uberAgent

Citrix NetScaler (ADC) Metrics

Citrix NetScaler (ADC) monitoring requires its metrics to be enabled on at least one machine. See the documentation for details.

Appliance Inventory

uberAgent collects metrics like MAC address, model, and version for the primary as well as the secondary appliance.

Details

  • Source type: uberAgent:CitrixADC:ApplianceInventory
  • Used in dashboards: CitrixADC Inventory, Single CitrixADC Inventory
  • Enabled through configuration setting: CitrixADCInventory
  • Related configuration settings: [CitrixADC_Config]
  • Supported platform: Windows

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
HostName Appliance name. String   CitrixADC1
Version Firmware version. String   NS12.0: Build 59.8.nc Date: Sep 12 2018 06:16:17
License Installed license. String   Platinum
Model Appliance model. Number   1000
LicensingMode Configured licensing mode. Possible values: Local, Pooled, CICO. String   Local
HwDescription Hardware and its ports detail. String   NetScaler Virtual Appliance.
SysId System id. String   450088
ManufactureDay Day the appliance was manufactured. Number   17
ManufactureMonth Month the appliance was manufactured. Number   2
ManufactureYear Year the appliance was manufactured. Number   2009
CpuFrequncy CPU frequency. Number   3890
SerialNo Serial number. Number   ABCDEFG12
EncodedSerialno Encoded serial number. String   68310055cb267307ffg8
MACAddress MAC address. String   00155d3d890d
HostId Host id. String   123456789
LastConfigSaveTime Time when the configuration was last saved. String   2018-12-07 12:06:36
Timezone Timezone. String   GMT+01:00-CET-Europe/Berlin
WeakPassword List of all weak passwords. String   password
SystemType System type. Possible Values: Standalone, HA, Cluster. String   HA
LastConfigChangedTime Time when the configuration was last changed. String   2018-12-07 12:06:21
LastStartupTime Time when the appliance was last started. String   2018-11-24 15:26:25
CurrentHAStatus Indicates the high availability state of the node. Possible values: Staysecondary, Primary, Secondary, Claiming, Force change. String   Primary
LastHAStatusChange Time when the last master state transition occurred. String   2018-12-04 10:34:51
SSLCards2 Number of available SSL cards. Number   0
SSLCardsUp2 Number of working SSL cards. Number   0

List of Calculated Fields

Field Description Data type Unit Example Where available
SSLCards Number of available SSL cards. Number   0 Splunk data model
SSLCardsUp Number of working SSL cards. Number   0 Splunk data model

Appliance Performance

uberAgent collects metrics like CPU usage, RAM usage as well as network throughput for the primary appliance.

Details

  • Source type: uberAgent:CitrixADC:AppliancePerformance
  • Used in dashboards: CitrixADC Appliance Performance
  • Enabled through configuration setting: CitrixADCPerformance
  • Related configuration settings: [CitrixADC_Config]
  • Supported platform: Windows

