Citrix NetScaler (ADC) Metrics
Citrix NetScaler (ADC) monitoring requires its metrics to be enabled on at least one machine. See the documentation for details.
Appliance Inventory
uberAgent collects metrics like MAC address, model, and version for the primary as well as the secondary appliance.
Details
- Source type:
uberAgent:CitrixADC:ApplianceInventory - Used in dashboards: CitrixADC Inventory, Single CitrixADC Inventory
- Enabled through configuration setting:
CitrixADCInventory - Related configuration settings:
[CitrixADC_Config] - Supported platform: Windows
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Example |
|---|---|---|---|---|
| HostName | Appliance name. | String | CitrixADC1 | |
| Version | Firmware version. | String | NS12.0: Build 59.8.nc Date: Sep 12 2018 06:16:17 | |
| License | Installed license. | String | Platinum | |
| Model | Appliance model. | Number | 1000 | |
| LicensingMode | Configured licensing mode. Possible values: Local, Pooled, CICO. |
String | Local | |
| HwDescription | Hardware and its ports detail. | String | NetScaler Virtual Appliance. | |
| SysId | System id. | String | 450088 | |
| ManufactureDay | Day the appliance was manufactured. | Number | 17 | |
| ManufactureMonth | Month the appliance was manufactured. | Number | 2 | |
| ManufactureYear | Year the appliance was manufactured. | Number | 2009 | |
| CpuFrequncy | CPU frequency. | Number | 3890 | |
| SerialNo | Serial number. | Number | ABCDEFG12 | |
| EncodedSerialno | Encoded serial number. | String | 68310055cb267307ffg8 | |
| MACAddress | MAC address. | String | 00155d3d890d | |
| HostId | Host id. | String | 123456789 | |
| LastConfigSaveTime | Time when the configuration was last saved. | String | 2018-12-07 12:06:36 | |
| Timezone | Timezone. | String | GMT+01:00-CET-Europe/Berlin | |
| WeakPassword | List of all weak passwords. | String | password | |
| SystemType | System type. Possible Values: Standalone, HA, Cluster. |
String | HA | |
| LastConfigChangedTime | Time when the configuration was last changed. | String | 2018-12-07 12:06:21 | |
| LastStartupTime | Time when the appliance was last started. | String | 2018-11-24 15:26:25 | |
| CurrentHAStatus | Indicates the high availability state of the node. Possible values: Staysecondary, Primary, Secondary, Claiming, Force change. |
String | Primary | |
| LastHAStatusChange | Time when the last master state transition occurred. | String | 2018-12-04 10:34:51 | |
| SSLCards2 | Number of available SSL cards. | Number | 0 | |
| SSLCardsUp2 | Number of working SSL cards. | Number | 0 |
List of Calculated Fields
| Field | Description | Data type | Unit | Example | Where available |
|---|---|---|---|---|---|
| SSLCards | Number of available SSL cards. | Number | 0 | Splunk data model | |
| SSLCardsUp | Number of working SSL cards. | Number | 0 | Splunk data model |
Appliance Performance
uberAgent collects metrics like CPU usage, RAM usage as well as network throughput for the primary appliance.
