Hotfix package name: ES530VDAAgentWX64005.zip
For: EdgeSight for Virtual Desktops Agents, Version 5.3, running on 64-bit editions of one of the following operating systems, with or without EdgeSight software being previously installed:

• Windows XP
• Windows Vista
• Windows 2003
• Windows 2008
• Windows 2008 R2
• Windows 7

Readme Revision History

Important Note(s)

Caution! This release may require you to edit the registry. Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

Where to Find Documentation

This document describes the issue(s) resolved by this release and includes installation instructions. For additional product information, see Citrix eDocs,the Citrix Product Documentation Library.

New Fixes in This Release

1. When starting the EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring) after launching a session on a client device, the session display might become unresponsive.

   [From ES530VDAAgentWX64005][#LA4032]

2. For agents running on PVS provisioned XenApp servers, the Device Reboot alert can fail due to non-persistent storage locations of the Windows System Event log. To enable this fix, the Window System Event log must be written to persistent storage.

   Important: Along with installing this fix, you must set up the Windows System Event log of each provisioned XenApp server in a permanent storage location.

   [From ES530VDAAgentWX64005][#LA4124]

3. When configuring EdgeSight alerts with the poll interval set to 270 seconds, the first two alerts might occur every 270 seconds but subsequent alerts occur every 360 seconds.

   [From ES530VDAAgentWX64005][#LA4339]

4. Time changes in the Virtual Desktop Agent causes errors in the EdgeSight Agent payload processing.

   [From ES530VDAAgentWX64005][#LA4593]

5. This fix addresses a non-paged pool memory issue that occurs when EdgeSight falls behind in processing the collection of Windows event logs. This fix introduces support for the following registry key, which allows you to completely turn off the collection of Windows event logs. One consequence of turning off the collection of Windows event logs is that EdgeSight alert rules that are based on event IDs will not work. After installing this fix but before using this method, create an Agent property to suppress security event logging (and if necessary also to reduce or suppress system/application event logging).

   To enable the fix, set the following registry key:

   HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\System Monitoring\Agent\Core\4.00
   Name: DisableEventLogging
   Type: REG_DWORD
   Value: 1 (disable); 0 (reenable)

   [From ES530VDAAgentWX64005][#LA5284]

6. If EdgeSight is disabled by using the UI setting, starting the application can cause an infinite load or unload loop. This can slow the process start time because the CPU consumption is high.

   [From ES530VDAAgentWX64005][#LA5461]

7. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring) might exit unexpectedly if the partition has a corrupt transaction.

   [From ES530VDAAgentWX64005][#LA5760]

8. This feature enhancement updates the SQL API in EdgeSight from Version 3.x to Version 4.1.3 and improves stability while accessing the database.

   [From ES530VDAAgentWX64005][#LC0154]

9. After restarting the VDA, the EdgeSight Agent for VDA might encounter the Firebird Database error "Failed to initialize Virtual Desktop ICA channel performance counters." The error appears in the log SYS_EVENT_TXT.

   [From ES530VDAAgentWX64005][#LC0731]

Fixes from Replaced Hotfixes

1. When an EdgeSight Agent upgrade is performed using the MSIEXEC command line, some registry values may be corrupted and the System Monitoring Service will not start.

   [From ES530VDAAgentWX64002][#234109]

2. If the scheduled job for daily data deletion and the database maintenance worker run at the same time, the EdgeSight Agent hangs and is restarted.

   [From ES530VDAAgentWX64002][#239632]

3. Large amounts of data were generated when monitoring Windows Event Log alerts. Event log alert data can be throttled using registry keys located at HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\4.00. There is one registry key per event log (System, Application, and Security). The registry key type is DWORD.

   • MaxSysEventLogThreshold
   • MaxAppEventLogThreshold
   • MaxSecEventLogThreshold

   Specify a value to indicate the maximum number of event log messages allowed per 10 minute window. Event log alerts can be throttled to zero. Any missing value will be considered as unlimited, meaning that no throttling will be applied to alerts for the corresponding event log.

