Changelog and Release Notes

Citrix CVAD integration (Windows): uberAgent is now part of the Citrix Virtual Apps and Desktops installation (documentation).

Citrix Director integration (Windows) : uberAgent is now connected with Citrix Director (documentation), enabling new Director functionalities.

Citrix Web Studio integration (Windows) : uberAgent can now be enabled and configured via Citrix Web Studio (documentation).

Logon monitoring (Windows) : added monitoring of AppX file associations and package load times.

Agent (macOS) : enhanced logging and error management for unsupported receiver types.

Agent (Windows) : added generic ETW receiver for services to read events from uberAgent® using the Windows Event Tracing for Windows (ETW) API using the ETW receiver type and the ETWProviderGuid configuration option.

Agent (Windows) : added config-flag AppNameIsAppId that disables compressing the application name, resulting in the AppId being identical to the application name.

Agent (Windows) : improved the performance of the data exchange with the driver.

Dashboards : expanded clickable area of collapsible section headers in Experience Score Overview and Security Score dashboards for improved usability.

Dashboards : updated the Splunk SDK for Python to version 2.1.0 in the uberAgent ESA Splunk app.

Driver (Windows) : reduced the scope of file locks.

Setup (Windows) : the default installation directory is now: C:\Program Files\Citrix\uberAgent.

Agent (macOS) : fixed a logical memory leak if a timer contains the ESA metric ProcessStop but ESA is not licensed.

Agent (Windows) : fixed an issue where the internal application name cache was not populated due to misspelled registry key.

Agent (Windows) : fixed an issue where the driver configuration was not applied when ESA was disabled.

CCFM (Windows) : fixed an issue where failed to monitor the GPO registry key for updates.

Code Signing (Windows) : updated code signing certificates in all binaries to use certificates issued for Citrix Systems, Inc., except for uberAgentFilter.sys and uberAgentNetMon.sys.

Installer (macOS): After upgrading uberAgent, ensure to run pkill -f "uberAgentBrowserHelper" with root privileges before enabling the daemon.

Setup : the configuration files are no longer part of the installation package. See Installing the macOS Endpoint Agent or Installing the Windows Endpoint Agent for details.

Sourcetype (Windows) : uberAgent:Logon:LogonDetail has new fields: AppXFileAssocStart, AppXFileAssocEnd, AppXLoadPackagesStart, AppXLoadPackagesEnd and AppXPackages.

Agent (Windows) : under heavy load the following message may be logged: CheckEventRecord,Events were lost. This may affect uberAgent's per-process disk, network, or UI-responsiveness metrics.

Boot monitoring : on Windows 11, no information can be retrieved if there is no active session within the data collection period.

Browsers : on systems with many user sessions the URL of the foreground tab might not match the browser's window title.

Browsers/Firefox add-on : if the option privacy.resistFingerprinting is set to true, browser metrics are not available due to invalid data being sent from Firefox.

Browsers/IE add-on (Windows): metrics are collected incompletely for the configured start page.

Browsers/IE add-on (Windows): metrics are not collected on page reload.

Browsers/IE add-on (Windows): monitoring does not work if IE is published from Citrix Virtual Apps. It does work from Citrix Virtual Desktops, however.

Citrix CVAD/DaaS (Windows): data collection issue if the Citrix Remote Powershell SDK (required for Citrix Cloud monitoring) is installed on a CVAD controller.

Citrix CVAD/DaaS (Windows): when running the Citrix VDA on a Citrix delivery controller, some per-machine information is missing.

Experience Score : scheduled searches generate three warnings in Splunk's _internal index every 30 minutes. The messages look like the following: DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event.. However, there is no impact on uberAgent's functionality.

GPU (Windows) : values for the fields ComputeUsagePercentAllEngines, ComputeUsagePercentEngine0 and similar can be higher than 100 with Intel Iris GPUs on Windows Server 2016 1607.

Kafka : in rare cases, sending data to Kafka results in a SEC_E_BUFFER_TOO_SMALL error message in the logfile. This should have no effect; the transmission is repeated and succeeds on the second try.

NetScaler®: in very rare cases, the content of the Virtual Server Performance field vServerName contains spaces in wrong places.

Update inventory (Windows): not all installed Windows updates may be reported due to API limitations.

User input delay (Windows) : determining this metric may trigger a handle leak in uberAgent caused by Windows. This was fixed by Microsoft in most OS versions, but still happens on Windows Server 2022 22H2.

Volume inventory (macOS): the encryption status of mounted read-only APFS snapshots may not be reported due to API limitations. This includes the root directory volume in a default installation of macOS.