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
HostName Appliance name. String   CitrixADC1
MemUsagePcnt Memory usage. Number % 17.62
MgmtCpuUsagePcnt Management CPU usage. Number % 14.6
PktCpuUsagePcnt Packet CPU usage. Number % 3
Disk0PerUsage /flash disk usage. Number % 41
Disk0Size /flash disk size. Number MB 1585
Disk0Used /flash disk allocated space. Number MB 598
Disk0Avail /flash disk free space. Number MB 860
Disk1PerUsage /var disk usage. Number % 45
Disk1Size /var disk size. Number MB 14179
Disk1Used /var disk allocated space. Number MB 5988
Disk1Avail /var disk free space. Number MB 7056
ApplianceBytesReceived Amount of incoming network data. Number Bytes 608359
ApplianceBytesSent Amount of outgoing network data. Number Bytes 616856
NumCpus2 Number of CPUs. Number   3
MemSizeMB2 Memory size. Number MB 8096
MemUseInMB2 Memory usage. Number MB 196
CpuFan0Speed CPU fan 0 speed. Acceptable range is 3000 through 6000 RPM. Number   5000
CpuFan1Speed CPU fan 1 speed. Acceptable range is 3000 through 6000 RPM. Number   5000
SystemFanSpeed System fan speed. Acceptable range is 3000 through 6000 RPM. Number   5000
Cpu0Temp CPU 0 temperature. Number   80
Cpu1Temp CPU 1 temperature. Number   80
InternalTemp Internal temperature of health monitoring chip. Number   80
PowerSupply1Status Power supply 1 failure status. Can be 0, 1, 2, 3, or 4. See also PowerSupply1StatusDisplayName. Number   1
PowerSupply2Status Power supply 2 failure status. Can be 0, 1, 2, 3, or 4. See also PowerSupply2StatusDisplayName. Number   1
PowerSupply3Status Power supply 3 failure status. Can be 0, 1, 2, 3, or 4. See also PowerSupply3StatusDisplayName. Number   1
PowerSupply4Status Power supply 4 failure status. Can be 0, 1, 2, 3, or 4. See also PowerSupply4StatusDisplayName. Number   1
VoltageV33Main Main power supply +3.3V output. Acceptable range is 2.970 through 3.630 volts. Number   3.630
ICAOnlySessions Number of ICA sessions. Number   45
ICAOnlyConnections Number of ICA connections. Number   45
SmartAccessSessions Number of VPN sessions. Number   45
SmartAccessICAConnections Number of VPN ICA connections. Number   45
SSLSessions Number of SSL sessions. Number   400

List of Calculated Fields

Field Description Data type Unit Example Where available
ApplianceMBReceived Amount of incoming network data.
The field is deprecated and will be removed in a future release. Use ApplianceMbpsReceived instead.
Number MB 594.100 Splunk data model
ApplianceMBSent Amount of outgoing network data.
The field is deprecated and will be removed in a future release. Use ApplianceMbpsSent instead.
Number MB 602.39 Splunk data model
ApplianceMbpsSent Amount of outgoing network data. Number Mbps 602.39 Splunk data model
NumCpus Number of CPUs. Number   3 Splunk data model
MemSizeMB Memory size. Number MB 8096 Splunk data model
MemUseInMB Memory usage. Number MB 196 Splunk data model
PowerSupply1StatusDisplayName Power supply 1 failure status. Can be Unknown, Normal, Failed, Not present, or Not supported. Based on the lookup file citrixadc_powersupplystatus.csv. Number   Normal Splunk data model, Splunk SPL
PowerSupply2StatusDisplayName Power supply 2 failure status. Can be Unknown, Normal, Failed, Not present, or Not supported. Based on the lookup file citrixadc_powersupplystatus.csv. Number   Normal Splunk data model, Splunk SPL
PowerSupply3StatusDisplayName Power supply 3 failure status. Can be Unknown, Normal, Failed, Not present, or Not supported. Based on the lookup file citrixadc_powersupplystatus.csv. Number   Normal Splunk data model, Splunk SPL
PowerSupply4StatusDisplayName Power supply 4 failure status. Can be Unknown, Normal, Failed, Not present, or Not supported. Based on the lookup file citrixadc_powersupplystatus.csv. Number   Normal Splunk data model, Splunk SPL

Certificates

uberAgent collects certificate metrics like name, type, and expiration date for the primary as well as the secondary appliance.

Details

  • Source type: uberAgent:CitrixADC:Certificate
  • Used in dashboards: Single CitrixADC Inventory
  • Enabled through configuration setting: CitrixADCInventory
  • Related configuration settings: [CitrixADC_Config]
  • Supported platform: Windows

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
HostName Appliance name. String   CitrixADC1
CertName Certificate name. String   nsmgmtcer
CertFile Certificate file. String   nsmgmt.cer
CertType Certificate type. Possible values: Client, Server, Client;Server,Root, Intermediate. String   Client;Server
CertExpirationDate Certificate expiration date. String   2020-11-22 11:06:46

Gateways

uberAgent collects gateway metrics like network throughput and SSL as well as authentication policies for the primary appliance.

