Changelog and Release Notes

Citrix CVAD/DaaS (Windows) : additional metrics are now collected.

Event log forwarding (Windows) : uberAgent® can now collect and forward events from the Windows event log.

Process startup (macOS) : uberAgent now reports blocked process creations where a security product prevented the exec system call. When this happens, uberAgent generates a ProcessStartup event with a blocked flag.

Agent : the log file path can now be configured.

Agent (Windows) : uberAgent's kernel drivers use lists to buffer data for collection by the service (user mode). The sizes of these lists are now configurable, and they're reported as part of the memory statistics in the log file.

Agent (macOS) : improved peer verification for IPC.

Agent (Windows) : improved efficiency by introducing batch processing of processes and libraries in the driver to agent communication.

Agent : improved logging if Azure Event Hubs configuration is invalid.

Agent (macOS) : optimized long-term memory usage and performance for systems under high load conditions.

Agent (Windows) : significantly reduced CPU usage when determining a huge number of performance counters.

Agent (Windows) : better protection against user-writable directories in the %PATH% environment variable when launching child processes.

Browsers (Windows) : enhanced communication between the browser extensions' native messaging hosts and the uberAgent service.

Browsers (Windows) : added support for flag #launch-windows-native-hosts-directly in Chromium-based browsers.

Citrix CVAD/DaaS (Windows) : the database size is now determined and visualized in the Citrix Virtual Apps and Desktops Databases dashboard.

Citrix CVAD/DaaS (Windows) : licenses are now determined for Citrix DaaS, too, and visualized in the Citrix Virtual Apps and Desktops Licenses dashboard.

Citrix CVAD/DaaS (Windows) : status information per delivery group is now determined and visualized in the Citrix Virtual Apps and Desktops Machines dashboard.

Configuration (Windows) : configuration files are no longer searched in the installation directory.

Dashboards : the Data Volume dashboard now includes a dropdown to filter indexes.

NetScaler® : the NetScaler Virtual Server dashboards now show hit rate, request rate, response rate, and current client and server connections.

NetScaler : the NetScaler Gateway Performance dashboard now shows the number of users and number of AAA sessions per gateway.

Security score : renamed the host to license distribution chart to uberAgent component to host ratio on the Security Score dashboard. The chart now displays where ESA is used in comparison to UXM.

Security score : removed redundant fields in the Host Analysis drilldown panel on the Security Score dashboard.

uAQL : The new jsonp function makes it possible to use JSON pointers to easily access specific values in a JSON object.

Agent (Windows) : fixed a possible case of DLL search order hijacking.

Agent (Windows) : fixed a race condition in the logger resulting in the configuration log being written twice.

Agent (macOS) : fixed small memory leak when using credentials store.

Agent (Windows) : fixed a bug that might result in uberAgent attempting to terminate arbitrary processes due to PID reuse.

Agent (macOS) : removed unnecessary log output while collecting information for the SystemPerformanceSummary2 sourcetype.

Agent (macOS) : fixed process exit processing for blocked exec events.

Agent (macOS) : fixed occasional high CPU load caused by network monitoring.

Configuration : configuration rules are now evaluated in the order defined in the configuration.

Citrix CVAD/DaaS (Windows) : fixed a bug that might result in uberAgent not computing Citrix virtual channel metrics on older Citrix VDA installations.

Dashboards : improved timestamp handling in the Stop Errors table on the Single Machine Details dashboard.

Drivers (Windows) : fixed an issue in the file system filter driver that could cause writes to any named pipes on the system to fail.

Experience score : total Experience Score calculation is now in line with sub-scores.

Performance counters : percent values are not capped at 100 anymore.

Setup (Windows) : fixed an issue where the service was not removed and continued running after uninstallation.

Threat Detection Engine : reduced CPU usage for network-related rules.

Threat Detection Engine : rules for event type Net.Any are now properly evaluated.

Agent (Windows): the minimum OS requirement is now Windows 10 Build 1607 or Windows Server 2016.

Configuration : new ConfigFlag settings MaxProcessEventQueueSize, MaxLibraryEventQueueSize, MaxThreadEventQueueSize and MaxRegistryEventQueueSize.

Configuration : new ConfigFlag settings MaxProcessBatchSize and MaxLibrariesBatchSize.

