uberAgent 7.5.1

Last published : Oct 14, 2026
Related information
What's New
Fixed issuesKnown issues

About the release

This uberAgent release includes new features, improvements and bug fixes.
For installation and upgrade instructions:
Please note that uberAgent 7.5.0 is only available with Citrix Virtual Apps and Desktops 2511\. Technically, it's the same version as uberAgent 7.5.1\.

What's New

Licensing via Citrix License Activation Service
With uberAgent 7.5.1, uberAgent switches to utilizing the Citrix License Activation Service (LAS) for all types of deployments. This means that the product will no longer work with legacy uberAgent license files (e.g., uberAgent.lic)\. While uberAgent versions 7.4.2 and later are automatically licensed on Citrix Virtual Delivery Agent (VDA) deployments, an activation file issued from your Citrix Cloud account is required for all non-VDA installations. Please consult the uberAgent license guide for more details\.
To ensure uberAgent is able to communicate with the LAS backend, verify that your endpoints are able to connect to the license servers listed here\.
If uberAgent cannot contact the LAS backend, the license verification may fail and uberAgent does not start\. Note, this may require uberAgent to use a proxy, depending on your environment\. For instructions on how to configure uberAgent to use a system proxy follow this guide\. Please also review the upgrade instructions and update your deployment process.

Azure Monitor Sunsetting

uberAgent supported Azure Monitor as backend via its HTTP Data Collector API. This API has been deprecated by Microsoft. It will no longer function after September 14, 2026. Unfortunately, the API’s successor, the Logs Ingestion API, does not meet uberAgent's technical requirements. There is no longer a viable way for uberAgent to send data to Azure Monitor. For this reason, Azure Monitor is no longer a supported backend for uberAgent. For details and alternatives please see Microsoft Azure Monitor (legacy).

Configure ProcessDetailTopN Metric Granularity

It is now possible to fine-tune the number of processes reported by the ProcessDetailTopN metric, if uberAgent should not collect data about all processes\. Specify the number of processes you want to monitor directly in the metric name (e.g., ProcessDetailTop10)\. This setting allows to control the amount of processes included in each of the five performance categories\. This setting can be used to enable more efficient data collection in data volume optimized configurations\. Please see the documentation for more details\.

Managed User Profile Metrics on Windows

uberAgent now collects detailed metrics for managed user profiles on Windows systems\. The initial release includes full support for Citrix Profile Management, providing deeper insights into user profile behavior and performance for environments utilizing this technology\. Metrics are visualized on a new Splunk dashboard, the User Profile Overview and additionally on the Single Logon dashboard\.

Citrix macOS VDA: HDX Session Metrics

uberAgent extends its monitoring capabilities to Citrix VDA for macOS, now collecting detailed metrics on HDX sessions\. When installed on a macOS VDA, The product provides visibility into session and virtual channel performance by adding macOS-related events to the sourcetypes: uberAgent:CitrixSession:VirtualChannelDetail, uberAgent:CitrixSession:SessionConfig, and uberAgent:Session:SessionDetail\. The data is visualized on the existing Splunk dashboards.

Config & Support Tool Enhancement (macOS and Windows)

The Config & Support Tool has been improved to simplify the setup of proof of concept (PoC) installations and streamline troubleshooting\. Users can now quickly generate support and configuration bundles on both macOS and Windows, enabling faster issue resolution and smoother onboarding\. Additionally, the tool now provides an option to customize the configuration before creating a configuration bundle\. The Config & Support Tool is now automatically installed with uberAgent\. More details can be found in the tool's documentation\.

Citrix Session Insights

A new Splunk dashboard, Citrix Session Insights, is now available. This dashboard offers baseline insights on Citrix logon durations, session responsiveness, and disconnect events\. It provides administrators with a comprehensive comparison of current session performance with respective baseline values\. Consult the documentation for more details\.

macOS System Log Forwarding

uberAgent can now collect and forward events from the macOS system log\. This enhancement gives administrators deeper insight into macOS system activities and improves monitoring capabilities across Apple devices\. See the documentation for implementation details, and examples\.

Customizable Ignored Processes During Logon

uberAgent monitors various phases of a logon, including the execution of a logon script\. To determine the phase duration, it waits for all child processes of the main logon process to finish\. If there is a process that was started by the logon script but keeps running throughout the user session, it can cause the logon phase to be reported as taking longer than it actually did\. To avoid this, you can now configure uberAgent to ignore certain processes that are started by the logon script\. See this article for implementation examples\.

PowerShell Scripts Are Now Stored on Disk

In addition to its drivers, uberAgent uses PowerShell scripts to determine additional metrics and query external data sources, such as NetScaler appliances, Citrix site metrics, and more. Earlier versions of uberAgent dynamically created these PowerShell scripts during runtime. However, starting with uberAgent 7.5.1, these scripts are stored in the folder %ProgramFiles%\Citrix\uberAgent\Scripts and are signed with a Citrix code signing certificate. This helps customers put uberAgent's scripts on an allowlist while security policies prohibit unsigned script execution\.