Details

  • Source type: uberAgent:CitrixADC:Gateway
  • Used in dashboards: Citrix ADC Gateway Performance,Single CitrixADC Inventory
  • Enabled through configuration setting: CitrixADCGateway
  • Related configuration settings: [CitrixADC_Config]
  • Supported platform: Windows

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
HostName Appliance name. String   CitrixADC1
vServerName Gateway name. String   _XD_10.1.1.22_443
PrimaryIpAddress IP address. IPv4   10.1.1.22
PrimaryPort Port. Number   443
Type vServer type. Possible values: SSL. String   SSL
State vServer state. String   Up
RequestBytesRate Incoming network traffic. Number Bytes 1024
ResponseBytesRate Outgoing network traffic. Number Bytes 1024
AuthLDAPPolicies Bound LDAP authentication policies. String   pol_ldap1;pol_ldap2
AuthRadiusPolicies Bound Radius authentication policies. String   pol_radius1;pol_radius2
AuthSAMLPolicies Bound SAML authentication policies. String   pol_saml1
SessionPolicies Bound session policies. String   sp_storefront
STAs Secure ticket authorities. String   http://DDC.vastlimits.com
ResponderPolicies Bound responder policies. String   rp_storefront
RewritePolicies Bound rewrite policies. String   rw_clientname
Certificates Bound certificates. String   wildcard.vastlimits.com
PortalTheme Bound portal theme. String   Default
SSL2* Indicates if SSL2 is enabled. String   0
SSL3* Indicates if SSL3 is enabled. String   0
TLS1* Indicates if TLS1 is enabled. String   0
TLS11* Indicates if TLS1.1 is enabled. String   0
TLS12* Indicates if TLS1.2 is enabled. String   1
DiffeHellman* Indicates if Diffie-Hellman is enabled. String   1
SSLProfile Name of the bound SSL profile. String   ns_default_ssl_profile_frontend
Ciphers* Bound ciphers. String   DEFAULT
CipherSuites* Bound cipher suites. String   DEFAULT
TotalRequests2 Total number of requests received. Number   456789
TotalResponses2 Total number of responses. Number   456789
SessionTimeout2* Session timeout. Number   120
HSTS State of HSTS protocol support for the SSL Virtual Server. Using HSTS, a server can enforce the use of an HTTPS connection for all communication with a client. Can be Enabled or Disabled. String   Disabled
HSTSMaxAge The maximum time, in seconds, in the strict transport security (STS) header during which the client must send only HTTPS requests to the server. Number   0
HSTSInclSubdom Indicates if HSTS for subdomains is enabled or disabled. If set enabled, a client must send only HTTPS requests for subdomains. Can be Yes or No. String   No
TLS13 Indicates if TLS1.3 is enabled. String   Enabled

* If an SSL profile is bound, then these settings are taken from it.

List of Calculated Fields

Field Description Data type Unit Example Where available
RequestResponseBytesRate RequestBytesRate + ResponseBytesRate. Number Bytes 2048 Splunk data model
RequestResponseRateMB RequestResponseBytesRate / 1024
The field is deprecated and will be removed in a future release. Use RequestResponseRateMbps instead.
Number MB 2 Splunk data model
RequestResponseRateMbps round(RequestResponseBytesRate/125000,1) Number Mbps 2 Splunk data model
TotalRequests2 Total number of requests received. Number   456789 Splunk data model
TotalResponses2 Total number of responses. Number   456789 Splunk data model
SessionTimeout2* Session timeout. Number   120 Splunk data model

Ips

uberAgent collects Ip metrics like address, type, and if it is used for management access for the primary as well as the secondary appliance.

Details

  • Source type: uberAgent:CitrixADC:Ip
  • Used in dashboards: Single CitrixADC Inventory
  • Enabled through configuration setting: CitrixADCInventory
  • Related configuration settings: [CitrixADC_Config]
  • Supported platform: Windows

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
HostName Appliance name. String   CitrixADC1
IpAddress IP address. IPv4   10.1.1.25
IpNetmask IP netmask. String   255.255.0.0
IpType IP type. Possible values: SNIP, VIP, NSIP, GSLBsiteIP, CLIP, LSN. String   VIP
IpvServer Indicates if the IP is bound to a vServer. String   Yes
IpMgmtAccess Indicates if management access is allowed. String   0

Services

uberAgent collects service metrics like protocol, state as well as bound monitors for the primary appliance.