Details
- Source type:
uberAgent:CitrixADC:AppliancePerformance - Used in dashboards: CitrixADC Appliance Performance
- Enabled through configuration setting:
CitrixADCPerformance - Related configuration settings:
[CitrixADC_Config] - Supported platform: Windows
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Example |
|---|---|---|---|---|
| HostName | Appliance name. | String | CitrixADC1 | |
| MemUsagePcnt | Memory usage. | Number | % | 17.62 |
| MgmtCpuUsagePcnt | Management CPU usage. | Number | % | 14.6 |
| PktCpuUsagePcnt | Packet CPU usage. | Number | % | 3 |
| Disk0PerUsage | /flash disk usage. | Number | % | 41 |
| Disk0Size | /flash disk size. | Number | MB | 1585 |
| Disk0Used | /flash disk allocated space. | Number | MB | 598 |
| Disk0Avail | /flash disk free space. | Number | MB | 860 |
| Disk1PerUsage | /var disk usage. | Number | % | 45 |
| Disk1Size | /var disk size. | Number | MB | 14179 |
| Disk1Used | /var disk allocated space. | Number | MB | 5988 |
| Disk1Avail | /var disk free space. | Number | MB | 7056 |
| ApplianceBytesReceived | Amount of incoming network data. | Number | Bytes | 608359 |
| ApplianceBytesSent | Amount of outgoing network data. | Number | Bytes | 616856 |
| NumCpus2 | Number of CPUs. | Number | 3 | |
| MemSizeMB2 | Memory size. | Number | MB | 8096 |
| MemUseInMB2 | Memory usage. | Number | MB | 196 |
| CpuFan0Speed | CPU fan 0 speed. Acceptable range is 3000 through 6000 RPM. | Number | 5000 | |
| CpuFan1Speed | CPU fan 1 speed. Acceptable range is 3000 through 6000 RPM. | Number | 5000 | |
| SystemFanSpeed | System fan speed. Acceptable range is 3000 through 6000 RPM. | Number | 5000 | |
| Cpu0Temp | CPU 0 temperature. | Number | 80 | |
| Cpu1Temp | CPU 1 temperature. | Number | 80 | |
| InternalTemp | Internal temperature of health monitoring chip. | Number | 80 | |
| PowerSupply1Status | Power supply 1 failure status. Can be 0, 1, 2, 3, or 4. See also PowerSupply1StatusDisplayName. |
Number | 1 | |
| PowerSupply2Status | Power supply 2 failure status. Can be 0, 1, 2, 3, or 4. See also PowerSupply2StatusDisplayName. |
Number | 1 | |
| PowerSupply3Status | Power supply 3 failure status. Can be 0, 1, 2, 3, or 4. See also PowerSupply3StatusDisplayName. |
Number | 1 | |
| PowerSupply4Status | Power supply 4 failure status. Can be 0, 1, 2, 3, or 4. See also PowerSupply4StatusDisplayName. |
Number | 1 | |
| VoltageV33Main | Main power supply +3.3V output. Acceptable range is 2.970 through 3.630 volts. | Number | 3.630 | |
| ICAOnlySessions | Number of ICA sessions. | Number | 45 | |
| ICAOnlyConnections | Number of ICA connections. | Number | 45 | |
| SmartAccessSessions | Number of VPN sessions. | Number | 45 | |
| SmartAccessICAConnections | Number of VPN ICA connections. | Number | 45 | |
| SSLSessions | Number of SSL sessions. | Number | 400 |
List of Calculated Fields
| Field | Description | Data type | Unit | Example | Where available |
|---|---|---|---|---|---|
| ApplianceMBReceived | Amount of incoming network data. The field is deprecated and will be removed in a future release. Use ApplianceMbpsReceived instead.
|
Number | MB | 594.100 | Splunk data model | ApplianceMbpsReceived | Amount of incoming network data. | Number | Mbps | 594.100 | Splunk data model |
| ApplianceMBSent | Amount of outgoing network data. The field is deprecated and will be removed in a future release. Use ApplianceMbpsSent instead. |
Number | MB | 602.39 | Splunk data model |
| ApplianceMbpsSent | Amount of outgoing network data. | Number | Mbps | 602.39 | Splunk data model |
| NumCpus | Number of CPUs. | Number | 3 | Splunk data model | |
| MemSizeMB | Memory size. | Number | MB | 8096 | Splunk data model |
| MemUseInMB | Memory usage. | Number | MB | 196 | Splunk data model |
| PowerSupply1StatusDisplayName | Power supply 1 failure status. Can be Unknown, Normal, Failed, Not present, or Not supported. Based on the lookup file citrixadc_powersupplystatus.csv. |
Number | Normal | Splunk data model, Splunk SPL | |
| PowerSupply2StatusDisplayName | Power supply 2 failure status. Can be Unknown, Normal, Failed, Not present, or Not supported. Based on the lookup file citrixadc_powersupplystatus.csv. |
Number | Normal | Splunk data model, Splunk SPL | |
| PowerSupply3StatusDisplayName | Power supply 3 failure status. Can be Unknown, Normal, Failed, Not present, or Not supported. Based on the lookup file citrixadc_powersupplystatus.csv. |
Number | Normal | Splunk data model, Splunk SPL | |
| PowerSupply4StatusDisplayName | Power supply 4 failure status. Can be Unknown, Normal, Failed, Not present, or Not supported. Based on the lookup file citrixadc_powersupplystatus.csv. |
Number | Normal | Splunk data model, Splunk SPL |
Certificates
uberAgent collects certificate metrics like name, type, and expiration date for the primary as well as the secondary appliance.