   This feature is only included in EdgeSight 5.3. In future releases, the registry key will be ignored and an equivalent function will be available from the EdgeSight Server console.

   [From ES530VDAAgentWX64002][#240693]

4. The XenApp server was slow to restart or logoff after upgrading the HP System Management Homepage to version 6.1.0.102.

   [From ES530VDAAgentWX64002][#241240]

5. Thread Hang Detection is tripped repeatedly resulting in an error messages ("The queue thread has stopped responding" or "The Scheduler thread has stopped responding") and a restart of the EdgeSight agent.

   [From ES530VDAAgentWX64002][#242581]

6. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) is terminated unexpectedly.

   [From ES530VDAAgentWX64002][#245683]

7. The EdgeSight Agent service (rscorsvc.exe) experiences memory leaks.

   [From ES530VDAAgentWX64002][#245749]

8. Session Performance alerts are not generated when the poll interval selected is 360 seconds.

   [From ES530VDAAgentWX64003][#234266]

9. The EdgeSight Agent can exit unexpectedly with the following error:

   "The application attempted to release a resource it did not own, ntdll!RtlpNotOwnerCriticalSection+0xac invoked by SemsCollector (SemsPerf, SessionDef)."

   [From ES530VDAAgentWX64003][#242578]

10. Version 5.3 (or 5.3, Build 4109) of the EdgeSight Agent can exit unexpectedly with the following error: "INVALID_POINTER_READ_c0000005_es_ext.dll!CProcessCounterSet::IterThreads."

    [From ES530VDAAgentWX64003][#242580]

11. Published application information is not collected when the application is launched from a script, for example a file with .cmd extension. This fix is dependent on the installation of hotfix EUEM100W001, which addresses the underlying EUEM issue for Windows Server 2003 32-bit and 64-bit systems.

    [From ES530VDAAgentWX64003][#244070]

12. When launching certain applications, a C++ Runtime Initialization Error may occur which prevents the application from launching.

    This is caused by processes that dynamically link to the same runtime components of Visual C++ libraries as the EdgeSight Agent. In order to avoid this problem, the conflicting processes need to be excluded from EdgeSight monitoring by using the registry keys listed below.

    By default all processes are monitored.

    To exclude specific processes:

    1. Add a list of processes to be excluded from being monitored by EdgeSight (separate the processes by a semi-colon) to the UviProcessList registry key.
    2. Set the UviProcessIsExcluded registry key to 1 to exclude the processes in the list:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rskcore
    Name: UviProcessList
    Type: REG_SZ
    Data: <semi-colon separated list of processes to exclude>

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rskcore
    Name: UviProcessIsExcluded
    Type: REG_DWORD
    Data: 1 (to exclude the listed processes from being monitored, this is set to 1 by default)

    This enhancement extends the agent’s functionality by providing the option to monitor only specific processes and exclude all others.

    To monitor only specific processes:

    1. Add a list of processes to be monitored by EdgeSight (separate the processes by a semi-colon; do not include any leading spaces in process names) to the UviProcessList registry key.
    2. Set the UviProcessIsExcluded registry key to 0 to include the processes in the list:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rskcore
    Name: UviProcessList
    Type: REG_SZ
    Data: <semi-colon separated list of processes to monitor>

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rskcore
    Name: UviProcessIsExcluded
    Type: REG_DWORD
    Data: 0 (to include the listed processes to be monitored)

    Note:

    Applying this fix deprecates the following registry key. During the upgrade its values are migrated to the new UviProcessIsExcluded key:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rskcore\UviProcessExcludes

    [From ES530VDAAgentWX64003][#248309]

13. The EdgeSight Agent can exit unexpectedly.

    [From ES530VDAAgentWX64003][#254596]

14. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) can exit unexpectedly, causing sessions running on XenApp servers to be disconnected at random several times a day. The following error message appears:

    "The Citrix System Monitoring Agent service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service."

