Citrix Licensing Telemetry data elements
License Server data elements
Metadata fields
| Field | Description | Example |
|---|---|---|
| ClientTool | This field isn’t in use. | Not applicable |
| UploadUser | This field isn’t in use. | Not applicable |
UTCDate |
Report generation time in UTC format. | 2022-10-10T06:11:14Z |
| Date | Report generation time in local time format. | 10/10/2022 02:11:14 |
| Product | Name of the upload. | LicenseServerCompliance |
| ProductVersion | This is the version of the upload. | 2.0 |
| ProductUTCDeployDate | Denotes the time when the License Server is installed. | 2022-08-16T00:00:00Z |
| SiteID | This field isn’t in use. | Not applicable |
| SiteName | This field isn’t in use. | Not applicable |
| Component | This field isn’t in use. | Not applicable |
| UI | This field ensures the integrity of the uploaded file. | 8826d6ac8e1c8e68e471ae90c2bacbe1854f8281a6f5ae40cc7b74114e026abc |
License Server and License Usage information
| Field name | Description | Example value |
|---|---|---|
| License Server information | ||
| GUID | A unique identifier created during install and preserved during upgrades. This field is used to identify which uploads are from the same server. | a5ae17c9-8a4a-4318-938f-a8c6da2aa2ef |
| HardwareId | This field is a unique identifier for the License Server instance. | E824249098A96BF0 |
| FQDN | License Server machine and domain name. This value is sent to help identify License Servers in the reporting experience. Used to pair a License Server calling home to a license allocation record in the back office. | CITRIX-12T5MRV4 |
| InstallUTC | This value denotes the time when the License Server is installed. | 2016-10-12T00:00:00Z |
| ProductVersion | Identifies the License Server version. | 11.16.6.0. build 35000 |
| SGPClockErrorCode | Error code indicating why the License Server entered the License burst mode. | 0 |
| SGPMaxDays | Maximum days remaining in the License burst mode. | 15 |
| Inventory | ||
| Feature | ||
| ID | This value represents the product code license usage is associated with | CAG_AAC_CCU |
| UDBinFileCreatedUTC | Timestamp of when the file used to track user or device licenses was created. | 2016-11-09T00:55:56Z |
| UDReportGenerationUTC | Timestamp of when the user or device report was generated. | 2016-11-09T00:55:56Z |
| UDAdminUsersReleased | Count of users released by udadmin. |
3 |
| UDAdminDevicesReleased | Count of devices released by udadmin. |
3 |
SADate |
This field is used to build a view of license usage over time. | For examples, see SADate in the following section. |
| SADate | ||
| id | Captures the SA Date through the ID attribute of the SADate element. |
2022.1231 |
| DateSampleStartUTC | Start time of the sample being collected. | 2016-11-08T01:08:13Z |
| DateSampleStopUTC | End time of the sample being collected. | 2016-11-09T00:55:56Z |
| CountUsedMax | This value represents the maximum number of licenses used by this customer. | 6 |
| CCUDevices | Lists the device IDs that use the Citrix concurrent licenses. This helps in getting the license usage over time. | |
| Active | If the value is ‘1’, it’s in the current inventory. If the value is ‘0’, it appears only in historical records and is no longer part of the current inventory either because it is removed or expired. | 1 |
| Licensees | The Licensees field has three sub fields namely CountTotal, Users, and Devices. | For examples, see Licensees in the following section. |
| CountInstalled | The number of licenses installed. | 1203 |
| Pool | For examples, see Pool in the following section. | |
| CCUDevices | ||
| DevId | Specifies the unique concurrent device identifier. This is applicable only for concurrent licenses. | C39A925064A3 |
| Licensees | ||
| CountTotal | Total number of licenses in use at the time the sample was taken. Total number is the sum of users and devices. | 3 |
