Citrix Virtual Apps and Desktops

FAQ

December 10, 2025

Contributed by:

How can I check the running log server configurations, like MAX_RESERVE_DAYS?

You can check the container environment values using either of the following commands:

docker inspect logserver |findstr MAX_RESERVE_DAYS Or by checking the container environment: docker exec -it logserver env |grep MAX_RESERVE_DAYS

If nothing is returned, it means the log server is using the default value: MAX_RESERVE_DAYS=7
Do I need to purchase Docker Desktop licenses when installing the log server container image on Windows?

Yes. A valid Docker Desktop license is required.
Should I use a new server for log server installation?

Yes. It is recommended to use a dedicated server for the log server installation to ensure performance and isolation.
What is the sustained ingest capacity of a single AOT Log Server? What are the maximum and safe Events-Per-Second (EPS) limits?

A single AOT Log Server supports a sustained ingest capacity of 10,000 events per second (EPS). This value represents both the maximum and the safe operating threshold for continuous ingestion.
How many components can a single AOT Log Server handle? Is there a maximum limit?

A single Log Server can connect up to 128,000 components, but it can only process about 10,000 logs per second. So the number of machines is rarely the issue — the real sizing factor is how many logs your users generate during peak activity.
What is the burst tolerance of the AOT Log Server? How much sudden log spike can it handle without loss or backlog breach?

The AOT Log Server can handle short-term bursts of up to 2× the normal event rate without losing logs. If log volume spikes beyond this (for example, 5×), the system will not be able to persist events reliably, and OpenSearch will start dropping logs because it cannot index them fast enough.
Can the AOT Log Server compress logs? What compression ratio should we expect?

Yes. The AOT Log Server uses the default LZ4 compression algorithm for storing logs in OpenSearch. The typical compression ratio is approximately 2:1, meaning log data is reduced to less than half its original size while maintaining fast read/write performance.
For each infrastructure type (single-site on-prem, multi-site on-prem, single-region cloud, multi-region cloud, hybrid, MSP/tenant), where should the AOT Log Server be deployed and why?

The AOT Log Server should always be deployed in the same line of sight as the VDAs. This ensures stable connectivity and helps maintain low latency between the components generating logs and the log server that ingests them. As long as every component (VDAs, DDCs, StoreFront, Gateway, etc.) can reliably reach the log server, the environment will function correctly.
Do we need one log server per region, or can everything be centralized? What about latency and egress?

You can centralize the log server, but customers should evaluate the latency and egress cost implications for their environment. The latency between regions may affect log ingestion, especially during high-volume periods. If the round-trip latency is high, spikes or bursts of logs may cause delays, backlog build-up, or potential loss during peak loads. Egress charges may apply when logs cross regional or cloud boundaries.
What are the minimum hardware specifications for supporting 1,000 machines with the AOT Log Server?

For environments with up to 1,000 machines, you need: 1 node (Log Server + OpenSearch combined), 4 vCPUs, 8 GB RAM, 2,000 IOPS minimum (SSD or NVMe recommended), 1 Gbps NIC. This setup is suitable for small or single-site deployments with moderate log volume.
How can I troubleshoot if there is a problem with the Log Server?

LogServer is running as a docker container, so all docker commands could be used to find the issues:
```
docker logs logserver
docker inspect logserver

```
And also, user could attach into the running container and view logs of logserver self:
```
docker exec –it logserver bash

```
In the logserver docker container bash shell, user can verify the health of logserver and opensearch:
```
curl http://localhost:5000/Ping
curl http://localhost:9200/_cluster/health?pretty

```
And check logs inside the container:
```
tail Config/applogs.txt
tail Config/weblogs.txt

```
If need more logs, user could modify the LOG_LEVEL=0 in StartLogServer.sh/StartLogServer.bat and restart the logserver by these script files. Then the detailed logs will include TRACE, DEBUG, INFO, WARN, ERROR all levels.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

FAQ

December 10, 2025

Contributed by:

December 10, 2025

Contributed by:

FAQ

In this article