Citrix Licensing Telemetry data elements

License Server data elements

Metadata fields

Field Description Example
ClientTool This field isn’t in use. Not applicable
UploadUser This field isn’t in use. Not applicable
UTCDate Report generation time in UTC format. 2022-10-10T06:11:14Z
Date Report generation time in local time format. 10/10/2022 02:11:14
Product Name of the upload. LicenseServerCompliance
ProductVersion This is the version of the upload. 2.0
ProductUTCDeployDate Denotes the time when the License Server is installed. 2022-08-16T00:00:00Z
SiteID This field isn’t in use. Not applicable
SiteName This field isn’t in use. Not applicable
Component This field isn’t in use. Not applicable
UI This field ensures the integrity of the uploaded file. 8826d6ac8e1c8e68e471ae90c2bacbe1854f8281a6f5ae40cc7b74114e026abc

License Server and License Usage information

Field name Description Example value
License Server information    
GUID A unique identifier created during install and preserved during upgrades. This field is used to identify which uploads are from the same server. a5ae17c9-8a4a-4318-938f-a8c6da2aa2ef
HardwareId This field is a unique identifier for the License Server instance. E824249098A96BF0
FQDN License Server machine and domain name. This value is sent to help identify License Servers in the reporting experience. Used to pair a License Server calling home to a license allocation record in the back office. CITRIX-12T5MRV4
InstallUTC This value denotes the time when the License Server is installed. 2016-10-12T00:00:00Z
ProductVersion Identifies the License Server version. 11.16.6.0. build 35000
SGPClockErrorCode Error code indicating why the License Server entered the License burst mode. 0
SGPMaxDays Maximum days remaining in the License burst mode. 15
     
Inventory
Feature
ID This value represents the product code license usage is associated with CAG_AAC_CCU
UDBinFileCreatedUTC Timestamp of when the file used to track user or device licenses was created. 2016-11-09T00:55:56Z
UDReportGenerationUTC Timestamp of when the user or device report was generated. 2016-11-09T00:55:56Z
UDAdminUsersReleased Count of users released by udadmin. 3
UDAdminDevicesReleased Count of devices released by udadmin. 3
SADate This field is used to build a view of license usage over time. For examples, see SADate in the following section.
SADate    
id Captures the SA Date through the ID attribute of the SADate element. 2022.1231
DateSampleStartUTC Start time of the sample being collected. 2016-11-08T01:08:13Z
DateSampleStopUTC End time of the sample being collected. 2016-11-09T00:55:56Z
CountUsedMax This value represents the maximum number of licenses used by this customer. 6
CCUDevices Lists the device IDs that use the Citrix concurrent licenses. This helps in getting the license usage over time.
Active If the value is ‘1’, it’s in the current inventory. If the value is ‘0’, it appears only in historical records and is no longer part of the current inventory either because it is removed or expired. 1
Licensees The Licensees field has three sub fields namely CountTotal, Users, and Devices. For examples, see Licensees in the following section.
CountInstalled The number of licenses installed. 1203
Pool   For examples, see Pool in the following section.
CCUDevices
DevId Specifies the unique concurrent device identifier. This is applicable only for concurrent licenses. C39A925064A3
Licensees
CountTotal Total number of licenses in use at the time the sample was taken. Total number is the sum of users and devices. 3
Users Specific users where a user license is assigned, contributing to the total count. This is applicable only for user/device licenses. For examples, see Users in the following section.
Devices Specific devices where a device license is assigned contributing to the total count. This is applicable only for user/device licenses. For examples, see Devices in the following section.
Users
timeLastLogin Last login time event from a user. 2022-07-12T10:00:00
ID Specific users where a user license is assigned, contributing to the total count. user@domain.com or user
Devices
timeLastLogin Last login time event from this device. 2022-07-12T10:00:00
DevId Specifies the unique device identifier where a device license is assigned, contributing to the total count. C39A925064A3
Name Friendly name for the device. User1Desktop
Pool
Serial This information allows Citrix to identify who the product is entitled to. OR10:13
DateExpiration Most recent expiration date that impacts the license count in the pool. 12/1/2020.
DateIssued The date that the license file was issued. The date issued of the license file that expires first. 1-Dec-03
VendorStr Representation of licensing information that informs products of what edition and mode that they must operate in. <![CDATA[;LT=Retail;GP=2;PSL=10;CL=ENT,ADV,STD,AST;SA=1;ODP=0]]>.
CountInstalled Number of licenses installed among the pools for a given feature. 100
CountOverdraft Number of licenses used above the installed quantity. 0
UsageSamples For examples, see Sample in the following section.
DateStart Date from which licenses are valid on. 31-Dec-2014
Sample
Timestamp Timestamp of the sample collection. 2016-11-09T00:55:56Z
CountInUse Number of licenses in use at the specific time stamp. 3
OverDraft Number of licenses used above the installed quantity. 0
Installed Number of licenses installed at the specific time stamp. 100
     
