databases are not shown on Security › Integrations. Vantage's own lists (self-learned and hand-added) are not affected.
Off by default. When this is off the firewall section at the foot of Security › Integrations is hidden (Sync now and the push cap, UniFi, Other firewalls), nothing is sent to a UniFi controller, and none of the external databases' addresses go to the NetScaler data set or the Windows agents; the databases still sync and answer lookups. Vantage's own lists (self-learned and hand-added) are enforced by their rules as before. An installation that already pushed a Block-mode list or had UniFi set up keeps this on after the update.
Console
Off by default. Who is on a console, an administrator's Take over and Send text stay available on every VM's Console tab either way.
The console draws what the last scan stored. A pool is rescanned the moment one of its tasks finishes, and on this cadence besides, so the tree is current without anyone asking. A scan is a read of the pool's records, a second or two.
Reading…
A recipe is typed where the guest's cursor is; it cannot open a prompt or run elevated on its own, so say what it needs.
Geolocation
Where an address is -- country, region, city, network -- on the Identity threat and HDX Insight data pages, beside every source address. The Windows servers' feeds carry it from their agent.
Reading…
An .mmdb, or MaxMind's tar.gz as downloaded. It is sent in 8 MB pieces, so a proxy's request limit does not apply (IIS refuses a single request over 30 MB). A file copied into the install folder as geoip.mmdb is picked up on its own.
DB-IP City Lite (included) -- the free database the installer carries, fetched again from DB-IP each month so it stays current. No account; only the file's request leaves this host. A MaxMind account, or a file you upload, takes its place.
Reading…
IP Geolocation by DB-IP, licensed under CC BY 4.0.
Download from MaxMind -- the database straight from your MaxMind account over their download API, and again on a schedule so it stays current. GeoLite2 needs a free MaxMind account and a licence key from it; the key is stored encrypted on this host and never shown again.
Reading…
Only the address leaves this host, at most 25 per pass, cached 30 days. The default is the provider the Windows agent uses; a provider swap is a URL change, the fields are read by their usual names.
MAC vendor lookup
Which manufacturer a MAC address was registered to, on the Estate map: an appliance's ARP table gives every member address a MAC, and a VM carries its own. The registry is IEEE's and it is kept on this server — no address from your estate is ever sent to a lookup service, because a MAC address is inventory and a service receiving one also receives this installation's address and the time. Vantage ships no copy of the registry: IEEE publishes it and the terms are theirs.
Reading…
Registries
The download is a plain request for a public file: nothing about this estate goes with it. A 36-bit assignment lives inside a 24-bit one, so all three sizes are worth having — the match takes the most specific first and says which it used.
For a server with no route to the internet. IEEE's own CSV; the file's header row is read, so the column order does not matter.
Auto-deploy
When enabled, the dashboard uploads its embedded copy of the health-check script to each coordinator on enrollment, and re-uploads when the SHA-256 differs (e.g. after a dashboard upgrade ships an updated script). Disable only if you manage
XenServerHealthCheck.sh via configuration management.
The most recent report is kept on the coordinator so you can inspect it directly via SSH. Older reports are pruned after each successful import (the raw markdown is already stored in the dashboard's database). Disable only if some other tool reads the full history of those files.
Embedded script SHA-256:
...
Health-check thresholds
These values are passed to
XenServerHealthCheck.sh as environment variables on every run, so changes take effect on the next collection (no script re-upload needed). All values are integer percentages or multipliers.
%
%
%
%
%
%
x vCPU
x vCPU
%
minutes
Note: warning thresholds must give you headroom before critical. For free-space and free-memory, warn % must be higher than critical %. For disk usage and load multiplier, warn must be lower than critical.
Backup & restore
Export this box's full configuration — pools, NetScalers, monitors, settings, branding, AD mapping, collected history, and the SSH key — as a single file. Import restores a backup onto this box (or clones another box's setup here).