Details

  • Source type: uberAgent:CitrixADC:Service
  • Used in dashboards: Single Virtual Server Performance
  • Enabled through configuration setting: CitrixADCvServer
  • Related configuration settings: [CitrixADC_Config]
  • Supported platform: Windows

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
HostName Appliance name. String   CitrixADC1
ServiceName Service name. String   webserver1
Protocol Service protocol. Possible values: HTTP, FTP, TCP, UDP, SSL, SSL_BRIDGE, SSL_TCP, DTLS, NNTP, DNS, DHCPRA, ANY, SIP_UDP, SIP_TCP, SIP_SSL, DNS_TCP, RTSP, PUSH, SSL_PUSH, RADIUS, RDP, MYSQL, MSSQL, DIAMETER, SSL_DIAMETER, TFTP, ORACLE, SMPP, SYSLOGTCP, SYSLOGUDP, FIX, SSL_FIX, USER_TCP, USER_SSL_TCP. String   HTTP
PrimaryIpAddress IP address. IPv4   10.1.1.11
PrimaryPort Port. Number   80
State Service state. Possible values: UP, DOWN, UNKNOWN, OFS (Out of Service), TROFS (Transition Out of Service), TROFS_DOWN (Down when going Out of Service). String   Up
vServerName Name of the vServer the service is bound to. String   lbvs_CompanyWebserver
ServiceMonitors Bound service monitors. String   tcp-default

List of Calculated Fields

Field Description Data type Unit Example Where available
ServiceMonitorsSplit ServiceMonitors split by semicolon. Number MB   Splunk data model

Service Groups

uberAgent collects service group metrics like protocol, state as well as bound monitors for the primary appliance.

Details

  • Source type: uberAgent:CitrixADC:ServiceGroup
  • Used in dashboards: Single Virtual Server Performance
  • Enabled through configuration setting: CitrixADCvServer
  • Related configuration settings: [CitrixADC_Config]
  • Supported platform: Windows

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
HostName Appliance name. String   CitrixADC1
ServiceGroupName Service group name. String   sgr1
Protocol Service group protocol: ADNS, DNS, MYSQL, RTSP, SSL_DIAMETER, ADNS_TCP, DNS_TCP, NNTP, SIP_UDP, SSL_TCP, ANY, FTP, RADIUS, SNMP, TCP, DHCPRA, HTTP, RDP, SSL, TFTP, DIAMETER, MSSQL, RPCSVR, SSL_BRIDGE, UDP. String   HTTP
State Service group state. Possible values: UP, DOWN, UNKNOWN, OFS (Out of Service), TROFS (Transition Out of Service), TROFS_DOWN (Down when going Out of Service). String   Up
EffectiveState Indicates the effective servicegroup state based on the state of the bound service items. Possible values: UP, DOWN, OUT OF SERVICE, PARTIAL-UP, PARTIAL-DOWN. String   Up
vServerName Name of the vServer the service group is bound to. String   lbvs_Storefront
ServiceGroupMembers Services which are members of the service group. String   Service1;Service2
ServiceGroupMonitors Bound service group monitors. String   ping;tcp

List of Calculated Fields

Field Description Data type Unit Example Where available
ServiceGroupMembersSplit ServiceGroupMembers split by semicolon. Number MB Service1 Service2 Splunk data model
ServiceGroupMonitorsSplit ServiceGroupMonitors split by semicolon. Number MB ping tcp Splunk data model

Virtual Server

uberAgent collects virtual server (load-balancing virtual server only) metrics like network throughput and bound policies for the primary appliance.