| Users | Specific users where a user license is assigned, contributing to the total count. This is applicable only for user/device licenses. | For examples, see Users in the following section. |
| Devices | Specific devices where a device license is assigned contributing to the total count. This is applicable only for user/device licenses. | For examples, see Devices in the following section. |
| Users | ||
| timeLastLogin | Last login time event from a user. | 2022-07-12T10:00:00 |
| ID | Specific users where a user license is assigned, contributing to the total count. |
user@domain.com or user |
| Devices | ||
| timeLastLogin | Last login time event from this device. | 2022-07-12T10:00:00 |
| DevId | Specifies the unique device identifier where a device license is assigned, contributing to the total count. | C39A925064A3 |
| Name | Friendly name for the device. | User1Desktop |
| Pool | ||
| Serial | This information allows Citrix to identify who the product is entitled to. | OR10:13 |
| DateExpiration | Most recent expiration date that impacts the license count in the pool. | 12/1/2020. |
| DateIssued | The date that the license file was issued. The date issued of the license file that expires first. | 1-Dec-03 |
| VendorStr | Representation of licensing information that informs products of what edition and mode that they must operate in. |
<![CDATA[;LT=Retail;GP=2;PSL=10;CL=ENT,ADV,STD,AST;SA=1;ODP=0]]>. |
| CountInstalled | Number of licenses installed among the pools for a given feature. | 100 |
| CountOverdraft | Number of licenses used above the installed quantity. | 0 |
| UsageSamples | For examples, see Sample in the following section. | |
| DateStart | Date from which licenses are valid on. | 31-Dec-2014 |
| Sample | ||
| Timestamp | Timestamp of the sample collection. | 2016-11-09T00:55:56Z |
| CountInUse | Number of licenses in use at the specific time stamp. | 3 |
| OverDraft | Number of licenses used above the installed quantity. | 0 |
| Installed | Number of licenses installed at the specific time stamp. | 100 |
| StartupCounts data elements | ||
| LPE | Product, Edition, and version information for each server communicating with the License Server. Example from left - Apps and Desktops Premium - 2012. | <ID><![CDATA[XDT_PLT_2020.1201]]></ID> |
| Count | Total number of LPEs connected to the License Server. | 2 |
| SupplementalGracePeriod | ||
| ID | This field represents the product code following the License burst mode detail is associated with. | XDT_ENT_UD |
SADate |
This field represents the CSS date for which the License burst mode was triggered. | 2019.1201 |
| SGPErrorCode | Error code for which License burst mode was triggered. | -4 |
| LicCount | License count for which License burst mode for triggered. | 100 |
| DateTriggerUTC | UTC date on which License burst mode was triggered for ID and SADate. |
2022-07-19T14:35:59Z |
| DateTriggerLocal | Local date on which License burst mode was triggered for ID and SADate. |
2022-07-19T10:35:59 |
Citrix Virtual Apps and Desktops data elements
Metadata fields
| Field | Description | Example |
|---|---|---|
| ClientTool | This field isn’t in use. | Not applicable |
| UploadUser | This field isn’t in use. | Not applicable |
UTCDate |
Report generation time in UTC format. | 2022-06-30T15:31:34Z |
| Date | Indicates the upload bundle creation date. | 06/30/2022 11:31:34 |
| Product | Identifies the upload bundle | LicenseServer.OnPremUsage |
| ProductVersion | Manifest schema version. | 1.0 |
| ProductDeployUTCDate | Denotes the time when the License Server is installed. | 2022-03-21T00:00:00Z |
| GUID | A unique identifier created during install and preserved during upgrades. This field is used to identify which uploads are from the same server. | a5ae17c9-8a4a-4318-938f-a8c6da2aa2ef |
| UploadType | Indicates if the license upload is manual or automatic. | Auto |
