uberAgent

Session Metrics

Session Detail

uberAgent collects metrics like the session ID, connection state, protocol latency, and foreground application per user session.

Details

  • Source type: uberAgent:Session:SessionDetail
  • Used in dashboards: Application Usage, Machine Uptime, SBC Sizing and Capacity Planning, Session 0, Session Info: Citrix, Session Info: VMware, User Session Overview, User Sessions, Single Application Performance, Single Machine Performance, Single User Performance, Analyze data over time
  • Enabled through configuration setting: SessionDetail
  • Related configuration settings: n/a

List of Fields in the Raw Agent Data

Field Description Data type Unit Example Platform
SessionID Session ID generated by the OS. Session IDs are reused and cannot be used to uniquely identify a session. Use SessionGUID for that purpose instead. Number   3 all
SessionLogonTime Time when the user logged on. String   2018-07-23 10:06:02.123 +0200 all
SessionProtocol Remoting protocol used to connect to the session.
Possible values on Windows: Console, ICA, RDP, PCoIP, Blast, Frame, Protocol [ID].
Possible values on macOS: Console, RFB, SSH, Protocol [ID].
String   ICA all
SessionConnectionState Session connection state. Possible values: active, connected, connecting, shadowing,disconnected, idle, listening, reset, down, initializing, unknown, Unsupported state: [ID]. String   active Win
SessionProcessCount Number of processes that are running in the session. Number   34 all
SessionCPUTimeMs Session CPU usage (absolute usage in milliseconds). Number ms 3000 all
SessionCPUUsagePercent Process CPU usage (relative usage in percent). Number % 29 all
SessionIOPS I/O operations per second of all processes in the session combined. Number   500 Win
SessionIOCount I/O operation count of all processes in the session combined. Number   300 Win
SessionIOMB I/O data volume of all processes in the session combined. Number MB 20 all
SessionIOLatencyMs Latency of I/O operations. Number ms 300 Win
SessionWorkingSetMB RAM usage (working set) of all processes in the session combined. Number MB 450.2 all
SessionNetKBPS Process network traffic data volume per second of all processes in the session combined. Number KB 21 Win
SessionUser User name. String   Domain\JohnDoe all
SessionGUID Unique identifier for a session that is generated by uberAgent. String   00000002-f295-9109-e7c7-c964011dd401 all
SessionRpLatencyMs2 Remoting protocol latency. This field is filled with the latency in ms at collection time. If the protocol is ICA, uberAgent uses the perfmon counter Latency - Last Recorded as the source. This metric is different from Citrix Round-Trip-Time (more information). Number ms 30 Win
SessionClientMac Remote client MAC address. Only collected for VMware sessions. String   AC-ED-5C-02-F0-30 Win
SessionClientIp Remote client IP address. String   192.168.178.40 all
SessionClientName Remote client name. String   Client1 Win
SessionClientDomain Remote client Active Directory domain. String   vastlimits.com Win
SessionClientUser Remote client user name. String   JohnDoe Win
SessionClientUserDomain Remote client user Active Directory domain. String   Domain Win
SessionHRes Horizontal resolution. String   1920 Win
SessionVRes Vertical resolution. String   1080 Win
SessionColorDepth Color depth. String   32 Win
SessionClientPlatform Remote client platform. String   Windows Win
SessionClientVersion Remote client version. String   13.0.0.256735 Win
SessionClientOsLanguage Remote client operating system language. String   en-us Win
SessionPublishedName Published resource name. This resource was used to start or connect to the session. String   Google Chrome Win
SessionPublishedAppsCtx List of used Citrix published apps in the session. String   Word Excel Win
SessionAppStateCtx Citrix application state. Possible values: n/a, active, pre-launched, lingering, app not running, unsupported. String   lingering Win
SessionEncryptionCtx Citrix remoting protocol encryption. Possible values: unknown, basic, logon, 40 bit, 56 bit, 128 bit, SecureICA, unsupported. String   SecureICA Win
SessionClientTypeCtx Citrix client type. Possible values: WI, ICA Client. String   WI Win
SessionBrokerDnsVmw VMware broker DNS name. String   HorizonCS.vastlimits.com Win
SessionBrokerUrlVmw VMware broker URL. String   https://192.168.8.6:443 Win
SessionBrokerTunneledVmw VMware: indicates if session is tunneled. Possible values: true, false. String   true Win
SessionBrokerTunnelUrlVmw VMware: URL of the View Connection Server tunnel connection. String   https://HorizonCS.vastlimits.com:443 Win
SessionBrokerRemoteIpVmw VMware broker remote IP address. String   192.168.178.40 Win
SessionBrokerUserVmw VMware broker user name. String   John Win
SessionBrokerDomainVmw VMware broker user domain name. String   Doe Win
SessionClientTimezoneVmw VMware client timezone. String   Europe/Italy Win
SessionClientIdVmw VMware client ID. String   c47c60cf41ec44829ff91e1822b24dd8 Win
SessionTypeVmw VMware session type. Possible values: application, desktop. String   application Win
SessionBrokerType Remoting broker type. Possible values: Citrix, Microsoft, VMware, Nutanix Frame, none, unknown, Unsupported broker: [number]. String   Citrix Win
SessionFgAppId Foreground application ID. Used by uberAgent to look up application names and populate the field SessionFgAppName. String   GglChrm all
SessionFgAppVersion Foreground application version. String   67.0.3396.99 all
SessionFgProcessName Foreground process name. String   chrome.exe all
SessionFgProcessId Foreground process ID. Number   456 all
SessionFgBrowserType If the foreground window is a browser: browser type. Possible values: 1, 2, 3, 4. Also see the field SessionFgBrowserDisplayName. Number   1 all
SessionFgBrowserActiveTabHost If the foreground window is a browser: the URL of active tab. See this KB article for troubleshooting empty values. String   uberagent.com all
SessionFgWindowTitle The title of the active foreground window. String   Search | Splunk 7.2.1 - Google Chrome all
SessionClientHwIdCtx2 Citrix client hardware ID. Number   409D39C2 Win
SessionRoundTripTimeMs Citrix session round trip time. Number ms 50 Win
SessionFps Remoting protocol frames per second at collection time. Only available for Citrix and Nutanix Frame sessions. Number   20 Win
SessionTransportProtocols The protocol chain used for this connection. Only available for Citrix sessions. String   UDP-CGP-ICA Win

