HDX Insight Diagnostics and Troubleshooting Guide

HDX Insight Diagnostics and Troubleshooting Guide

book

Article ID: CTX215130

calendar_today

Updated On:

Description

Citrix ADM, formerly NetScaler MAS

Introduction

The following are the various modes of operation / deployment for HDX Insight:
  1. Transparent Mode
    User-added image

  2. LAN user mode
    User-added image

  3. Single Hop Gateway mode
    User-added image

  4. Double hop Gateway mode
    User-added image

This article covers various diagnosis and troubleshoot tips for these modes.

Prerequisites for Configuring HDX Insight

Before you begin configuring a HDX Insight solution, make sure that you complete the following tasks:
  • Choosing the right deployment type - Based on the existing XenApp/XenDesktop deployment choose one of the deployment modes.
    • If you have a standalone XenApp/XenDesktop deployment, Transparent Mode or Lan User Mode of deployment is recommended.
    • If you have an existing Gateway deployment, based on the type choose SingleHop or Double Hop Mode.
  • Test connectivity - Before configuring HDX Insight, ensure that you existing XenApp/XenDesktop solutions (Application/ desktop launches and functionality) works. Ensure that the required ports are open for the solution to work. Citrix Documentation - Before You Begin.

  • Configuration - Creating AppFlow collector action and policy is common for all modes of operation.
    add appflow collector af_collector_1.2.3.4 -IPAddress 1.2.3.4
    add appflow action af_action_VPN_1.2.3.4 -collectors af_collector_1.2.3.4
    add appflow policy af_policy_VPN_1.2.3.4 true af_action_LB_1.2.3.4

    For Transparent or Lan User Deployment Type you will have to bind the policy to AppFlow global bindpoint and set icaports in ns parm setting.
    set ns param -icaPorts 1494 2598
    bind appflow global af_policy_VPN_1.2.3.4 1 END -type ICA_REQ_DEFAULT

    For Single Hop Deployment Type, you can bind the policy either globally or to the VPN vserver
    bind vpn vserver _XD_GW -policy global af_policy_VPN_1.2.3.4 1 -priority 254 -gotoPriorityExpression END -type ICA_REQUEST
    bind appflow global af_policy_VPN_1.2.3.4 1 END -type ICA_REQ_DEFAULT

    For Double Hop Deployment Type, you can bind the policy either globally or to the VPN vserver.
    Note: One of the hop should have only otherTcp Bindpoint while the other hop ICA_Request/ICA_Request_Default/ICA_Request_Override
    bind vpn vserver _XD_GW1 -policy global af_policy_VPN_1.2.3.4 1 - priority 254 -gotoPriorityExpression END -type ICA_REQUEST
    bind vpn vserver _XD_GW2 -policy global af_policy_VPN_1.2.3.4 1 - priority 254 -gotoPriorityExpression END -type OTHERTCP_REQUEST
    bind appflow global af_policy_VPN_1.2.3.4 1 END -type ICA_REQ_DEFAULT
    bind appflow global af_policy_VPN_1.2.3.4 1 END -type OTHERTCP_REQ_DEFAULT

For more information refer to Citrix Documentation - Enabling HDX Insight Data Collection.

Troubleshooting

If your HDX Insight solution does not function properly, the issue could be with:
  • Configuration
    • Example: Globally Bound AppFlow policy with type ICA_REQ_OVERRIDE. This overrides all other ICA policy bindings and prevents ICA reporting to multiple Collectors.
    • Example: AppFlow Logging not enabled on the Vserver
  • Firewall blocking AppFlow port 4739
  • Supported Receiver/XenApp/XenDesktop server’s data traffic
  • Unsupported Receiver / XenApp/XenDesktop server.
If you are unsure which type of problem you have, look for an error message in the log file and see if the error message is in the list of HDX Insight issues. If you do not find your error message, check the list of possible issues related to Error counters.

Issues Related to ICA parsing

After the requirements for configuring the HDX Insight solution are met and the Insight Center is configured, if the status / reports of the ICA session is not available on the Insight center dashboard, check for following error messages.

On NetScaler appliance, type the following command at the shell prompt:
# cat /var/log/ns.log  

The following table lists some common errors and their solutions.
 