    [From ES530VDAAgentWX64003][#259762]

15. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) can restart unexpectedly due to a defect in the ZCollect!ProcessTracker::PersistUsage module. The restart generates a rscorsvc.exe.dmp file.

    [From ES530VDAAgentWX64003][#LA0207]

16. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) can restart unexpectedly due to a defect in the QRThread (thread#4 ZCollect!QThread::FindPrincipal called by winsta!RpcWinStationGetAllProcesses_NT6). The restart generates a rscorsvc.exe.hang.dmp file.

    [From ES530VDAAgentWX64003][#LA0208]

17. This fix addresses several instances where the EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) can restart unexpectedly due to a defect in the ZCollect!ProcessTracker::Find module. The restart generates a rscorsvc.exe.dmp file.

    [From ES530VDAAgentWX64003][#LA0245]

18. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) can restart unexpectedly or can appear to be non-functional while writing to the rscorsvc.exe.hang.dmp file due to a defect in the ZCollect module. The restart generates a rscorsvc.exe.hang.dmp file.

    Another symptom might be that the EdgeSight Agent stops working (the time when the last entry was made in SYS_EVENT_TXT.txt exceeds one hour) and a rscorsvc.exe.hang.dmp file with zero bytes is created.

    [From ES530VDAAgentWX64003][#LA0355]

19. EdgeSight's asset worker invokes a WMI query to the win32_Product class. The query invokes a consistency check on each installed MSI package. The consistency check generates a Windows Application Event log entry for each installed MSI package that passes the test, stating "Windows Installer reconfigured the product. Product Name: <name>." As a result, Windows Event logs are being populated with unnecessary events.

    After applying this fix, EdgeSight no longer performs the WMI query and the unnecessary log entries are no longer generated.

    [From ES530VDAAgentWX64003][#LA0387]

20. Several processes, including explorer.exe, iexplore.exe, and cnthelp.exe, running on servers with the EdgeSight Agent installed can exit unexpectedly. The dump of a process shows that the EdgeSight RSIntCor module exited when trying to get version information (RSCorInt!ModInfo::getVersionInfo) for the program module.

    [From ES530VDAAgentWX64003][#LA0769]

21. A generic rscorsvc.exe.dmp file is created for the EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) for a variety of reasons.

    [From ES530VDAAgentWX64003][#LA0921]

22. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) can exit and then restart intermittently.

    [From ES530VDAAgentWX64003][#LA1289]

23. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) can restart unexpectedly with the following message in the sys_event-txt.txt file: "queue thread has stopped responding."

    A few thread activities might exceed the allowed fixed time (300 seconds) for processing, and the restart generates a rscorsvc.exe.hang.dmp file.

    This fix lets you modify the allowed fixed time beyond 300 seconds. To enable it, you must create the following registry key:

    On 32-bit Windows:

    HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\System Monitoring\Agent\Core\4.00
    Name: MaxQueuedSecs
    Type: REG_DWORD
    Data: <A value of 0x12c (300 seconds) to 0x384 (900 seconds); lower or higher data values are replaced (in code) by 300 and 900>

    On 64-bit Windows:

    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\System Monitoring\Agent\Core\4.00
    Name: MaxQueuedSecs
    Type: REG_DWORD
    Data: <A value of 0x12c (300 seconds) to 0x384 (900 seconds); lower or higher data values are replaced (in code) by 300 and 900>

    [From ES530VDAAgentWX64003][#LA1478]

24. Real-time alerts that are configured for CPU times might fail when the polling interval exceeds 10 minutes.

    [From ES530VDAAgentWX64003][#LA1706]

25. The EdgeSight Agent Service (rscorsvc.exe) can experience memory leaks.

    [From ES530VDAAgentWX64003][#LA1796]

26. The ICA Session Round Trip time might be missing from the EdgeSight report. The issue occurs when the error in the sys-event_txt.txt of the agent occurs repeatedly due to a numeric overflow, arithmetic exception, or a string truncation while consolidating the ICA Session Round Trip data of the EdgeSight Agent.