| Ccid | Indicates the Citrix Cloud Customer ID; only available with registered License Server. | xaxddaily1 |
| OrgID | Indicates the Org ID, the installed licenses are tied to; only available with registered License Server. | 23456123 |
| TotalFiles | Total number of files in the upload bundle. | 6 |
| SerialNumbers → Serial → ID | Represents the product code associated with the installed license. | XDS_ADV_CCS |
| SerialNumbers → Serial → SADate | Represents the CSS date associated with the installed license. | 2023.1201 |
| SerialNumbers → Serial → SN | This information allows us to identify who the product is entitled to. | eval1 |
| File → Name | Name of the uploaded file. | ue_lt_1683864965.zip |
| File → UI | Hash to indicate the integrity of the file. | 4d14a58f98b1ae2e9d965b2980b67853cfcac7c76e655952bd056ad6dc7a80ae |
| File → EventStartTS | Indicates the bundle data start time. | 1697417241680 |
| File → EventEndTS | Indicates the bundle data end time. | 1697430741834 |
| File → OfferingType → Name | Indicates the product. | Broker |
| FilesUI | Hash to indicate integrity of the bundle | 4d14a58f98b1ae2e9d965b2980b67853cfcac7c76e655952bd056ad6dc7a80ff |
| ManifestUI | Hash to indicate integrity of the manifest. | 4d14a58f98b1ae2e9d965b2980b67853cfcac7c76e655952bd056ad6dc7a8345 |
Headers
| Field | Description | Example |
|---|---|---|
| ver | Version of the license usage event. | 1.0 |
| id | Unique identifier of the usage event. | d4ce7919-5d80-44de-a8fa-102923fe0ead |
| type | Event type used by CAS to identify cloud usage events. | Cloud.Licensing |
| st | Timestamp when the event is generated in Broker. | 2011-08-12T20:17:46.384Z |
| prod | Originating product and deployment of the usage event. | XenDesktop.Broker |
| prodVer | DaaS or Citrix Virtual Apps and Desktops product version | 7.25.0.0 |
| user | Specifies the unique User ID used to identify the user initiating the session launch. | fullName: User-Steven |
| samName: CTXLAB\User-Steven | ||
| upn:User-Steven@ctxlabs.onmicrosoft.com | ||
| userLicenseId: User-Steven@CTXLABS04 | ||
| userSid: S-1-5-21-3711855558-820010554-2448362978-22222 | ||
| tenant -> id | Customer ID of the Citrix Cloud account. For on-premises environments the value is always “CitrixOnPremises”. | joj1mh0598tj |
| dvc -> dvcId | Specifies the unique device ID used to identify a device from where the session launch is initiated. | AE18C4D5 |
| dvc -> dvcName | Friendly name for the device. | Steven’s PC |
Payload
| Field | Description | Example |
|---|---|---|
| appProtectionKeyLoggingRequired | Denotes if the session is launched with Key Logging Protection enabled. | False |
| appProtectionScreenCaptureRequired | Denotes if the session is launched with Screen Capture Protection enabled. | False |
| cspTenantCustomerId | Customer ID of a CSP’s tenant’s Citrix Cloud account. This field is left empty if the customer ID is not available, for example, in on-premises deployments. | 6c2vtxgxyftt |
| isAnonymousUser | Denotes if an unauthenticated session is launched. | False |
| licenseActivityTimeStamp | Timestamp when the payload is generated. | 2011-08-12T20:17:46.384Z |
| licenseActivityType | Licensing event type. This field indicates if the licensing event type is for assignment or release action. | Connect |
| licenseModel | License model of the deployment. | UserDevice |
| productEdition | Product edition of the deployment. | Premium or Advanced |
| productId | Product ID of the product in the deployment. | CAVDS |
| protocol | The protocol used to launch the session. | HDX |
| sessionKey | Unique identifier for the session. | uq390c5fc3-86eb-4df3-bd9a-f4a8fed2c9e2 |
| sessionSupport | Session support type. | SingleSession |
| sessionType | The session type | Application |
| ver | Payload version. | 1.3 |
| workerSid | Unique identifier for the VDA used for the session. | S-1-5-21-3711855558-820010554-2448362978-27640 |