Error Log MessagePossible CauseSolution
Skipped parsing ICA connection - HDX Insight not supported for this host
 
Log message example
 
: ICA Message 10973207 0 :
"Skipped parsing ICA connection - HDX Insight not supported for this host"
Jun 23 17:20:42
 
: ICA Message 10973208 0 :
"Skipping ICA flow: Session GUID [Undefined], Session setup time [Undefined], Client Type [0x0000], User [Undefined], Server [Undefined,192.168.48.205],
Ctx Flags [0x1000000], Track Flags [0x81000000], "
Seen for Unsupported XenApp/XenDesktop versionsUpgrade the XenApp/XenDesktop servers to a supported version.
Skipped parsing ICA – Client Receiver not supported
 
Log message example
 
ICA Message 120881 0 : "Client type received 0x53, NOT SUPPORTED"
Unsupported version of Receiver or Receiver typeCheck for supported Receivers as per the ADM release version: 
https://docs.citrix.com/en-us/citrix-application-delivery-management-software.html
 
Skipped parsing ICA – Expander errors
 
Log message example
 
ICA Message 412079 0 : "Expander error: Bytes consumed 101 more than bytes available 37”
 
"Error from Expand Packet - Skipping all hdx processing for this flow "
Issue with uncompressing ICA trafficNo reports will be available for this particular ICA session until a new session.
Invalid transition – Parsing error
log message example
 
"Invalid transition: NS_ICA_ST_FLOW_INIT/NS_ICA_EVT
_INVALID -> NS_ICA_ST_UNINIT"
Issue with parsing the ICA handshakeNo reports will be available for this particular ICA session until a new session.
End User Experience Monitoring channel not available
 
Log message example
 
ICA Message 7049 0 :  "Missing EUEM ICA RTT: Session GUID [c2bd539d48ea4641b8817901b27ea c19], MSI Client Cookie [Non- MSI],Session setup time [04/22/2016:11:47:40 GMT], Client
Type [0x0001], User [ravig], Client [103.14.252.249], Server [FTL-RDS- CO43-08], Ctx Flags [0x220029],
Track Flags [0x90d0db7c], Skip Code [0]"
Unable to parse End User Experience Monitoring channel dataEnsure End User Experience Monitoring service in started on the XenApp/XenDesktop servers. Ensure you are using supported Receivers.
Invalid Channel header
 
Log message example
 
"Invalid Channel Header : Session GUID [7eea6182821545758348474a32f2dd
40], MSI Client Cookie [Non- MSI],Session setup time [03/22/2016:14:29:27 GMT], Client
Type [0x0052], User [ravig], Client [106.51.21.79], Server [SC-RDS-BE24-
15], Ctx Flags [0x3bcf2d], Track Flags [0x9090dfff], Skip Code [0]"
Unable to identify channel headerNo reports will be available for this particular ICA session until a new session.

Error Counter details

There are various counters with respect to ICA parsing is captured. The description of these counters are shown below:
# nsconmsg –g hdx –d statswt0