Improvements

Agent

All platforms

  • : web response messages are no longer printed to stdout\.
  • : time unit suffixes are now allowed in time interval specifications, e.g., 25s stands for 25 seconds\. Previously, all time intervals were interpreted as milliseconds. The old format (without specifiers) is still supported\.
  • : the default state of the uberAgentEnabled Citrix policy is now enabled\. Previously, it was disabled\.
  • : when an unsupported attribute is used in a [ThreatDetectionRule] stanza, a log message is written instead of silently discarding the rule\.
  • : fixed an agent crash if an Azure Event Hubs configuration is invalid\.
  • : integrated the Config & Support Tool into the macOS and Windows installers\.
  • : receiver names are now checked for the following illegal characters: /\:*?"<>|
  • : when sending the data, the index name is taken from the uberAgent configuration (for Splunk or Kafka backends). This allows for index name changes without affecting buffered events\.

Windows

  • : added the GUID of the foreground process to the SessionDetail sourcetype\.
  • : WMI queries are now executed directly in the agent without calling external programs. This is the new default setting\.
  • : the LogonServer field of the sourcetype uberAgent:Logon:LogonDetail is now left empty for Entra joined devices\.
  • : fixed an issue where uberAgent did not update its own %PATH% environment variable when multiple PowerShell versions are installed on the system\.
  • : fixed an issue where some unicode characters were converted incorrectly when collecting CVAD, DaaS and NetScaler metrics\.
  • : improved update handling for uberAgent installations managed by the CVAD installer\.
  • : remove the entire registry key HKLM\SOFTWARE\Citrix\uberAgent during deinstall\.

macOS

  • : enhanced detection and recovery after tampering with communication resources of helper binaries\.
  • : significantly reduced CPU usage during Endpoint Security event processing by implementing bundle information caching\.
  • : system extensions are now associated with their originating applications\.

Splunk

  • : improved the Licensing status dashboard to provide a better overview of active licenses and Citrix LAS communication errors\.
  • : added user profile details to the Single Logon dashboard\.
  • : added a drilldown to the Application Input Delay and Process Input Delay dashboards\.
  • : added a drilldown to the Logon duration per host (top 10) panel on the User Logon Duration dashboard\.

Release notes

  • Code Signing (Windows) : updated remaining binaries' code signing certificates to use certificates issued for Citrix Systems, Inc.\.
  • Code Signing (Windows) : updated file attribute of all binaries CompanyName to reflect the official company name: Citrix Systems, Inc..
  • Dashboards : added the field OsName to the hostinfo lookup\.
  • Dashboards : added the fields OsName, HwBiosVersion, and SourceIndex to all data models\.
  • Dashboards : added the field HwBiosVersion to the hostinfo lookup\.
  • Dashboards : the Citrix Session Protocol Insights dashboard was renamed to Citrix Session Protocol Details\.
  • Dashboards : in uberAgent UXM, the SBC/VDI menu has been renamed to Citrix, and Experience Score Overview to Scores & Insights\.
  • Installer (Windows) : upgraded the code signature digest algorithm from SHA-1 to SHA-256\.
  • Installer (Windows) : updated file attribute Authors to reflect the official company name: Citrix Systems, Inc.\.
  • Licensing (macOS, Windows) : uberAgent now supports Citrix CVAD licensing; when present, it takes precedence over the license file\.
  • Sourcetype (macOS) : new sourcetype uberAgentESA:System:MacOsSystemLogForwarding with fields: LevelValue, Count, ProcessID, ProcName, Message, LevelDescription, Subsystem, Category and AppId\.
  • Sourcetype (Windows) : uberAgent:Session:SessionDetail has new fields: CtxSessionKey, CtxAutoClientReconnectCount, CtxFrameRateInputFPS, CtxFrameRateTargetFPS, CtxFrameRateCurrentFPS, CtxEDTNAKPacketsSent, CtxOutOfOrderEDTPackets, CtxHDXDirectStatus\.
  • Sourcetype (Windows) : uberAgent:Session:SessionDetail has a new field: SessionFgProcessGuid\.
  • Sourcetype (Windows) : new sourcetype uberAgent:Session:SessionProfile with fields: SessionGUID, ProfileType, ProfileVersion, ProfileContainerDiskType, ProfileContainerDiskSizeLogonMB, ProfileFileCount, ProfileSizeMB, ProfileLargeFileCount\.
  • Splunk data models : added the uberAgent UXM data model uberAgentUXM_CitrixBaselineInsights with the dataset uberAgentUXM_CitrixBaselineInsights\.
  • Splunk data models : added the dataset uberAgentUXM_Session_SessionProfile to the uberAgent UXM data model uberAgentUXM_Session\.
  • Splunk data models : added the fields ActivationExpiration and LasCommunicationErrors to the Splunk data set uberAgentUXM_License\.
  • Threat Detection Engine : the field Reg.Key.Sddl has been phased out to reduce complexity and focus on core improvements\.