Sensitive: the backup file contains the SSH private key that grants root access to your pools. Store and transfer it securely — treat it like a password.
Authentication & Authorization
Configure Active Directory connectivity and which AD groups map to dashboard roles.
Changes apply immediately to new logins.
Active Directory
For a directory behind a VIP / load balancer whose certificate can't match the dialed address. The connection stays encrypted, but the server certificate is not verified.
Staying signed in
A session is an idle timeout: as long as a dashboard window is open and visible it keeps itself alive, so nobody gets signed out mid-shift. These two settings decide what happens after that.
Counted from the last request this browser made, not from when you signed in.
The stay-signed-in credential is a random token, stored here only as a hash and replaced every time it is used, so a copied cookie stops working as soon as the real browser comes back. Signing out revokes it. Setting this to 0 revokes every one that is currently issued. It is never given out on Windows-authenticated installs, which re-authenticate on every request anyway.
Tests the values above (even unsaved) by binding once.
Service accounts
One credential per product, used for its ongoing work and stored
encrypted on this host. Neither is ever shown again and no endpoint
returns either password. These are not the credentials anyone
signs in with, and not the admin credentials used to install an agent —
those are typed at the moment of use and never stored.
NetScaler appliances
One credential for every appliance set to Service account (shared).
Read-only on the appliances: collection only reads. Update the password here
once and all of them use the new one on their next connection — no
per-appliance edits. Stored encrypted; never shown again.
Configuration account (NITRO)
NetScaler configuration from Vantage is a licensed feature. It uses a
read-write NITRO account — a NetScaler system user with a
configuration (read-write) command policy — over NITRO only when an
administrator changes an appliance's configuration (and when the sign-in
block list is written to the appliances), never by ordinary collection.
It may be a separate account (defence in depth: a leaked monitoring
credential cannot configure) or the same account as monitoring if
that account already has read-write rights — either is allowed.
NITRO must be enabled and its certificate pinned on each appliance
for a change to be written; otherwise it is refused. Stored encrypted, never
shown again. Leave the username empty and save to remove it.
Windows Infrastructure agent
One credential for the agent service on every monitored Windows server.
It needs “log on as a service” and read access to the agent folder —
nothing more. Changing it here applies to servers deployed from now on;
those already deployed keep the account they were installed with until
they are redeployed. Stored encrypted; never shown again.
Role mappings
Add AD group names (sAMAccountName, e.g.
XenServer-Admins) that should grant each role.
Highest role wins if a user is in multiple. Group names are matched case-insensitively.
Admin
admin Everything Operator can do, plus: configure authentication, install licenses, manage NetScaler certificates, and configure/remove NetScaler syslogOperator
operator Everything Viewer can see, plus: enroll/edit/delete XenServer pools, trigger collections, and mark NetScaler config changes as readViewer
viewer Read-only across all modules: XenServer pools, NetScaler topology & stats, uptime monitors, syslog, and reportsSetup account
A local fallback account used to bootstrap the dashboard. Disable it once your AD groups are configured and working.
Validate groups against AD
Confirms each AD group name above actually exists in the directory. Your password is used once to bind, then discarded — not stored. Validation is informational; you can still save groups that don't exist yet.
Test AD connection
Binds to the domain using the values entered above (Domain, LDAP server(s), Search base) — even if you haven't saved them yet. Enter an AD account to bind with; its password is used once, then discarded — not stored.
Loading…
Set elsewhere
NetScaler gateways' blocking rule and enforcement:
Where an address is (the attack map and the reputation's places):
Firewalls that hold the block list:
Webroot download proxy (hosted by Vantage)
Look up an address
See where an address is, which feeds flag it, what it has done on your estate, and whether the shared list blocks it. Nothing is contacted but the reverse-DNS you ask for here (and geolocation, only if the provider is switched on).
