Citrix Provisioning Services - Slow Target Boot With Sentinel One Client

Citrix Provisioning Services - Slow Target Boot With Sentinel One Client

book

Article ID: CTX370621

calendar_today

Updated On:

Description

Provisioned Target Devices boot slow or initially boot ok in small batches but after a certain number of Devices are running Target performance continues to nose dive.

Target devices get stuck at a black screen or "found vDisk" early in the PXE boot process.

Target Devices show an uptick in the number of retries and typically steadily increase. 

A Target reboot does not resolve the behavior.
 

Environment

Citrix is not responsible for and does not endorse or accept any responsibility for the contents or your use of these third party Web sites. Citrix is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement by Citrix of the linked Web site. It is your responsibility to take precautions to ensure that whatever Web site you use is free of viruses or other harmful items.

Resolution

Allow the Sentinel One client to complete its Certificate Disk Scan in a read-write version of the vDisk.  The concept behind a disk certificate scan is to prepare certificate results for the agent in order to avoid calculating them during times where CPU and disk usage is high, for example during boot.  

How can you tell if the Sentinel One Certificate Security Scan has been completed?
From an elevated command line run:
Sentinelctl.exe read_fdcs_status

This will return one of the following values, anything other than 2 indicates scan in progress.
CreatingTaskRecords = 0
TaskRecordsCreated = 1
ScanCompleted = 2


Problem Cause

As Targets continue to boot the start of the cert disk scan causes a multiplying effect of Read IO requests to the PVS Server in question.  The increase in IO request can effectively slow down overall PVS Server performance resulting in what appears to look like a storage based IO delay.  In reality the delay is originally sourced from the Target Device need to fulfill the cert disk scan operation.  

Although this behavior is specific to Sentinel One based clients when a vDisk scan or mass definitions update is kicked off by other security and/or AV based clients, for example, Windows Defender, the same behavior can be expected.  

Additional Information

You can also log into the desktop of a newly booted Target Device and run Resource Monitor:
Sort by Disk>Reads

if SentinelAgentWorker.exe is consuming most of the disk this is a good indicator that the Target increase in Read IO has led to this condition.