Configuration : removed deprecated option Thread priority and stanzas [ProcessStartStop_Filter], [ProcessDetailFull_Filter] and [NetworkTargetPerformanceProcess_Filter]. The removed stanzas can be replaced with Event Data Filtering.

Dashboards : renamed the Citrix Virtual Apps and Desktops dashboards to CVAD/DaaS to emphasize that Citrix DaaS is supported, too.

NetScaler : raised the required NetScaler version from 10.5 to 13.1.

NetScaler : removed SSL3 as a valid security protocol when connecting to NetScaler. TLS 1.1 is now the minimum.

Setup : the agent is no longer started after a successful installation. See Installing the macOS Endpoint Agent or Installing the Windows Endpoint Agent for details.

Sourcetype (Windows) : uberAgent:Citrix:Databases has new fields: DBSizeMB, DBDataSpaceUsageMB, DBIndexSpaceUsageMB and DBSpaceAvailableMB.

Sourcetype (Windows) : uberAgent:Citrix:DesktopGroups has new fields: Enabled and IsInMaintenanceMode.

Sourcetype (Windows) : uberAgent:Citrix:Licenses has new fields: LicenseUserUsage, LicenseDeviceUsage and CustomerId.

Sourcetype (Windows) : uberAgent:CitrixADC:Gateway has new fields: VpnUsers, and SslVpnUsers.

Sourcetype (Windows) : uberAgent:CitrixADC:vServer has new fields: HitsRate, RequestsRate, ResponsesRate, CurrentClientConnections, and CurrentServerConnections.

Sourcetype (Windows) : uberAgent:CitrixADC:vServer has removed fields: TotHits2, TotalRequests2, TotalResponses2, RequestMBRate, ResponseMBRate, RequestResponseRateMB.

Sourcetype (Windows) : uberAgent:CitrixADC:AppliancePerformance has removed fields: ApplianceMBReceived, ApplianceMBSent.

Sourcetype (Windows) : new sourcetype uberAgentESA:System:WinEvtLogForwarding with fields: ProviderName, EventID, Level, ProcessID, Channel, User and EventData.

Agent (Windows) : under heavy load the following message may be logged: CheckEventRecord,Events were lost. This may affect uberAgent's per-process disk, network, or UI-responsiveness metrics.

Boot monitoring : on Windows 11, no information can be retrieved if there is no active session within the data collection period.

Browsers : on systems with many user sessions the URL of the foreground tab might not match the browser's window title.

Browsers/IE add-on (Windows): metrics are not collected on page reload.

Browsers/IE add-on (Windows): metrics are collected incompletely for the configured start page.

Browsers/IE add-on (Windows): monitoring does not work if IE is published from Citrix Virtual Apps. It does work from Citrix Virtual Desktops, however.

Browsers/Firefox add-on : if the option privacy.resistFingerprinting is set to true, browser metrics are not available due to invalid data being sent from Firefox.

Citrix CVAD/DaaS (Windows): data collection issue if the Citrix Remote Powershell SDK (required for Citrix Cloud monitoring) is installed on a CVAD controller.

Citrix CVAD/DaaS (Windows): when running the Citrix VDA on a Citrix delivery controller, some per-machine information is missing.

Experience Score : scheduled searches generate three warnings in Splunk's _internal index every 30 minutes. The messages look like the following: DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event.. However, there is no impact on uberAgent's functionality.

GPU (Windows) : values for the fields ComputeUsagePercentAllEngines, ComputeUsagePercentEngine0 and similar can be higher than 100 with Intel Iris GPUs on Windows Server 2016 1607.

Kafka : in rare cases, sending data to Kafka results in a SEC_E_BUFFER_TOO_SMALL error message in the logfile. This should have no effect; the transmission is repeated and succeeds on the second try.

NetScaler: in very rare cases, the content of the Virtual Server Performance field vServerName contains spaces in wrong places.

Update inventory (Windows): not all installed Windows updates may be reported due to API limitations.

User input delay (Windows) : determining this metric may trigger a handle leak in uberAgent caused by Windows. This was fixed by Microsoft in most OS versions, but still happens on Windows Server 2022 22H2.

Volume inventory (macOS): the encryption status of mounted read-only APFS snapshots may not be reported due to API limitations. This includes the root directory volume in a default installation of macOS.