| isWindows365 | Denotes if the session is launched for Windows 365 | True |
| entitlementType | Customer’s license entitlement type | Production |
| siteId | Unique identifier for the site | a35647d0-901c-4477-87e0-dcd781d455f4 |
| desktopGroupId | Unique identifier for the Desktop or Delivery Group | e9d859dc-1bfc-4b3e-bad3-41806bb4e694 |
| clientType | Citrix Workspace app type | Windows |
| clientVersion | Citrix Workspace app version | 23.5.1.83 |
| workerCloudType | Public cloud type used for VDA provisioning. | Azure |
| enabledFeatures | Denotes the features that are enabled for the session. For example, in a session where AppProtectionScreenCaptureRequired and SessionRecording are enabled, value of this field is 66. | 66 |
| isEvents | Critical failures in License Server | Unable to create ST Database. |
| heartBeatTime | License server heart beat time to CIS or CAS | 1689058813 |
The following table specifies the numbers assigned to different features under enabledFeatures:
| Feature | enabledFeature number |
|---|---|
| AppProtectionKeyLoggingRequired | 1 |
| AppProtectionScreenCaptureRequired | 2 |
| AnonymousUser | 4 |
| Windows 365 | 8 |
| SaaS | 32 |
| SessionRecording | 64 |
| WEM | 128 |
Citrix Secure Private Access data elements
Admin payload v1.0
Event header
| Field | Description | Example |
|---|---|---|
| ver | Header version. Hardcoded: “ver”: “1.0” | 1.0 |
| id | Unique event Id (GUID) | 1fced2a0-52e7-4c48-bf4e-6f2e06136e11 |
| type
|
Event type name. Hardcoded | admin
|
| “type”: “admin” | ||
| st | UTC formatted timestamp | 2011-08-12T20:17:46.384Z |
| prod
|
Product name. Hardcoded.
“prod”: “AccessSecurity.OnPrem” |
AccessSecurity.OnPrem
|
| prodVer | Product version | 2402 |
| user
|
Unique ID to identify the admin logged in.
|
{
“fullName”: “Username”,”fullName”: “Username”, “samName”: “User’s SAM account name”, “upn”: “User’s UPN name”, “userSid”: “User’s SID” } |
Event payload
| Field | Description | Example |
|---|---|---|
| actualtemplatecode
|
Payload template version.
Hardcoded:”actualtemplatecode”: “1.0” |
1.0
|
| adminLoginType
|
RBAC of admin
|
type: enum
values: fulladmin/readonly/helpdesk |
| clientType | From where admin logged in. Admin console/Director/Public API etc. Others will be sent when no User-Agent is received from client. | AdminConsole/CitrixMonitor/Others |
| tenantName | Tenant name for multitenant deployments (service providers) or site name for single tenant. | SPASite1 |
| enabledFeatures | Denotes the features that are enabled for the session. | 1 |
Config payload v1.0
Event header
| Field | Description | Example |
|---|---|---|
| ver | Header version. Hardcoded: “ver”: “1.0” | 1.0 |
| id | Unique event Id (GUID) | 1fced2a0-52e7-4c48-bf4e-6f2e06136e11 |
| type
|
Event type name. Hardcoded | config
|
| “type”: “config” | ||
| st | UTC formatted timestamp | 2011-08-12T20:17:46.384Z |
| prod
|
Product name. Hardcoded | AccessSecurity.OnPrem
|
| “prod”: “AccessSecurity.OnPrem” | ||
| prodVer | Product version | 2405 |
Event payload
| Field | Description | Example |
|---|---|---|
| actualtemplatecode
|
Payload template version. Hardcoded.
“actualtemplatecode”: “1.0” |
1.0
|
| appsPublished
|
List of internal and external applications published. Includes Web/SaaS and TCP/UDP apps.
|
[
{ “name”:”jira”, “type”: “web”, “internal”: true }, { “name”:”Office 365”, “type”: “saas”, “internal”: false }, { “name”:”eng_printer”, “type”: “tcp”, “internal”: true } ] |
User payload v1.5
Event header
| Field | Description | Example |
|---|---|---|
| ver | Header version. Hardcoded: “ver”: “1.0” | 1.0 |
| id | Unique event Id (GUID) | 1fced2a0-52e7-4c48-bf4e-6f2e06136e11 |
| type
|
Event type name | user
|
| “type”: “user” | ||
| st | UTC formatted timestamp | 2011-08-12T20:17:46.384Z |
| prod
|
Product name. Hardcoded
“prod”: “AccessSecurity.OnPrem” |
AccessSecurity.OnPrem
|
| prodVer | Product version | 2402 |
| user
|
Unique ID to identify a user.