StartupCounts data elements
LPE Product, Edition, and version information for each server communicating with the License Server. Example from left - Apps and Desktops Premium - 2012. <ID><![CDATA[XDT_PLT_2020.1201]]></ID>
Count Total number of LPEs connected to the License Server. 2
     
SupplementalGracePeriod    
ID This field represents the product code following the License burst mode detail is associated with. XDT_ENT_UD
SADate This field represents the CSS date for which the License burst mode was triggered. 2019.1201
SGPErrorCode Error code for which License burst mode was triggered. -4
LicCount License count for which License burst mode for triggered. 100
DateTriggerUTC UTC date on which License burst mode was triggered for ID and SADate. 2022-07-19T14:35:59Z
DateTriggerLocal Local date on which License burst mode was triggered for ID and SADate. 2022-07-19T10:35:59

Citrix Virtual Apps and Desktops data elements

Metadata fields

Field Description Example
ClientTool This field isn’t in use. Not applicable
UploadUser This field isn’t in use. Not applicable
UTCDate Report generation time in UTC format. 2022-06-30T15:31:34Z
Date Indicates the upload bundle creation date. 06/30/2022 11:31:34
Product Identifies the upload bundle LicenseServer.OnPremUsage
ProductVersion Manifest schema version. 1.0
ProductDeployUTCDate Denotes the time when the License Server is installed. 2022-03-21T00:00:00Z
GUID A unique identifier created during install and preserved during upgrades. This field is used to identify which uploads are from the same server. a5ae17c9-8a4a-4318-938f-a8c6da2aa2ef
UploadType Indicates if the license upload is manual or automatic. Auto
Ccid Indicates the Citrix Cloud Customer ID; only available with registered License Server. xaxddaily1
OrgID Indicates the Org ID, the installed licenses are tied to; only available with registered License Server. 23456123
TotalFiles Total number of files in the upload bundle. 6
SerialNumbers → Serial → ID Represents the product code associated with the installed license. XDS_ADV_CCS
SerialNumbers → Serial → SADate Represents the CSS date associated with the installed license. 2023.1201
SerialNumbers → Serial → SN This information allows us to identify who the product is entitled to. eval1
File → Name Name of the uploaded file. ue_lt_1683864965.zip
File → UI Hash to indicate the integrity of the file. 4d14a58f98b1ae2e9d965b2980b67853cfcac7c76e655952bd056ad6dc7a80ae
File → EventStartTS Indicates the bundle data start time. 1697417241680
File → EventEndTS Indicates the bundle data end time. 1697430741834
File → OfferingType → Name Indicates the product. Broker
FilesUI Hash to indicate integrity of the bundle 4d14a58f98b1ae2e9d965b2980b67853cfcac7c76e655952bd056ad6dc7a80ff
ManifestUI Hash to indicate integrity of the manifest. 4d14a58f98b1ae2e9d965b2980b67853cfcac7c76e655952bd056ad6dc7a8345

Headers

Field Description Example
ver Version of the license usage event. 1.0
id Unique identifier of the usage event. d4ce7919-5d80-44de-a8fa-102923fe0ead
type Event type used by CAS to identify cloud usage events. Cloud.Licensing
st Timestamp when the event is generated in Broker. 2011-08-12T20:17:46.384Z
prod Originating product and deployment of the usage event. XenDesktop.Broker
prodVer DaaS or Citrix Virtual Apps and Desktops product version 7.25.0.0
user Specifies the unique User ID used to identify the user initiating the session launch. fullName: User-Steven
    samName: CTXLAB\User-Steven
    upn:User-Steven@ctxlabs.onmicrosoft.com
    userLicenseId: User-Steven@CTXLABS04
    userSid: S-1-5-21-3711855558-820010554-2448362978-22222
tenant -> id Customer ID of the Citrix Cloud account. For on-premises environments the value is always “CitrixOnPremises”. joj1mh0598tj
dvc -> dvcId Specifies the unique device ID used to identify a device from where the session launch is initiated. AE18C4D5
dvc -> dvcName Friendly name for the device. Steven’s PC

