Collection of published application launch events is the responsibility of the EUEM service (SemsService.exe) running on each XenApp server. It is important to note that when it pertains to the launch events, the EdgeSight agent is just a consumer of the data provided by the EUEM service and is not likely to be at the root cause of a failure to obtain the events. There are still a number of things to check on the EdgeSight agent side to make sure it is set to collect those launch events.

---

Instructions

1 – Edgesight agent check

There are a few conditions that will cause the EdgeSight agent not to collect Published application launch events even when the EUEM service is collecting them. All of those conditions can be checked in the SYS_EVENT_TXT.txt file which is located on each XenApp server with the agent installed, typically under <\ProgramData\Citrix\System Monitoring\Data>

Note: If the data is stored in a custom location, you will find the path to the data folder under DataPath here: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\System Monitoring\Agent\Core\4.00

The conditions that must be met on the EdgeSight Agent software side are the following:

• The agent must be running in Full (Advanced) mode
• Sems Performance collection must be active (as opposed to “Paused”)

Here is an example of the Citrix system monitoring service log (SYS_EVENT_TXT.txt) when the service is started:
 

2016-03-17 11:50:26 Core                     Service                  [6516] ----- Starting Agent on XAServer001 version 5.4.21.3 -----
2016-03-17 11:50:26 Core                     Service                  [6516] Current service state is 'START_PENDING'
2016-03-17 11:50:26 Core                     Collector                [6516] Starting...  
2016-03-17 11:50:26 Core                     Collector                [6516] Database connection is local.
...
2016-03-17 11:50:44 Ctrx                     FunctionalityMode        [936] Initial functionality mode set to FULL.
…
2016-03-17 11:50:50 Ctrx                     CPSPerformance           [936] Sems Performance collection is active. 
2016-03-17 11:50:50 Ctrx                     FunctionalityMode        [936] Functionality mode changed to FULL.
…
2016-03-17 11:51:18 EdgeSight                Performance              [936] Performance collection starting in thread 1780
2016-03-17 11:51:19 EdgeSight                Performance              [936] Device is not pooled
2016-03-17 11:51:19 Ctrx                     CPSPerformance           [936] SEMS performance collection starting in thread 5796
2016-03-17 11:51:19 Ctrx                     CPSPerformance           [936] Performance collection starting in thread 7044
2016-03-17 11:51:33 Core                     Collector                [936] Phased startup complete.
2016-03-17 11:51:33 EdgeSight                Performance              [936] Performance collection is active.
2016-03-17 11:51:33 Ctrx                     CPSPerformance           [936] Performance collection is active.
2016-03-17 11:51:33 Ctrx                     CPSPerformance           [936] Sems Performance collection is active.

This is enough to validate that the EdgeSight agent is set up as it should to obtain the Application launch events from the EUEM service.
We can now turn our attention to the EUEM service, which is running on the same XA server as the EdgeSight agent.
 
2 – EUEM Service check

Note that the EUEM service is part of XenApp (it is not an EdgeSight component). When troubleshooting EUEM, we are moving out of the scope EdgeSight.
Basic checks:

•  The EUEM service must be installed on the XenApp server. If it is not, the XenApp server might have been installed in standard edition. This install mode does not include the EUEM Service.
•  The EUEM service must be running

 

Note that the EUEM service is set to manual startup. This is because the startup request is triggered by the consumer – in that case the EdgeSight agent. If there is no component to consume the information, the service does not need to start.

To verify that the EUEM service is collecting the Application launch event, enable VerboseSEMSLogging on the XenApp server by adding the following key and restart the EUEM service:

Key Name:          HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\System Monitoring\Agent\Ctrx\4.00
  Name:            VerboseSEMSLogging
  Type:            REG_DWORD
  Data:            0x1

The log file is named SEMS_EVENT_TXT.txt and is created in the data folder (<\ProgramData\Citrix\System Monitoring\Data>)
In the output log file, the event of interest is Counter type ApplicationLaunch. See example below where the published application name is wmiexplorer2.
 

2017-01-13 14:54:46 [8240] Counter type ClientStartup with 12 parameters: applicationName='#wmiexplorer2'; isSharedSession=0; launchType='WI'; lpwd=7; nrwd=67; sccd=529; scd=3003; semsSessionId='4:636199160785047093'; sessionId=4; slcd=1; timestamp=1-13-2017 14:54:47; trwd=3;
2017-01-13 14:54:47 [7836] Counter type ServerStartup with 12 parameters: casd=47; cosd=47; dmsd=15; endTime=1-13-2017 14:54:46; lsesd=2075; plsd=5085; scsd=827; semsSessionId='4:636199160785047093'; sessionId=4; sssd=8627; startTime=1-13-2017 14:54:38; timestamp=1-13-2017 14:54:48;
2017-01-13 14:54:47 [8240] Counter type ApplicationLaunch with 9 parameters: CreateProcess=1-13-2017 14:54:47; IdleDetectedTime=1-13-2017 14:54:48; LaunchId=0; ProcessId=8032; ProcessPath='C:\wmiEx\WMIExplorer.exe'; PublishedApplicationName='wmiexplorer2'; semsSessionId='4:636199160785047093'; sessionId=4; timestamp=1-13-2017 14:54:48;
2017-01-13 14:56:40 [8240] Counter type IcaRoundtripResult with 6 parameters: inputBandwidthUsed=240; networkLatency=0; outputBandwidthUsed=10176; semsSessionId='4:636199160785047093'; sessionId=4; timestamp=1-13-2017 14:56:38;

 
If event ApplicationLaunch is present in SEMS_EVENT_TXT.txt upon application startup, it is very likely that there is no issue with the application launch collection and we can assume that the event will be recorded as it should in the local Firebird database and later in the SQL database.

If event ApplicationLaunch is not present in SEMS_EVENT_TXT.txt upon application startup, CDF tracing should be setup. See instructions below:

Failure to collect the published application launch events at the EUEM level might fall into the following scenario:

1 - EUEM fails to collect the events at a certain point, and until the EUEM service is restarted (This is the most likely scenario)

This suggests a unique unrecoverable exception occurred, causing a thread to terminate.
Troubleshooting method: A multiple sequential CDF trace should be started after EUEM startup and run continuously until the failure is observed. SEMS_EVENT_TXT.txt is the log to be consulted to find out whether the issue is present or not. The issue is present when the ApplicationLaunch event is not generated when starting a published application.
CDF modules to trace:

- MF_Service_SEMS- MF_Session_EuemApp
- MF_Session_Wfshell
- MF_Driver_RMPNDrv

2 - EUEM consistently fails to collect the launch events even after startup

Troubleshooting method: A CDF trace should be captured when manually starting the EUEM service. If nothing stands out during initialization, trace should be captured while starting a published application on the affected XenApp server.
CDF modules to trace:

- MF_Service_SEMS
- MF_Service_SEMSComPlugin
- MF_Session_EuemApp

3 - EUEM randomly fails to collect the events (This is the least likely scenario)

Troubleshooting method: A CDF trace should be captured while starting the published application on the affected XenApp server.
CDF modules to trace:

- MF_Service_SEMS
- MF_Service_SEMSComPlugin
- MF_Session_EuemApp

Caution! Using Registry Editor incorrectly can cause serious problems that might require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. Be sure to back up the registry before you edit it.

Troubleshooting Published application launch event collection failures.