Citrix ADM, formerly NetScaler MAS
Transparent Mode
LAN user mode
Single Hop Gateway mode
Double hop Gateway mode
This article covers various diagnosis and troubleshoot tips for these modes.
Test connectivity - Before configuring HDX Insight, ensure that you existing XenApp/XenDesktop solutions (Application/ desktop launches and functionality) works. Ensure that the required ports are open for the solution to work. Citrix Documentation - Before You Begin.
Configuration - Creating AppFlow collector action and policy is common for all modes of operation.
add appflow collector af_collector_1.2.3.4 -IPAddress 1.2.3.4
add appflow action af_action_VPN_1.2.3.4 -collectors af_collector_1.2.3.4
add appflow policy af_policy_VPN_1.2.3.4 true af_action_LB_1.2.3.4
For Transparent or Lan User Deployment Type you will have to bind the policy to AppFlow global bindpoint and set icaports in ns parm setting.
set ns param -icaPorts 1494 2598
bind appflow global af_policy_VPN_1.2.3.4 1 END -type ICA_REQ_DEFAULT
For Single Hop Deployment Type, you can bind the policy either globally or to the VPN vserver
bind vpn vserver _XD_GW -policy global af_policy_VPN_1.2.3.4 1 -priority 254 -gotoPriorityExpression END -type ICA_REQUEST
bind appflow global af_policy_VPN_1.2.3.4 1 END -type ICA_REQ_DEFAULT
For Double Hop Deployment Type, you can bind the policy either globally or to the VPN vserver.
Note: One of the hop should have only otherTcp Bindpoint while the other hop ICA_Request/ICA_Request_Default/ICA_Request_Override
bind vpn vserver _XD_GW1 -policy global af_policy_VPN_1.2.3.4 1 - priority 254 -gotoPriorityExpression END -type ICA_REQUEST
bind vpn vserver _XD_GW2 -policy global af_policy_VPN_1.2.3.4 1 - priority 254 -gotoPriorityExpression END -type OTHERTCP_REQUEST
bind appflow global af_policy_VPN_1.2.3.4 1 END -type ICA_REQ_DEFAULT
bind appflow global af_policy_VPN_1.2.3.4 1 END -type OTHERTCP_REQ_DEFAULT
After the requirements for configuring the HDX Insight solution are met and the Insight Center is configured, if the status / reports of the ICA session is not available on the Insight center dashboard, check for following error messages.
On NetScaler appliance, type the following command at the shell prompt:
# cat /var/log/ns.log
Error Log Message | Possible Cause | Solution |
Skipped parsing ICA connection - HDX Insight not supported for this host Log message example : ICA Message 10973207 0 : "Skipped parsing ICA connection - HDX Insight not supported for this host" Jun 23 17:20:42 : ICA Message 10973208 0 : "Skipping ICA flow: Session GUID [Undefined], Session setup time [Undefined], Client Type [0x0000], User [Undefined], Server [Undefined,192.168.48.205], Ctx Flags [0x1000000], Track Flags [0x81000000], " | Seen for Unsupported XenApp/XenDesktop versions | Upgrade the XenApp/XenDesktop servers to a supported version. |
Skipped parsing ICA – Client Receiver not supported Log message example ICA Message 120881 0 : "Client type received 0x53, NOT SUPPORTED" | Unsupported version of Receiver or Receiver type | Check for supported Receivers as per the ADM release version: https://docs.citrix.com/en-us/citrix-application-delivery-management-software.html |
Skipped parsing ICA – Expander errors Log message example ICA Message 412079 0 : "Expander error: Bytes consumed 101 more than bytes available 37” "Error from Expand Packet - Skipping all hdx processing for this flow " | Issue with uncompressing ICA traffic | No reports will be available for this particular ICA session until a new session. |
Invalid transition – Parsing error log message example "Invalid transition: NS_ICA_ST_FLOW_INIT/NS_ICA_EVT _INVALID -> NS_ICA_ST_UNINIT" | Issue with parsing the ICA handshake | No reports will be available for this particular ICA session until a new session. |
End User Experience Monitoring channel not available Log message example ICA Message 7049 0 : "Missing EUEM ICA RTT: Session GUID [c2bd539d48ea4641b8817901b27ea c19], MSI Client Cookie [Non- MSI],Session setup time [04/22/2016:11:47:40 GMT], Client Type [0x0001], User [ravig], Client [103.14.252.249], Server [FTL-RDS- CO43-08], Ctx Flags [0x220029], Track Flags [0x90d0db7c], Skip Code [0]" | Unable to parse End User Experience Monitoring channel data | Ensure End User Experience Monitoring service in started on the XenApp/XenDesktop servers. Ensure you are using supported Receivers. |
Invalid Channel header Log message example "Invalid Channel Header : Session GUID [7eea6182821545758348474a32f2dd 40], MSI Client Cookie [Non- MSI],Session setup time [03/22/2016:14:29:27 GMT], Client Type [0x0052], User [ravig], Client [106.51.21.79], Server [SC-RDS-BE24- 15], Ctx Flags [0x3bcf2d], Track Flags [0x9090dfff], Skip Code [0]" | Unable to identify channel header | No reports will be available for this particular ICA session until a new session. |