Payload

Field Description Example
appProtectionKeyLoggingRequired Denotes if the session is launched with Key Logging Protection enabled. False
appProtectionScreenCaptureRequired Denotes if the session is launched with Screen Capture Protection enabled. False
cspTenantCustomerId Customer ID of a CSP’s tenant’s Citrix Cloud account. This field is left empty if the customer ID is not available, for example, in on-premises deployments. 6c2vtxgxyftt
isAnonymousUser Denotes if an unauthenticated session is launched. False
licenseActivityTimeStamp Timestamp when the payload is generated. 2011-08-12T20:17:46.384Z
licenseActivityType Licensing event type. This field indicates if the licensing event type is for assignment or release action. Connect
licenseModel License model of the deployment. UserDevice
productEdition Product edition of the deployment. Premium or Advanced
productId Product ID of the product in the deployment. CAVDS
protocol The protocol used to launch the session. HDX
sessionKey Unique identifier for the session. uq390c5fc3-86eb-4df3-bd9a-f4a8fed2c9e2
sessionSupport Session support type. SingleSession
sessionType The session type Application
ver Payload version. 1.3
workerSid Unique identifier for the VDA used for the session. S-1-5-21-3711855558-820010554-2448362978-27640
isWindows365 Denotes if the session is launched for Windows 365 True
entitlementType Customer’s license entitlement type Production
siteId Unique identifier for the site a35647d0-901c-4477-87e0-dcd781d455f4
desktopGroupId Unique identifier for the Desktop or Delivery Group e9d859dc-1bfc-4b3e-bad3-41806bb4e694
clientType Citrix Workspace app type Windows
clientVersion Citrix Workspace app version 23.5.1.83
workerCloudType Public cloud type used for VDA provisioning. Azure
enabledFeatures Denotes the features that are enabled for the session. For example, in a session where AppProtectionScreenCaptureRequired and SessionRecording are enabled, value of this field is 66. 66
isEvents Critical failures in License Server Unable to create ST Database.
heartBeatTime License server heart beat time to CIS or CAS 1689058813

The following table specifies the numbers assigned to different features under enabledFeatures:

Feature enabledFeature number
AppProtectionKeyLoggingRequired 1
AppProtectionScreenCaptureRequired 2
AnonymousUser 4
Windows 365 8
SaaS 32
SessionRecording 64
WEM 128

Citrix Secure Private Access data elements

Admin payload v1.0

Event header

Field Description Example
ver Header version. Hardcoded: “ver”: “1.0” 1.0
id Unique event Id (GUID) 1fced2a0-52e7-4c48-bf4e-6f2e06136e11
type
Event type name. Hardcoded admin
“type”: “admin”
st UTC formatted timestamp 2011-08-12T20:17:46.384Z
prod
Product name. Hardcoded.
“prod”: “AccessSecurity.OnPrem”
AccessSecurity.OnPrem
prodVer Product version 2402
user




Unique ID to identify the admin logged in.




{
“fullName”: “Username”,”fullName”: “Username”,
“samName”: “User’s SAM account name”,
“upn”: “User’s UPN name”,
“userSid”: “User’s SID”
}

Event payload

Field Description Example
actualtemplatecode
Payload template version.
Hardcoded:”actualtemplatecode”: “1.0”
1.0
adminLoginType
RBAC of admin
type: enum
values: fulladmin/readonly/helpdesk
clientType From where admin logged in. Admin console/Director/Public API etc. Others will be sent when no User-Agent is received from client. AdminConsole/CitrixMonitor/Others
tenantName Tenant name for multitenant deployments (service providers) or site name for single tenant. SPASite1
enabledFeatures Denotes the features that are enabled for the session. 1

Config payload v1.0

Event header

Field Description Example
ver Header version. Hardcoded: “ver”: “1.0” 1.0
id Unique event Id (GUID) 1fced2a0-52e7-4c48-bf4e-6f2e06136e11
type
Event type name. Hardcoded config
“type”: “config”
st UTC formatted timestamp 2011-08-12T20:17:46.384Z
prod
Product name. Hardcoded AccessSecurity.OnPrem
“prod”: “AccessSecurity.OnPrem”
prodVer Product version 2405

Event payload

Field Description Example
actualtemplatecode
Payload template version. Hardcoded.
“actualtemplatecode”: “1.0”
1.0
appsPublished















List of internal and external applications published. Includes Web/SaaS and TCP/UDP apps.















