Session Metrics
Session Detail
uberAgent collects metrics like the session ID, connection state, protocol latency, and foreground application per user session.
Details
- Source type:
uberAgent:Session:SessionDetail - Used in dashboards: Application Usage, Machine Uptime, SBC Sizing and Capacity Planning, Session 0, Session Info: Citrix, Session Info: VMware, User Session Overview, User Sessions, Single Application Performance, Single Machine Performance, Single User Performance, Analyze data over time
- Enabled through configuration setting:
SessionDetail - Related configuration settings: n/a
- Please also review the metric dependencies.
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Example | Platform |
|---|---|---|---|---|---|
| SessionID | Session ID generated by the OS. Session IDs are reused and cannot be used to uniquely identify a session. Use SessionGUID for that purpose instead. |
Number | 3 | all | |
| SessionLogonTime | Time when the user logged on. | String | 2018-07-23 10:06:02.123 +0200 | all | |
| SessionProtocol | Remoting protocol used to connect to the session., Possible values on Windows: Console, ICA, RDP, PCoIP, Blast, Frame, Protocol [ID]., Possible values on macOS: Console, RFB, SSH, Protocol [ID].
|
String | ICA | all | |
| SessionConnectionState | Session connection state. Possible values: active, connected, connecting, shadowing,disconnected, idle, listening, reset, down, initializing, unknown, Unsupported state: [ID]. |
String | active | Win | |
| SessionProcessCount | Number of processes that are running in the session. | Number | 34 | all | |
| SessionCPUTimeMs | CPU usage (absolute usage in milliseconds) of all processes in the session combined. | Number | ms | 3000 | all |
| SessionCPUUsagePercent | CPU usage (relative usage in percent) of all processes in the session combined. | Number | % | 29 | all |
| SessionIOPS | I/O operations per second of all processes in the session combined. | Number | 500 | Win | |
| SessionIOCount | I/O operation count of all processes in the session combined. | Number | 300 | Win | |
| SessionIOMB | I/O data volume of all processes in the session combined. | Number | MB | 20 | all |
| SessionIOLatencyMs | Latency of I/O operations per session of all processes in the session combined. | Number | ms | 300 | Win |
| SessionWorkingSetMB | RAM usage (working set) of all processes in the session combined. | Number | MB | 450.2 | all |
| SessionNetKBPS | Process network traffic data volume per second of all processes in the session combined. | Number | KB | 21 | Win |
| SessionUser | User name. | String | Domain\JohnDoe | all | |
| SessionGUID | Unique identifier for a session that is generated by uberAgent. | String | 00000002-f295-9109-e7c7-c964011dd401 | all | |
| SessionRpLatencyMs2 | Remoting protocol latency. This field is filled with the latency in ms at collection time. If the protocol is ICA, uberAgent uses the perfmon counter Latency - Last Recorded as the source. This metric is different from Citrix Round-Trip-Time |
Number | ms | 30 | Win |
| SessionClientMac | Remote client MAC address. Only collected for VMware sessions. | String | AC-ED-5C-02-F0-30 | Win | |
| SessionClientIp | Remote client IP address. | String | 192.168.178.40 | all | |
| SessionClientName | Remote client name. | String | Client1 | Win | |
| SessionClientDomain | Remote client Active Directory domain. | String | citrix.com | Win | |
| SessionClientUser | Remote client user name. | String | JohnDoe | Win | |
| SessionClientUserDomain | Remote client user Active Directory domain. | String | Domain | Win | |
| SessionHRes | Horizontal resolution. | String | 1920 | Win | |
| SessionVRes | Vertical resolution. | String | 1080 | Win | |
| SessionColorDepth | Color depth. | String | 32 | Win | |
| SessionClientPlatform | Remote client platform. | String | Windows | Win | |
| SessionClientVersion | Remote client version. | String | 13.0.0.256735 | Win | |
| SessionClientOsLanguage | Remote client operating system language. | String | en-us | Win | |