There are various counters with respect to ICA parsing is captured. The description of these counters are shown below:
# nsconmsg –g hdx –d statswt0
HDX Counter Name | Purpose | Category(Stats/Error/Diagn ostics) |
hdx_tot_ica_conn | Indicates total number of Pure ICA connections detected by NS. Incremented whenever an ICA connection based on the ICA signature on a client PCB is detected. | Stats |
hdx_tot_cgp_conn | Indicates total number of CGP connections detected by NS (Session Reliability ON). Incremented whenever a CGP connection based on the CGP signature on a client PCB is detected. | Stats |
hdx_tot_skip_conn | Indicates how many ICA connections were skipped by parser due to invalid ICA or CGP signature. | Stats |
hdx_dbg_active_conn | Total Active CGP/ICA connections at that instant. | Stats |
hdx_dbg_skip_appflow_disabled | Total number of instances where appflow was detached from a session because of disabling appflow | Stats/Diagnostics |
hdx_dbg_transparent_user | Total number of transparent user access | Stats/Diagnostics |
hdx_dbg_ag_user | Total number of Access Gateway user access | Stats/Diagnostics |
hdx_dbg_lan_user | Total number of Lan user mode access | Stats/Diagnostics |
hdx_basic_enc | Indicates how many ICA connections are using Basic encryption | Stats/Diagnostics |
hdx_advanced_enc | Indicates how many ICA connections are using Advanced RC5 based encryption | Stats/Diagnostics |
dx_dbg_wanscaler_on_clientside | Total number of CGP/ICA connections having WanScaler on Clientside | Stats/Diagnostics |
hdx_dbg_wanscaler_on_serverside | Total number of CGP/ICA connections having WanScaler Serverside | Stats/Diagnostics |
hdx_dbg_reconnected_session | Total number of reconnect requests from client without any NS error | Stats/Diagnostics |
hdx_dbg_host_rejected_ns_reconnect | Total number of host rejected reconnect requests by client | Stats/Diagnostics |
hdx_euem_available | Indicates how many connections have the End User Experience Monitoring channel available. End User Experience Monitoring channel is required to collect statistics such as ICA RTT. | Stats/Diagnostics |
hdx_err_disabled_sr | Session Reliability is disabled using nsapimgr knob. Session Reliability will not work for this session. | Error |
hdx_err_skip_no_msi | XA/XD Server is Missing MSI Capability, this indicates an old server version, HDX Insight will skip this connection. | Error |
hdx_err_skip_old_server | Old unsupported server version | Error |
hdx_err_clnt_not_whitelist | Client receiver not in whitelist, HDX Insight will skip this connection | Error |
hdx_sm_ica_cam_channel_disabled | Total number of NS_ICA_CAM_CHANNEL disabled via smartaccess policy | Diagnostics |
hdx_sm_ica_usb_channel_disabled | Total number of NS_ICA_USB_CHANNEL disabled via smartaccess policy | Diagnostics |
hdx_sm_ica_clip_channel_disabled | Total number of NS_ICA_CLIP_CHANNEL is disabled via smartaccess policy | Diagnostics |
hdx_sm_ica_ccm_channel_disabled | Total number of NS_ICA_CCM_CHANNEL is disabled via smartaccess policy | Diagnostics |
hdx_sm_ica_cdm_channel_disabled | Total number of NS_ICA_CDM_CHANNEL is disabled via smartaccess policy | Diagnostics |
hdx_sm_ica_com1_channel_disabled | Total number of NS_ICA_COM1_CHANNEL is disabled via smartaccess policy | Diagnostics |
hdx_sm_ica_com2_channel_disabled | Total number of NS_ICA_COM2_CHANNEL is disabled via smartaccess policy | Diagnostics |
hdx_sm_ica_cpm_channel_disabled | Total number of NS_ICA_CPM_CHANNEL is disabled via smartaccess policy | Diagnostics |
hdx_sm_ica_lpt1_channel_disabled | Total number of NS_ICA_LPT1_CHANNEL is disabled via smartaccess policy | Diagnostics |
hdx_sm_ica_lpt2_channel_disabled | Total number of NS_ICA_LPT2_CHANNEL is disabled via smartaccess policy | Diagnostics |
dx_dbg_sm_ica_msi_disabled | Total number of cases where MSI is disabled is smartaccess policy | Diagnostics |
hdx_sm_ica_file_channel_disabled | Total number of NS_ICA_FILE_CHANNEL is disabled via smartaccess policy | Diagnostics |
hdx_dbg_usb_accept_device | Total number of USB Accept Device | Diagnostics |
hdx_dbg_usb_reject_device | Total number of USB Reject Device | Diagnostics |
hdx_dbg_usb_reset_endpoint | Total number of USB Reset Endpoint | Diagnostics |
hdx_dbg_usb_reset_device | Total number of USB Reset Device | Diagnostics |
hdx_dbg_usb_stop_device | Total number of USB Stop Device | Diagnostics |
hdx_dbg_usb_stop_device_response | Total number of USB Stop Device Response | Diagnostics |
hdx_dbg_usb_device_gone | Total number of USB Device Gone | Diagnostics |
hdx_dbg_usb_device_stopped | Total number of USB Device Stopped | Diagnostics |
Make sure that you have the following items checked before contacting Citrix Technical Support.
Check Appflow config thoroughly.