[
{
“name”:”jira”,
“type”: “web”,
“internal”: true
},
{
“name”:”Office 365”,
“type”: “saas”,
“internal”: false
},
{
“name”:”eng_printer”,
“type”: “tcp”,
“internal”: true
}
]

User payload v1.5

Event header

Field Description Example
ver Header version. Hardcoded: “ver”: “1.0” 1.0
id Unique event Id (GUID) 1fced2a0-52e7-4c48-bf4e-6f2e06136e11
type
Event type name user
“type”: “user”
st UTC formatted timestamp 2011-08-12T20:17:46.384Z
prod
Product name. Hardcoded
“prod”: “AccessSecurity.OnPrem”
AccessSecurity.OnPrem
prodVer Product version 2402
user




Unique ID to identify a user.




{
“fullName”: “Username”, (optional)
“samName”: “User’s SAM account name”,
“upn”: “User’s UPN name”,
“userSid”: “User’s SID”
}
dvc


PII data, if enabled these values must be scrambled.
dvcId - Unique device ID to identify a device from where the application launch was initiated.
dvcName - Friendly name for the device.
{
“dvcId”: “AE18C4D5”,
“dvcName”: “User’s PC”
}

Event payload

Field Description Example
actualtemplatecode
Payload template version.
Hardcoded:”actualtemplatecode”: “1.5”
1.5
transportProtocolType Connection type: TCP or EDP or 0 (for Web\SaaS) tcp
ngsRecordType Application type: websaas or tcpudp websaas
tenantName Tenant name for multitenant deployments (service providers) or site name for single tenant. SPAOPDEVSite
SPAOPDEVSite








List of apps which will be accessed by the user for the event.








{
“published” : {
“internal” : [“issues.citrite.net”],
“external” :[“citrixsys.splunk.com”, “www.office365.com”]
},
“unpublished” : {
“internal” : [],
“external” : [“www.okta.com”, “www.cloudcentral.com”]
}
}
clientInfo This field indicates if the client is Citrix Enterprise Browser, Citrix Secure Access, Citrix Workspace App, RfWeb along with version. {“name”: “ceb”, “version”: “21.4.0”}
platformType This field displays the agent OS type. Win/MacOS/iOS/Android
enabledFeatures Denotes the features that are enabled for the session. 1

User payload v1.0

Event header

Field Description Example
ver Header version. Hardcoded: “ver”: “1.0” 1.0
id Unique event Id (GUID) 1fced2a0-52e7-4c48-bf4e-6f2e06136e11
type
Event type name. Hardcoded
“type”: “PolicyDocument.Download”
PolicyDocument.Download
st UTC formatted timestamp 2011-08-12T20:17:46.384Z
prod
Product name. Hardcoded. AccessSecurity.OnPrem
“prod”: “AccessSecurity.OnPrem”
prodVer Product version 2402
$schema
Reference to schema, hardcoded https://cas.citrix.com/schemas/event.json
“$schema”: "https://cas.citrix.com/schemas/event.json"
tenant



Organization (customer) identification info
“tenant”: {
“id”: “”
}
Secure Private Access plug-in does not track customer ID or the organization ID. It must be empty.
“tenant”: {
“id”: “”
}


“user”: {
“UPN”: "User UPN name"
}
user


User identification mapping info, UPN only.
“UPN”: <username (optionally encoded)>
Encoded if scrambling enabled (see Event Payload enabledFeatures).

Event payload

Field Description Example
actualtemplatecode
Payload template version.
Hardcoded:”actualtemplatecode”: “1.0”
1.0
ngsUsername
Username in UPN format (clear text/encoded).
Encoded if scrambling enabled (see Event Payload enabledFeatures)
User UPN name
Encoded UPN name
ngsProductName
Product name. Hardcoded. AccessSecurity.OnPrem
“ngsProductName”: “AccessSecurity.OnPrem”
transportProtocolType Connection type: TCP or UDP or 0 (for Web\SaaS) tcp
ngsRecordType Application type: websaas or tcpudp websaas
tenantName Tenant name for multitenant deployments (service providers) or site name for single tenant. SPAOPDEVSite
enabledFeatures Denotes the features that are enabled for the session. Currently not used. 1
Citrix Licensing Telemetry data elements