uberAgent – CVAD Site Monitoring – Site information not available in Splunk

book

Article ID: CTX695463

calendar_today

Updated On:

Description

There are 2 Errors logged in the Event Viewer on the Delivery Controller (Event 1030, Citrix Configuration Service)

 

2 operations are not permitted:

  • System.UnauthorizedAccessException: Operation is not permitted GetSite
  • System.UnauthorizedAccessException: Operation is not permitted GetServiceStatus

 

uberAgent.log located in C:\Windows\Temp folder shows that GetSiteGeneralInformation failed.

2025-10-19 03:06:48.261 -0700, ERROR, DOMAIN, DDC-MACHINE$, 14732, GetSiteGeneralInformation, The script failed with the following error:
...
You do not have the required permissions to perform this operation.
: NotSpecified: (:)
[Write-Error], WriteErrorException
+ FullyQualifiedErrorId : Microsoft. PowerShell.Commands.WriteErrorException

 

CDF trace captured on the Delivery Controller (DelegatedAdminLog module) shows that Delegated Admin service cannot find the Admin with SID: S-1-5-18 (System account)

CheckOperationPermittedWithCache(): admin NOT found for S-1-5-18 sid

 

System account is listed as an Admin when you check Administrators node in Web Studio on the Delivery Controller:

 

You can check the list of Administrators from PowerShell using Get-AdminAdministrator cmdlet:

 

Cause

Administrator account has been created with a lower case ‘s’ in the SID.

Delegated Admin service use case sensitive string comparison and it expects all SIDs to have capital letters.

Resolution

Remove existing NT AUTHORITY\SYSTEM account from the list of Administrators in Web Studio.

image.png

Create a new Admin account and make sure the SID format is correct.

New-AdminAdministrator -Sid S-1-5-18 -Enabled $true 
Add-AdminRight -Role 0a05f0c6-0153-4852-a55a-989d6a95c0eb -Administrator S-1-5-18 -All 

Issue/Introduction

uberAgent has been installed and configured for Citrix Site Monitoring on the Delivery Controller.

Administrators are not able to see CVAD Site information in Splunk when they select any of the dashboards under SBC\VDI:

image.png

Additional Information

uberAgent documentation: 

https://docs.citrix.com/en-us/uberagent/7-4-1/uxm-features-configuration/citrix-site-monitoring.html