| SessionPublishedName | Published resource name. This resource was used to start or connect to the session. | String | Google Chrome | Win | |
| SessionPublishedAppsCtx | List of used Citrix published apps in the session. | String | Word Excel | Win | |
| SessionAppStateCtx | Citrix application state. Possible values: n/a, active, pre-launched, lingering, app not running, unsupported. |
String | lingering | Win | |
| SessionEncryptionCtx | Citrix remoting protocol encryption. Possible values: unknown, basic, logon, 40 bit, 56 bit, 128 bit, SecureICA, unsupported. |
String | SecureICA | Win | |
| SessionClientTypeCtx | Citrix client type. Possible values: WI, ICA Client. |
String | WI | Win | |
| SessionBrokerDnsVmw | VMware broker DNS name. | String | HorizonCS.citrix.com | Win | |
| SessionBrokerUrlVmw | VMware broker URL. | String | https://192.168.8.6:443 | Win | |
| SessionBrokerTunneledVmw | VMware: indicates if session is tunneled. Possible values: true, false. |
String | true | Win | |
| SessionBrokerTunnelUrlVmw | VMware: URL of the View Connection Server tunnel connection. | String | https://HorizonCS.citrix.com:443 | Win | |
| SessionBrokerRemoteIpVmw | VMware broker remote IP address. | String | 192.168.178.40 | Win | |
| SessionBrokerUserVmw | VMware broker user name. | String | John | Win | |
| SessionBrokerDomainVmw | VMware broker user domain name. | String | Doe | Win | |
| SessionClientTimezoneVmw | VMware client timezone. | String | Europe/Italy | Win | |
| SessionClientIdVmw | VMware client ID. | String | c47c60cf41ec44829ff91e1822b24dd8 | Win | |
| SessionTypeVmw | VMware session type. Possible values: application, desktop. |
String | application | Win | |
| SessionBrokerType | Remoting broker type. Possible values: Citrix, Microsoft, VMware, Nutanix Frame, none, unknown, Unsupported broker: [number]. |
String | Citrix | Win | |
| SessionFgAppId | Foreground application ID. Used by uberAgent to look up application names and populate the field SessionFgAppName. |
String | GglChrm | all | |
| SessionFgAppVersion | Foreground application version. | String | 67.0.3396.99 | all | |
| SessionFgProcessName | Foreground process name. | String | chrome.exe | all | |
| SessionFgProcessId | Foreground process ID. | Number | 456 | all | |
| SessionFgBrowserType | If the foreground window is a browser: browser type. Possible values: 1, 2, 3, 4, 5. Also see the field SessionFgBrowserDisplayName. |
Number | 1 | all | |
| SessionFgBrowserActiveTabHost | If the foreground window is a browser: the URL of active tab. See this KB article for troubleshooting empty values. | String | uberagent.com | all | |
| SessionFgWindowTitle | The title of the active foreground window. | String | Search | Splunk 7.2.1 - Google Chrome | all | |
| SessionClientHwIdCtx2 | Citrix client hardware ID. | Number | 409D39C2 | Win | |
| SessionRoundTripTimeMs | Citrix session round trip time. | Number | ms | 50 | Win |
| SessionFps | Remoting protocol frames per second at collection time. Only available for Citrix and Nutanix Frame sessions. | Number | 20 | Win | |
| SessionTransportProtocols | The protocol chain used for this connection. Only available for Citrix sessions. | String | UDP-CGP-ICA | Win | |
| SessionInputDelayMaxMs | Maximum input delay per timer interval and session. | Number | ms | 15 | all |
| SessionInputDelaySumMs | Sum of input delay per timer interval and session. | Number | ms | 500 | all |
| SessionInputDelayCount | PerfMon event count per timer interval and session. | Number | 50 | all | |
| SessionFgProcessGuid | Foreground process GUID. | String | 00000002-f295-9109-e7c7-c964011dd401 | all | |
| SessionInputDelayMaxMs | Maximum input delay per timer interval and session. | Number | ms | 15 | all |
| SessionInputDelaySumMs | Sum of input delay per timer interval and session. | Number | ms | 500 | all |
| SessionInputDelayCount | PerfMon event count per timer interval and session. | Number | 50 | all | |
| CtxSessionKey | The Citrix session key. | String | 1367ba9d-eb01-46ca-9f41-004b2fe1b1db | Win | |