HDX Counter NamePurposeCategory(Stats/Error/Diagn ostics)
hdx_tot_ica_connIndicates total number of Pure ICA connections
detected
by NS. Incremented whenever an ICA connection based on the ICA signature on a client PCB is detected.
Stats
hdx_tot_cgp_connIndicates total number of CGP connections detected by NS (Session Reliability ON).
Incremented whenever a CGP connection based on the CGP signature on a client PCB is detected.
Stats
hdx_tot_skip_connIndicates how many ICA connections were skipped by parser due to invalid ICA or CGP signature.Stats
hdx_dbg_active_connTotal Active CGP/ICA connections at that instant.Stats
hdx_dbg_skip_appflow_disabledTotal number of instances where appflow was detached from a session because of disabling appflowStats/Diagnostics
hdx_dbg_transparent_userTotal number of transparent user accessStats/Diagnostics
hdx_dbg_ag_userTotal number of Access Gateway user accessStats/Diagnostics
hdx_dbg_lan_userTotal number of Lan user mode accessStats/Diagnostics
hdx_basic_encIndicates how many ICA connections are using Basic encryptionStats/Diagnostics
hdx_advanced_encIndicates how many ICA connections are using Advanced RC5 based encryptionStats/Diagnostics
dx_dbg_wanscaler_on_clientsideTotal number of CGP/ICA connections having WanScaler on ClientsideStats/Diagnostics
hdx_dbg_wanscaler_on_serversideTotal number of CGP/ICA connections having WanScaler ServersideStats/Diagnostics
hdx_dbg_reconnected_sessionTotal number of reconnect requests from client without any NS errorStats/Diagnostics
hdx_dbg_host_rejected_ns_reconnectTotal number of host rejected reconnect requests by clientStats/Diagnostics
hdx_euem_availableIndicates how many connections have the End User Experience Monitoring channel available. End User Experience Monitoring channel is required to collect statistics such as ICA RTT.Stats/Diagnostics
hdx_err_disabled_srSession Reliability is disabled using nsapimgr knob. Session Reliability will not work for this session.Error
hdx_err_skip_no_msiXA/XD Server is Missing MSI Capability, this indicates an old server version, HDX Insight will skip this connection.Error
hdx_err_skip_old_serverOld unsupported server versionError
hdx_err_clnt_not_whitelistClient receiver not in whitelist, HDX Insight will skip this connectionError
hdx_sm_ica_cam_channel_disabledTotal number of NS_ICA_CAM_CHANNEL
disabled
via smartaccess policy
Diagnostics
hdx_sm_ica_usb_channel_disabledTotal number of NS_ICA_USB_CHANNEL
disabled via smartaccess policy
Diagnostics
hdx_sm_ica_clip_channel_disabledTotal number of NS_ICA_CLIP_CHANNEL is
disabled via smartaccess policy
Diagnostics
hdx_sm_ica_ccm_channel_disabledTotal number of NS_ICA_CCM_CHANNEL is
disabled via smartaccess policy
Diagnostics
hdx_sm_ica_cdm_channel_disabledTotal number of NS_ICA_CDM_CHANNEL
is disabled via smartaccess policy
Diagnostics
hdx_sm_ica_com1_channel_disabledTotal number of NS_ICA_COM1_CHANNEL
is disabled via smartaccess policy
Diagnostics
hdx_sm_ica_com2_channel_disabledTotal number of NS_ICA_COM2_CHANNEL
is disabled via smartaccess policy
Diagnostics
hdx_sm_ica_cpm_channel_disabledTotal number of NS_ICA_CPM_CHANNEL is
disabled via smartaccess policy
Diagnostics
hdx_sm_ica_lpt1_channel_disabledTotal number of NS_ICA_LPT1_CHANNEL is
disabled via smartaccess policy
Diagnostics
hdx_sm_ica_lpt2_channel_disabledTotal number of NS_ICA_LPT2_CHANNEL is
disabled via smartaccess policy
Diagnostics
dx_dbg_sm_ica_msi_disabledTotal number of cases where MSI is disabled is smartaccess policyDiagnostics
hdx_sm_ica_file_channel_disabledTotal number of NS_ICA_FILE_CHANNEL is
disabled via smartaccess policy
Diagnostics
hdx_dbg_usb_accept_deviceTotal number of USB Accept DeviceDiagnostics
hdx_dbg_usb_reject_deviceTotal number of USB Reject DeviceDiagnostics
hdx_dbg_usb_reset_endpointTotal number of USB Reset EndpointDiagnostics
hdx_dbg_usb_reset_deviceTotal number of USB Reset DeviceDiagnostics
hdx_dbg_usb_stop_deviceTotal number of USB Stop DeviceDiagnostics
hdx_dbg_usb_stop_device_responseTotal number of USB Stop Device ResponseDiagnostics
hdx_dbg_usb_device_goneTotal number of USB Device GoneDiagnostics
hdx_dbg_usb_device_stoppedTotal number of USB Device StoppedDiagnostics

Checklist before Contacting Citrix Technical Support

Make sure that you have the following items checked before contacting Citrix Technical Support.

  • Check Appflow config thoroughly.

    • Is Appflow feature enabled?
    • How many AppFlow collectors are present?
    • What are the vservers which have AppFlow policies bound?
    • Classify based on vserver type.
    • Check for AppFlow logging enabled knob
      > sh vpn vserver <vserver_name>
    • Check for AppFlow hit counter on the respective AppFlow policy/action
    • Check nsconmsg counters for hdx search key
    • Check for resolution in the following troubleshooting tips at Citrix Documentation - Troubleshooting Tips.
    • If it is a crash grade issue:
      • Ensure ns_ica or nsica_ is present in the backtrace
      • Unbind the AppFlow policy from vservers one at time and observe for crashes rather than disabling AppFlow feature itself.
      • After above steps disable Appflow to confirm it to be an AppFlow/ HDX Insight issue

Information to collect before Contacting Citrix Technical support

For a speedy resolution, make sure that you have the following information before contacting Citrix Technical Support:
  • Details of the deployment and network topology.
  • XenApp/XenDesktop server versions
  • Client Receiver versions
  • Number of Active ICA sessions when the issue occurred.
  • Tech support bundle captured by typing the following command at the NetScaler command prompt:
    > show techsupport
  • If it is Insight center issue, do collect techsupport bundle for Insight Center as well
  • Packet traces captured on all NetScalers.
    To start a packet trace, type the following command at the NetScaler command prompt:
    > start nstrace-size 0
    To stop packet trace, type the following command at the NetScaler command prompt:
    > stop nstrace
  • Output of the following command typed at the NetScaler command prompt:
    > show arp

Known Issues

  • Some of the ICA sessions which has encountered parsing failures will not have any data reported. Parsing error specific counters are not captured as part of this article.

Issue/Introduction

HDX Insight Diagnostics and Troubleshooting Guide.

Additional Information