    [From ES530VDAAgentWX64003][#LA1998]

27. The EdgeSight Agent Service (rscorsvc.exe) can stop intermittently when trying to update the session protocol.

    [From ES530VDAAgentWX64003][#LA2190]

28. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring) can restart unexpectedly due to unnecessary counter lookups for disconnected sessions using Performance Data Helper. The restart generates a rscorsvc.exe.hang.dmp file.

    If analysis of the rscorsvc.exe.hang.dmp indicates that a thread is performing a PDHAddCounter lookup called "ctrx_ext!CFlexibleCounterSet::AddCounter," rebuild the Performance Monitoring (Perfmon) counters (for each agent device) by following the steps in Knowledge Center article http://support.microsoft.com/kb/300956.

    Note: Not all rscorsvc.exe.hang.dmp files result from unresponsive threads due to performance counter lookups. As a general rule of thumb, rebuilding the perfmon counters is a good way of addressing most issues logged in rscorsvc.exe.hang.dmp files.

    [From ES530VDAAgentWX64004][#LA1403]

29. If you change user names in Active Directory, the changes are not reflected in the EdgeSight database.

    To enable this fix, you must also install EdgeSight server-side Fix #LA1243 (ES540ServerWX86002; ES540ServerWX64002 or their replacements).

    [From ES530VDAAgentWX64004][#LA1506]

30. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) can exit and then restart intermittently. The following errors are recorded:

    Error in sys_event_txt.txt log:
    "unavailableDB"

    Error in Firebird.log:
    "XNET error: get_free_slot() failed� or “unknown ISC error 0"

    [From ES530VDAAgentWX64004][#LA1761]

31. The following error might be recorded in the sys_event_txt.txt log: "Unable to connect to database server RSDatr" and the administrator might be notified of a fatal database error. Also, an rscorsvc.exe.shutdown.dmp file might be created in the EdgeSight data folder. The issue usually occurs when there are connectivity issues with the Firebird Service. This fix lets you set the following registry key to configure a fault tolerance level for the number of database connectivity issues encountered before the error notifications are triggered:

    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\System Monitoring\Agent\Core\4.00
    Name: DatabaseMaxExceptionLevel
    Type: REG_DWORD
    Value: 2 (default) 3, 4, or 5 (Recommendation: Start with a value of 3)

    [From ES530VDAAgentWX64004][#LA2705]

32. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring) can restart unexpectedly due to processing of data while shutting down. The restart generates a rscorsvc.exe.shutdown.dmp file.

    [From ES530VDAAgentWX64004][#LA2958]

33. Inclusion or exclusion of processes with names that contain more than 15 characters does not work correctly.

    This fix allows using process names up to 31 characters in length.

    [From ES530VDAAgentWX64004][#LA2960]

34. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring) can restart due to a defect with connections to an unresponsive database. The restart generates a rscorsvc.exe.hang.dmp.

    [From ES530VDAAgentWX64004][#LA3077]

35. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring) can restart unexpectedly while purging inactive sessions. The restart generates a rscorsvc.exe.dmp file.

    [From ES530VDAAgentWX64004][#LA4125]

36. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) can exit unexpectedly while the system shuts down or restarts.

    [From ES530VDAAgentWX64004][#LA4130]

Installing This Release

Notes:

• This version is packaged as a .zip file containing the replacement EdgeSightVDAAgentx64.msi file. For more information about deploying msi files, see Microsoft article 884016 or visit the Microsoft Web site and search on keyword msiexec.
• To install this version successfully, servers must not have registry modification restrictions in place.

To install this version:

1. Copy the file to a shared folder on the network.
2. Extract the compressed file and save the EdgeSightVDAAgentx64.msi file on the computer you want to update.
3. Run the .msi file.
4. Restart the computer if prompted to do so.

If it does not exist already, this will add a new entry, Citrix EdgeSight for Virtual Desktops Agent 5.3 x64, to the Add/Remove Programs list.