HDX Insight without NetScaler Console

The gateway already sends HDX Insight as AppFlow (IPFIX). DTR Vantage receives it on your own server and decodes the sign-ins, launches, sessions, round trip and bandwidth, with no NetScaler Console (ADM) appliance.

Receives

AppFlow (IPFIX)

UDP 4739, on the Vantage server

Decodes

sign-ins · launches · sessions

ICA round trip and bandwidth each minute

Set up

one dialog

collector, action, policy, bound at Request and ICA Request

Joined to

the VDA

logon phases and counters from the agent

Kept

with syslog retention

pruned hourly

The direct answer. Point the gateway’s AppFlow collector at the DTR Vantage server and bind the AppFlow policy to each Gateway virtual server at both Request and ICA Request. The ICA Request bind is what makes the per-session metrics flow; with Request alone you get sign-ins and launches but no round trip. Vantage’s Configure a NetScaler dialog does every step and shows each command’s answer. Within a minute of the next launch you have, per session: the user, client, gateway, the VDA it reached, the round trip each minute, bytes each way, reconnects and when the connection closed.

What the gateway sends, and what you get

Record	What Vantage shows
Gateway sign-in	user, client address, gateway, AAA virtual server, policy, and the appliance’s failure code when it failed
ICA launch	the resource, the gateway, the session it belongs to
ICA session start	client version and host name, user, domain, the VDA’s name, address and version
ICA metrics, each minute	round trip (ms) and bytes to and from the client
Connection closed	when, and which connection; reconnects are counted

HDX Insight data in DTR Vantage: the sessions table with round trip, gateway, VDA and state, searchable by user

The commands

What the dialog runs over SSH, in order (the names are Vantage’s; yours can differ):

enable ns feature AppFlow
add appflow collector DTRV_HDX -IPAddress <vantage-ip> -port 4739 -Transport ipfix
add appflow action DTRV_HDX_ACT -collectors DTRV_HDX
add appflow policy DTRV_HDX_POL true DTRV_HDX_ACT
bind vpn vserver <gateway> -policy DTRV_HDX_POL -priority 100 -type REQUEST
bind vpn vserver <gateway> -policy DTRV_HDX_POL -priority 100 -type ICA_REQUEST
set vpn vserver <gateway> -appflowLog ENABLED
set appflow param -templateRefresh 60 -flowRecordInterval 60
save ns config

Where it is smaller than NetScaler Console

NetScaler Console does much more than HDX Insight. Vantage decodes the record types it has seen in real captures and names the rest by number instead of guessing. Some of the gateway’s templates (for example the client-side measurements) did not carry data in the captures so far, so they are not shown. What Vantage adds is the other side of the session: the VDA’s logon broken into phases, its counters, and a Launch analysis verdict that reads the gateway and the VDA together.

Questions

Do I need NetScaler Console (ADM) for HDX Insight?

Not to collect it. The gateway sends HDX Insight as AppFlow (IPFIX) to any collector it is pointed at; DTR Vantage is one, running on a Windows server you already have.

Why do I see sign-ins and launches but no round trip?

The AppFlow policy is probably bound to the gateway at Request only. Bind it at ICA Request as well, then start a new session.

Which port does it use?

UDP 4739, the IPFIX port. DTR Vantage adds the Windows Firewall rule for it when the capture starts.

How long is the data kept?

As long as the syslog retention you set; it is pruned hourly. The raw capture file starts over at 64 MB.

Checked against build b614, 2026-10-18. Where a statement is product knowledge rather than a tested capture, it says so.

The Data analytics modules Session performance from the VDA Troubleshooting failed launches Start a free trial