Details
- Source type:
uberAgent:CitrixADC:Certificate - Used in dashboards: Single CitrixADC Inventory
- Enabled through configuration setting:
CitrixADCInventory - Related configuration settings:
[CitrixADC_Config] - Supported platform: Windows
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Example |
|---|---|---|---|---|
| HostName | Appliance name. | String | CitrixADC1 | |
| CertName | Certificate name. | String | nsmgmtcer | |
| CertFile | Certificate file. | String | nsmgmt.cer | |
| CertType | Certificate type. Possible values: Client, Server, Client;Server, Root, Intermediate. |
String | Client;Server | |
| CertExpirationDate | Certificate expiration date. | String | 2020-11-22 11:06:46 |
Gateways
uberAgent collects gateway metrics like network throughput and SSL as well as authentication policies for the primary appliance.
Details
- Source type:
uberAgent:CitrixADC:Gateway - Used in dashboards: Citrix ADC Gateway Performance, Single CitrixADC Inventory
- Enabled through configuration setting:
CitrixADCGateway - Related configuration settings:
[CitrixADC_Config] - Supported platform: Windows
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Example |
|---|---|---|---|---|
| HostName | Appliance name. | String | CitrixADC1 | |
| vServerName | Gateway name. | String | _XD_10.1.1.22_443 | |
| PrimaryIpAddress | IP address. | IPv4 | 10.1.1.22 | |
| PrimaryPort | Port. | Number | 443 | |
| Type | vServer type. Possible values: SSL. |
String | SSL | |
| State | vServer state. | String | Up | |
| RequestBytesRate | Incoming network traffic. | Number | Bytes | 1024 |
| ResponseBytesRate | Outgoing network traffic. | Number | Bytes | 1024 |
| AuthLDAPPolicies | Bound LDAP authentication policies. | String | pol_ldap1;pol_ldap2 | |
| AuthRadiusPolicies | Bound Radius authentication policies. | String | pol_radius1;pol_radius2 | |
| AuthSAMLPolicies | Bound SAML authentication policies. | String | pol_saml1 | |
| SessionPolicies | Bound session policies. | String | sp_storefront | |
| STAs | Secure ticket authorities. | String | http://DDC.vastlimits.com | |
| ResponderPolicies | Bound responder policies. | String | rp_storefront | |
| RewritePolicies | Bound rewrite policies. | String | rw_clientname | |
| Certificates | Bound certificates. | String | wildcard.vastlimits.com | |
| PortalTheme | Bound portal theme. | String | Default | |
| SSL2* | Indicates if SSL2 is enabled. | String | 0 | |
| SSL3* | Indicates if SSL3 is enabled. | String | 0 | |
| TLS1* | Indicates if TLS1 is enabled. | String | 0 | |
| TLS11* | Indicates if TLS1.1 is enabled. | String | 0 | |
| TLS12* | Indicates if TLS1.2 is enabled. | String | 1 | |
| DiffeHellman* | Indicates if Diffie-Hellman is enabled. | String | 1 | |
| SSLProfile | Name of the bound SSL profile. | String | ns_default_ssl_profile_frontend | |
| Ciphers* | Bound ciphers. | String | DEFAULT | |
| CipherSuites* | Bound cipher suites. | String | DEFAULT | |
| TotalRequests2 | Total number of requests received. | Number | 456789 | |
| TotalResponses2 | Total number of responses. | Number | 456789 | |
| SessionTimeout2* | Session timeout. | Number | 120 | |
| HSTS | State of HSTS protocol support for the SSL Virtual Server. Using HSTS, a server can enforce the use of an HTTPS connection for all communication with a client. Can be Enabled or Disabled. |
String | Disabled | |
| HSTSMaxAge | The maximum time, in seconds, in the strict transport security (STS) header during which the client must send only HTTPS requests to the server. | Number | 0 | |
| HSTSInclSubdom | Indicates if HSTS for subdomains is enabled or disabled. If set enabled, a client must send only HTTPS requests for subdomains. Can be Yes or No. |
String | No | |
| TLS13 | Indicates if TLS1.3 is enabled. | String | Enabled |
* If an SSL profile is bound, then these settings are taken from it.