|
{
“fullName”: “Username”, (optional) “samName”: “User’s SAM account name”, “upn”: “User’s UPN name”, “userSid”: “User’s SID” } |
| dvc
|
PII data, if enabled these values must be scrambled.
dvcId - Unique device ID to identify a device from where the application launch was initiated. dvcName - Friendly name for the device. |
{
“dvcId”: “AE18C4D5”, “dvcName”: “User’s PC” } |
Event payload
| Field | Description | Example |
|---|---|---|
| actualtemplatecode
|
Payload template version.
Hardcoded:”actualtemplatecode”: “1.5” |
1.5
|
| transportProtocolType | Connection type: TCP or EDP or 0 (for Web\SaaS) | tcp |
| ngsRecordType | Application type: websaas or tcpudp | websaas |
| tenantName | Tenant name for multitenant deployments (service providers) or site name for single tenant. | SPAOPDEVSite |
| SPAOPDEVSite
|
List of apps which will be accessed by the user for the event.
|
{
“published” : { “internal” : [“issues.citrite.net”], “external” :[“citrixsys.splunk.com”, “www.office365.com”] }, “unpublished” : { “internal” : [], “external” : [“www.okta.com”, “www.cloudcentral.com”] } } |
| clientInfo | This field indicates if the client is Citrix Enterprise Browser, Citrix Secure Access, Citrix Workspace App, RfWeb along with version. | {“name”: “ceb”, “version”: “21.4.0”} |
| platformType | This field displays the agent OS type. | Win/MacOS/iOS/Android |
| enabledFeatures | Denotes the features that are enabled for the session. | 1 |
User payload v1.0
Event header
| Field | Description | Example |
|---|---|---|
| ver | Header version. Hardcoded: “ver”: “1.0” | 1.0 |
| id | Unique event Id (GUID) | 1fced2a0-52e7-4c48-bf4e-6f2e06136e11 |
| type
|
Event type name. Hardcoded
“type”: “PolicyDocument.Download” |
PolicyDocument.Download
|
| st | UTC formatted timestamp | 2011-08-12T20:17:46.384Z |
| prod
|
Product name. Hardcoded. | AccessSecurity.OnPrem
|
| “prod”: “AccessSecurity.OnPrem” | ||
| prodVer | Product version | 2402 |
| $schema
|
Reference to schema, hardcoded |
https://cas.citrix.com/schemas/event.json
|
“$schema”: "https://cas.citrix.com/schemas/event.json"
|
||
| tenant
|
Organization (customer) identification info
“tenant”: { “id”: “” } Secure Private Access plug-in does not track customer ID or the organization ID. It must be empty. |
“tenant”: {
“id”: “” } “user”: { “UPN”: "User UPN name"} |
| user
|
User identification mapping info, UPN only.
“UPN”: <username (optionally encoded)> Encoded if scrambling enabled (see Event Payload enabledFeatures). |
|
Event payload
| Field | Description | Example |
|---|---|---|
| actualtemplatecode
|
Payload template version.
Hardcoded:”actualtemplatecode”: “1.0” |
1.0
|
| ngsUsername
|
Username in UPN format (clear text/encoded).
Encoded if scrambling enabled (see Event Payload enabledFeatures) |
User UPN name
Encoded UPN name
|
| ngsProductName
|
Product name. Hardcoded. | AccessSecurity.OnPrem
|
| “ngsProductName”: “AccessSecurity.OnPrem” | ||
| transportProtocolType | Connection type: TCP or UDP or 0 (for Web\SaaS) | tcp |
| ngsRecordType | Application type: websaas or tcpudp | websaas |
| tenantName | Tenant name for multitenant deployments (service providers) or site name for single tenant. | SPAOPDEVSite |
| enabledFeatures | Denotes the features that are enabled for the session. Currently not used. | 1 |
Citrix Licensing Telemetry data elements
Copied!
Failed!