Details

  • Source type: uberAgent:CitrixADC:vServer
  • Used in dashboards: Citrix ADC Virtual Server Performance, Single Virtual Server Performance,Single CitrixADC Inventory
  • Enabled through configuration setting: CitrixADCGateway
  • Related configuration settings: [CitrixADC_Config]
  • Supported platform: Windows

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
HostName Appliance name. String   CitrixADC1
vServerName Virtual server name. String   vs_Storefront
PrimaryIpAddress IP address. IPv4   10.1.1.5
PrimaryPort Port. Number   443
Type vServer type. Possible values: HTTP, FTP, TCP, UDP, SSL, SSL_BRIDGE, SSL_TCP, DTLS, NNTP, DNS, DHCPRA, ANY, SIP_UDP, SIP_TCP, SIP_SSL, DNS_TCP, RTSP, PUSH, SSL_PUSH, RADIUS, RDP, MYSQL, MSSQL, DIAMETER, SSL_DIAMETER, TFTP, ORACLE, SMPP, SYSLOGTCP, SYSLOGUDP, FIX, SSL_FIX, USER_TCP, USER_SSL_TCP. String   SSL
State vServer state. String   Up
RequestBytesRate Incoming network traffic. Number Bytes 1024
ResponseBytesRate Outgoing network traffic. Number Bytes 1024
RewritePolicies Bound rewrite policies. String   rw_clientname
ResponderPolicies Bound responder policies. String   rp_storefront
Certificates Bound certificates. String   Cert1;Cert2
SSL2* Indicates if SSL2 is enabled. String   0
SSL3* Indicates if SSL3 is enabled. String   0
TLS1* Indicates if TLS1 is enabled. String   0
TLS11* Indicates if TLS1.1 is enabled. String   0
TLS12* Indicates if TLS1.2 is enabled. String   1
DiffeHellman* Indicates if Diffie-Hellman is enabled. String   1
SSLProfile Name of the bound SSL profile. String   vastlimits_ssl_profile
Ciphers* Bound ciphers. String   Secure_Cipher_Group
CipherSuites* Bound cipher suites. String   DEFAULT
ActSvcs2 Active services. Number   2
TotHits2 Total Hits. Number   456789
TotalRequests2 Total number of requests received. Number   31888
TotalResponses2 Total number of responses. Number   31888
VSLBHealth2 The health of the vserver. This gives the percentage of UP services bound to this vserver. Number % 100
SessionTimeout2* Session timeout. Number   120
HSTS State of HSTS protocol support for the SSL Virtual Server. Using HSTS, a server can enforce the use of an HTTPS connection for all communication with a client. Can be Enabled or Disabled. String   Disabled
HSTSMaxAge The maximum time, in seconds, in the strict transport security (STS) header during which the client must send only HTTPS requests to the server. Number   0
HSTSInclSubdom Indicates if HSTS for subdomains is enabled or disabled. If set enabled, a client must send only HTTPS requests for subdomains. Can be Yes or No. String   No
TLS13 Indicates if TLS1.3 is enabled. String   Enabled

* If an SSL profile is bound, then these settings are taken from it.

List of Calculated Fields

| Field | Description | Data type | Unit | Example | Where available | | ————— | ——————————————————————————————————————————————- | ——— | —- | ——- | —————– | | RequestMBRate | Incoming network traffic.
**The field is deprecated and will be removed in a future release. Use** RequestMbpsRate **instead**. | Number | MB | 1 | Splunk data model | | ResponseMBRate | Outgoing network traffic.
**The field is deprecated and will be removed in a future release. Use** ResponseMbpsRate **instead**. | Number | MB | 1 | Splunk data model | | RequestMbpsRate | Incoming network traffic. | Number | Mbps | 1 | Splunk data model | | ResponseMBRate | Outgoing network traffic. | Number | Mbps | 1 | Splunk data model | | ActSvcs | Active services. | Number | | 2 | Splunk data model | | TotHits | Total Hits. | Number | | 456789 | Splunk data model | | TotalRequests | Total number of requests received. | Number | | 31888 | Splunk data model | | TotalResponses | Total number of responses. | Number | | 31888 | Splunk data model | | VSLBHealth | The health of the vserver. This gives the percentage of UP services bound to this vserver. | Number | % | 100 | Splunk data model | | SessionTimeout | Session timeout. | Number | | 120 | Splunk data model | ```

Citrix NetScaler (ADC) Metrics