List of Calculated Fields

Field Description Data type Unit Example Where available
AppName Application name. Source is the field SessionFgAppId. String   Google Chrome Splunk data model, Splunk SPL
SessionCPUTimeS Session CPU usage (absolute usage in seconds). Number s 3 Splunk data model
SessionIODurationMs SessionIOLatencyMs x SessionIOCount. Number ms 90000 Splunk data model
SessionRAMUsagePercent Percentage of the machine’s RAM used by the session. Number % 34 Splunk data model
User Alias for SessionUser. String   Domain\JohnDoe Splunk data model
SessionUserLower User name converted to lower case. String   domain\johndoe Splunk data model
SessionDisplaySpecs SessionHRes + "x" + SessionVRes + "x" + SessionColorDepth. String   1920x1080x32 Splunk data model
SessionPublishedAppsCtxSplit SessionPublishedAppsCtx split by semicolon. String   Word;Excel Splunk data model
SessionPublishedAppsCtxSplitLower SessionPublishedAppsCtxSplit converted to lower case. String   word;excel Splunk data model
SessionFgAppName Foreground application name. String   Google Chrome Splunk data model, Splunk SPL
SessionFgBrowserDisplayName Foreground browser name. Possible values: Chrome, Internet Explorer, Firefox, Edge. String   Chrome Splunk data model, Splunk SPL
SessionClientHwIdCtx SessionClientHwIdCtx2 or SessionClientHwIdCtx, whichever is present. Number   409D39C2 Splunk data model
Session Metrics