VDA and NetScaler session diagnostics
The same session seen from the VDA and from the gateway, what each side can tell you on its own, and what the two together settle.
Two clocks
one row
the VDA's counters and the gateway's metrics on the same session
Round trip
both ends
the VDA's ICA RTT beside the gateway's per-minute RTT
Join
3 keys
user · client ip:port · the VDA's address
Stored
your server
the database on the VM, 7 days of samples and the syslog retention
Honest
always
not read is said, with the reason
The direct answer. The VDA perspective tells you what the session is doing: its CPU, memory and disk, its logon time, and the ICA round trip and bandwidth as the VDA measures them. The NetScaler perspective tells you what the session's path is doing: which gateway and virtual server it came through, the client's address, the VDA it was sent to, a round trip and bytes each way once a minute, reconnects and the close. Vantage joins them by user and by the connection's client address and port. When both round trips are low and the user is still waiting, the session's own CPU or disk is the suspect; when the gateway's round trip climbs while the VDA's counters read normal or are not read, the path or the connection is; when the VDA's session exists but the gateway holds no connection, the user came in another way.
The VDA perspective
| What | Source on the VDA | Where it shows |
|---|---|---|
| Who is signed in, since when, from which client | quser, the Terminal Services API, the console session, the ICA counter instance name | Session performance, the sessions table; the server page's Sessions fold |
| Logon duration | RDS LocalSessionManager events 21 and 22 | the sessions table |
| CPU, memory, disk per session | two raw process-counter samples a second apart, grouped by session | the charts per user |
| ICA round trip and bandwidth | the ICA Session counter object, per instance | the round trip chart against 150 ms; the bandwidth chart |
| What the box is like | services, disks, reboot pending, event log rules, certificates, the Citrix role | the server's verdict and reasons |
The NetScaler perspective
| What | Source on the appliance | Where it shows |
|---|---|---|
| The sign-in | AppFlow sign-in record; syslog LOGIN / LOGIN_FAILED with the appliance's reason | HDX Insight sign-ins; Session performance's Gateway connections; Identity threat |
| The launch and the session | AppFlow launch and session records; syslog ICASTART / ICAEND by ICA UUID | HDX Insight launches and sessions |
| The connection to the VDA | AppFlow ICA connection record: gateway session, client ip:port, VDA ip:port | the ICA sessions table, with the VDA named |
| Round trip and bytes, once a minute | AppFlow ICA metric record | the ICA session's chart |
| Reconnects and the close | the ICA start record seen again with a new client port; the close record with its code | the ICA sessions table's State column |
| The appliance itself | the poll over SSH and NITRO: CPU, memory, disk, HA, certificates, the gateway's bindings and STA servers | the appliance's page; Analyze |
Reading both together
| Symptom | VDA side | Gateway side | What it points at |
|---|---|---|---|
| Slow session, user on the LAN through the gateway | RTT 67 ms, CPU 90 % in that session | RTT 61 ms per minute, bytes normal | the session's own load: end the process, or the VDA is oversubscribed |
| Slow session from a remote site | RTT 240 ms, CPU low | RTT 230 ms, bytes low | the path: both ends agree; look at the client's link, not the VDA |
| Session freezes, then comes back | counters not read for the minutes between | reconnects counted, the close record with its code, a new client port | the connection dropping: the client's network or the gateway's DTLS / TCP profile |
| User says they cannot get in | no session row | a sign-in with the failure code, or a sign-in and no launch | the credential or the store / broker: see failed launches |
| A session exists with no gateway connection | a session row named from the counters | nothing for that user | the user came in directly (RDP, an internal StoreFront), not through the gateway |
The figures are illustrative; the rows are the cases the product was built to tell apart.
What each side needs, and its limits
VDA side. Windows Infrastructure licence, the agent on the VDA with the Citrix role VDA. Limits: the ICA counters exist only while an ICA connection is up; the agent is not an administrator, so the session list can come from the counter instance rather than quser, and the page names which; no client-device measurements.
Gateway side. NetScaler monitoring and NetScaler Data Analytics licences, AppFlow bound at Request and ICA Request, syslog to the receiver. Limits: the decoder was written from captures on NetScaler 14.1; a record it cannot read cleanly is counted as unreadable with its bytes shown; an exporter that is not an enrolled appliance is listed as such, never guessed.
Checked against build b429, 2026-09-21. Where a statement is product knowledge rather than a tested capture, it says so.