| CtxAutoClientReconnectCount | The Citrix session reconnect count. | Number | 1 | Win | |
| CtxFrameRateInputFPS | The frame rate of the operating system / application. | Number | 0 | Win | |
| CtxFrameRateTargetFPS | The rendering target. | Number | 30 | Win | |
| CtxEDTNAKPacketsSent | The Citrix EDT NAK packets sent. | Number | 0 | Win | |
| CtxOutOfOrderEDTPackets | The Citrix out-of-order EDT packets sent. | Number | 0 | Win | |
| CtxHDXDirectStatus | The Citrix HDX direct status. Possible values: 0, 1 2
|
Number | 1 | Win | |
| CtxHDXDirectStatusDisplayName | The Citrix HDX direct status display name. Possible values: None, Connected-Internal, Connected-External
|
String | Connected-Internal | Win |
List of Calculated Fields
| Field | Description | Data type | Unit | Example | Where available |
|---|---|---|---|---|---|
| AppName | Application name. Source is the field SessionFgAppId. |
String | Google Chrome | Splunk data model, Splunk SPL | |
| SessionCPUTimeS | Session CPU usage (absolute usage in seconds). | Number | s | 3 | Splunk data model |
| SessionIODurationMs |
SessionIOLatencyMs x SessionIOCount. |
Number | ms | 90000 | Splunk data model |
| SessionRAMUsagePercent | Percentage of the machine’s RAM used by the session. | Number | % | 34 | Splunk data model |
| User | Alias for SessionUser. |
String | Domain\JohnDoe | Splunk data model | |
| SessionUserLower | User name converted to lower case. | String | domain\johndoe | Splunk data model | |
| SessionDisplaySpecs |
SessionHRes + "x" + SessionVRes + "x" + SessionColorDepth. |
String | 1920x1080x32 | Splunk data model | |
| SessionPublishedAppsCtxSplit |
SessionPublishedAppsCtx split by semicolon. |
String | Word;Excel | Splunk data model | |
| SessionPublishedAppsCtxSplitLower |
SessionPublishedAppsCtxSplit converted to lower case. |
String | word;excel | Splunk data model | |
| SessionFgAppName | Foreground application name. | String | Google Chrome | Splunk data model, Splunk SPL | |
| SessionFgBrowserDisplayName | Foreground browser name. Possible values: Chrome, Internet Explorer, Firefox, Edge, Citrix Enterprise Browser. |
String | Chrome | Splunk data model, Splunk SPL | |
| SessionClientHwIdCtx |
SessionClientHwIdCtx2 or SessionClientHwIdCtx, whichever is present. |
Number | 409D39C2 | Splunk data model |
Session profile
Detailed performance data about managed user profiles (e.g., Citrix Profile Management).
Details
- Source type:
uberAgent:Session:SessionProfile - Used in dashboards: User Profile Overview, Single Logon
- Enabled through configuration setting:
SessionProfile - Related configuration settings: n/a
- Supported platform: Windows
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Measurement type | Example |
|---|---|---|---|---|---|
| SessionGUID | Unique identifier that is generated by uberAgent when the session is created. Valid for this session only. | String | Snapshot | 00000002-f295-9109-e7c7-c964011dd401 | |
| ProfileType | What kind of profile management software is used. | Number | Snapshot | 1 | |
| ProfileTypeDisplayName | The display name of the profile type. Possible values: Citrix Profile Management. |
String | Snapshot | Citrix Profile Management | |
| ProfileVersion | The version of the profile management software. | String | Snapshot | 25.7.100.95 | |
| ProfileContainerDiskType | What profile container disc type is used. | Number | Snapshot | 2 | |
| ProfileContainerDiskTypeDisplayName | The display name of the profile container type. Possible values: VHD, VHDX. |
String | Snapshot | VHDX | |
| ProfileContainerDiskSizeLogonMB | The size of the profile container at logon. | Number | MB | Snapshot | 127.4 |
| ProfileFileCount | The number of files on the network data store. | Number | Snapshot | 245 | |
| ProfileSizeMB | The size of the whole profile on the network data store. | Number | MB | Snapshot | 223.1 |
| ProfileLargeFileCount | The number of large files. | Number | Snapshot | 2 |
Session Metrics
Copied!
Failed!