Citrix session-performance monitoring
How DTR Vantage watches a Citrix session from both ends: the VDA it runs on and the NetScaler Gateway it came through, on one page, on your own server.
ICA Session counters, and the logon duration from the RDS event log. On the NetScaler Gateway, it decodes the HDX Insight AppFlow records the appliance exports: the sign-in, the launch, the ICA connection to the VDA, and a metric record a minute with round trip and bytes each way. Both land in the database on your Vantage server and are shown together under Data analytics, searched by user. No Splunk, no ADM, no cloud tenant.
What the VDA agent collects
| Metric | Where it comes from | Cadence |
|---|---|---|
| Sessions signed in, with user, domain, session id and name | quser; the Terminal Services API and the console session as fallbacks; when nobody names the user, the VDA's own ICA counter instance name (console (user)) does | every agent cycle |
| CPU, memory, disk per session | the per-process counters (two raw samples a second apart, as Task Manager does), grouped by session id | every cycle on a VDA |
| ICA round trip, bandwidth in and out | the VDA's \ICA Session(*) performance counters, matched to the session by instance name | every cycle while an ICA connection is up |
| Logon duration | RDS LocalSessionManager events 21 to 22 per session id | every cycle |
| Logon breakdown (Director's Session Logon Duration) | once per logon, from the VDA's own logs: Winlogon subscribers, User Profile Service, Group Policy with every client-side extension, logon scripts, Citrix Profile Management, PrintService, Security (pre-shell), and Citrix's EUEM record for the Workspace app and VDA startup panels | once, on the cycle after the shell starts; at most a few per cycle |
| Running applications | the process list per session with CPU and IO | the slow cadence (5 min by default) |
Set the server's Citrix role to VDA and the agent adds the session collector on its next cycle. The agent runs as a least-privilege service account; where quser refuses it, the page says so and names the session from the other sources instead of showing nobody.
What the gateway sends
| Record | AppFlow template | What Vantage reads from it |
|---|---|---|
| Gateway sign-in | 292 | user, client address, gateway, AAA virtual server, policy, the failure code |
| ICA launch | 294 | the published resource, the gateway, the session GUID |
| Session | 293 | the session GUID, user, gateway, the store and store server |
| ICA connection | 295 | the gateway's session GUID, the VDA's address and port, the client's address and port: the join to the launch |
| ICA session start | 271 | the ICA session GUID, client version and host, user, domain, the VDA's name and version |
| ICA metric, once a minute | 272 | round trip in ms, bytes from and to the client, the interval |
| Connection closed | 287 | the client, the VDA, the time, the close code |
Configure a NetScaler on the HDX Insight page sets the appliance up in one dialog (collector, action, policy bound at Request and ICA Request on each gateway you tick), every step in the appliance's own words. The template numbers and every field name were established from captures taken on NetScaler 14.1 appliances, not from documentation, and a record that does not read cleanly is counted as unreadable with its bytes shown, never displayed as data. The per-session HDX metrics arrive only once the policy is bound at ICA Request; the page says which templates the appliance has announced but not filled.
How the views connect
- One user, every table. Type a name on the HDX Insight page and the sign-ins, launches, sessions and ICA sessions narrow to that user on the server, past any row cap; pick a row on Session performance and the charts narrow to that session.
- The launch to the VDA session. An ICA session's start record and the gateway's ICA connection record share the client address and port; the connection carries the VDA's address, which Vantage matches to the Windows server that reports from it. So a launch on the gateway side lands on the VDA's row on the Windows side.
- The gateway's syslog beside it. LOGIN, LOGOUT, ICASTART and ICAEND lines from the syslog receiver are joined by ICA UUID into the Gateway connections section of Session performance, with the destination VDA named.
- Reconnects, closes, the worst minute. The ICA sessions table counts reconnects per session GUID, marks closed connections with the appliance's close code, and shows the last, average and worst round trip; a session's chart shows each minute against the 150 ms line.
- Every logon, broken down. A logon's phases (profile load, group policy and each extension, logon scripts, printers, pre-shell) with the gap between them, beside the user's average and everyone's over the window, in Director's chart; the Workspace app and VDA startup panels from Citrix's EUEM record; a log the agent could not read is said as such. Each logon is analysed once, on the VDA, bounded so the agent is never slowed.
- History. Session samples are kept 7 days (one row per session per report); HDX records follow the syslog retention setting. Charts run from one hour to seven days.
What it needs
| Piece | Requirement |
|---|---|
| Licence | NetScaler Data Analytics (the HDX side) with NetScaler monitoring; Windows Infrastructure for the VDA side |
| On the VDA | the Vantage agent (deployed from the dashboard over WinRM), the server's Citrix role set to VDA; the VDA's performance counters registered (the page names the counter sets it saw when the ICA Session object is missing) |
| On the gateway | AppFlow export to the Vantage server on UDP 4739, set up from the HDX Insight page or by hand; NetScaler 14.1 is what the decoder was written against |
| On the Vantage server | the capture listener (on by default) and a firewall rule the installer opens |
What it says when it cannot read
Empty and could-not-read are never the same line. On Session performance each server gets one plain sentence: the report's age first (red when the agent is not reporting), then "No ICA connection was up at that report, so the round trip and bandwidth were not read", "The session list could not be read on X: <quser's words>", "The session's user could not be named on X", or the agent build it needs. Administrators get the diagnostics behind a Details link: the counter set's answer, what quser, the Terminal Services API and WMI each said, the counter instances seen. On HDX Insight the note says whether the capture is off, nothing has arrived, records arrived but none in the window, or the writer is failing; the exporters table says which appliance sent what.
What it does not do
- No client-side measurements (the endpoint's Wi-Fi, CPU or ISP latency): Vantage has no agent on the user's device. The gateway's round trip is the nearest it gets.
- No per-process network counters (Windows does not expose one); network is per session from the ICA counters.
- No Delivery Controller, Citrix Cloud or Director data yet: registration state, brokering and the launch's enumeration stage are not read today (the broker integration is on the roadmap). See Troubleshooting failed launches for what that means.
- The VDA's ICA counters exist only while an ICA connection is up; a console session or a dropped connection reads as "not read", said as such.
- AppFlow templates 273 to 276 and 301 (client-side and application-level HDX families) have not been seen carrying data on the estates captured; they are listed as silent, not decoded from a guess.
Checked against build b429, 2026-09-21. Where a statement is product knowledge rather than a tested capture, it says so.