IP reputation databases reputation.db
Every external IP-reputation source lives here, in this server's own reputation.db. First is the Vantage reputation blocklist the licensing portal hosts (CrowdSec, and more later) — pulled over updates.dtrvantage.com with this box's own licence, no URL or key to enter. Below it, add your own custom lists by URL — a CrowdSec mirror, or free public feeds (FireHOL, blocklist.de, Emerging Threats) that need no account. Each has its own sync interval and Block / Watch mode; a Block source folds into the one shared block list, so your Windows firewall-sync and UniFi drop them. A big list is kept whole for matching; with Push the external Block lists to the firewalls switched on in Settings, a capped, locally-seen-first subset is pushed to the firewalls (Sync now and the cap are then at the foot of this page).
UniFi
Firewall rules on the gateway
Not read yet.
Other firewalls Coming soon
Cisco Meraki is next, then other firewalls; each gets a card of its own here holding the same one list. Meanwhile any firewall can take the list by hand: Security › Blocklist › Export (.txt or .csv).
Endpoint protection
What each server’s endpoint protection reports about itself, and who has been attacking its sign-ins. What counts as protected?
Loading…
Wherever IIS runs: what its configuration exposes, what the requests in its logs are trying, and what was found on the server itself. Three kinds, never mixed: an exposure is not an attack, and an attempt is not a compromise.
Loading…
NetScaler Gateway sign-ins
Loading…
Loading…
Enrolled devices
Monitor and manage machines across all sites.
Loading...
Lockdown policy
Application control and endpoint restrictions.
Site keys
Enrolment keys and installer distribution.
Loading…
Servers
Role and hosting platform are separate filters. Tick a row to act on it; click one to open it.
Deploy agent to
Runs from the Vantage host over WinRM. These credentials are used for
this deployment only — they are not stored, and Vantage keeps no
copy once the run has started. The agent service afterwards runs as the
shared service account, not as this admin.
Deploying rotates this server’s secret. The agent already on it
stops being accepted the moment this starts, and stays that way until
the deployment finishes.
Build a Windows infrastructure report
Choose what goes in it. Sections you leave out are not collected, not
summarised and not mentioned.
Title
Servers
Sections
Administrator credentials
Run diagnostics on
Runs one collection cycle on the server, now, in the foreground, and
shows exactly what it said. Nothing is copied, no secret is rotated and
the service is not touched — so there is nothing to undo if it
fails. The credentials are used for this run only and are not stored.
This goes to the machine directly.
The agent calls Vantage, never the other way round, so the only thing
Vantage can normally do is answer the agent’s next check-in
— which is what Health now does. That needs the agent to be
reporting. When it is not, this is the way in, and Windows wants an
identity with rights on the box. Where delegation is in place that is
you, with no password; where it is not, an administrator account
is needed for this run only. The service account is deliberately not one:
it is a plain user, so a password stored for monitoring is
not a password worth stealing.
Inventory across the estate
Read over WinRM, on a schedule,
with no agent involved. Vantage tries its own computer account first, then
the shared service account; a run you start here uses your own account
where the target allows it.
Update agents
Each server is updated in turn, and each one’s secret is rotated as
it starts. A server whose update fails stops reporting until it is
deployed again — the run says which ones those were.
Shadow
Joins the user’s session from your own workstation, with your own Windows sign-in: run one of these there. Vantage reads whether the server allows it and can set that; it cannot open the session itself, since a browser cannot start mstsc.
Reboot
Runs as you, by delegation. Sessions with unsaved work lose it whichever you choose.
Deploy the agent to virtual machines
Remove
Its metrics and alert history are deleted and cannot be recovered.
Vantage removes the server from its own records only after the agent is
actually gone from the machine. If the uninstall fails, the server stays
here and says why.
Job
Edit
Applied on this server’s next report — the agent adopts its
configuration from Vantage, so none of this needs a redeploy. The server
name cannot be changed: it is the identity the agent was deployed with.
Edit
Only what you set here changes; everything left as it is keeps each
server’s own value. Applied on each server’s next report
— no redeploy needed. Notes stay per server.