List of Calculated Fields
| Field | Description | Data type | Unit | Example | Where available |
|---|---|---|---|---|---|
| RequestResponseBytesRate | RequestBytesRate + ResponseBytesRate. |
Number | Bytes | 2048 | Splunk data model |
| RequestResponseRateMB | RequestResponseBytesRate / 1024The field is deprecated and will be removed in a future release. Use RequestResponseRateMbps instead.
|
Number | MB | 2 | Splunk data model |
| RequestResponseRateMbps | round(RequestResponseBytesRate/125000,1) |
Number | Mbps | 2 | Splunk data model |
| TotalRequests2 | Total number of requests received. | Number | 456789 | Splunk data model | |
| TotalResponses2 | Total number of responses. | Number | 456789 | Splunk data model | |
| SessionTimeout2* | Session timeout. | Number | 120 | Splunk data model |
Ips
uberAgent collects Ip metrics like address, type, and if it is used for management access for the primary as well as the secondary appliance.
Details
- Source type:
uberAgent:CitrixADC:Ip - Used in dashboards: Single CitrixADC Inventory
- Enabled through configuration setting:
CitrixADCInventory - Related configuration settings:
[CitrixADC_Config] - Supported platform: Windows
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Example |
|---|---|---|---|---|
| HostName | Appliance name. | String | CitrixADC1 | |
| IpAddress | IP address. | IPv4 | 10.1.1.25 | |
| IpNetmask | IP netmask. | String | 255.255.0.0 | |
| IpType | IP type. Possible values: SNIP, VIP, NSIP, GSLBsiteIP, CLIP, LSN. |
String | VIP | |
| IpvServer | Indicates if the IP is bound to a vServer. | String | Yes | |
| IpMgmtAccess | Indicates if management access is allowed. | String | 0 |
Services
uberAgent collects service metrics like protocol, state as well as bound monitors for the primary appliance.
Details
- Source type:
uberAgent:CitrixADC:Service - Used in dashboards: Single Virtual Server Performance
- Enabled through configuration setting:
CitrixADCvServer - Related configuration settings:
[CitrixADC_Config] - Supported platform: Windows
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Example |
|---|---|---|---|---|
| HostName | Appliance name. | String | CitrixADC1 | |
| ServiceName | Service name. | String | webserver1 | |
| Protocol | Service protocol. Possible values: HTTP, FTP, TCP, UDP, SSL, SSL_BRIDGE, SSL_TCP, DTLS, NNTP, DNS, DHCPRA, ANY, SIP_UDP, SIP_TCP, SIP_SSL, DNS_TCP, RTSP, PUSH, SSL_PUSH, RADIUS, RDP, MYSQL, MSSQL, DIAMETER, SSL_DIAMETER, TFTP, ORACLE, SMPP, SYSLOGTCP, SYSLOGUDP, FIX, SSL_FIX, USER_TCP, USER_SSL_TCP. |
String | HTTP | |
| PrimaryIpAddress | IP address. | IPv4 | 10.1.1.11 | |
| PrimaryPort | Port. | Number | 80 | |
| State | Service state. Possible values: UP, DOWN, UNKNOWN, OFS (Out of Service), TROFS (Transition Out of Service), TROFS_DOWN (Down when going Out of Service). |
String | Up | |
| vServerName | Name of the vServer the service is bound to. | String | lbvs_CompanyWebserver | |
| ServiceMonitors | Bound service monitors. | String | tcp-default |
List of Calculated Fields
| Field | Description | Data type | Unit | Example | Where available |
|---|---|---|---|---|---|
| ServiceMonitorsSplit | ServiceMonitors split by semicolon. |
Number | MB | Splunk data model |
Service Groups
uberAgent collects service group metrics like protocol, state as well as bound monitors for the primary appliance.
Details
- Source type:
uberAgent:CitrixADC:ServiceGroup - Used in dashboards: Single Virtual Server Performance
- Enabled through configuration setting:
CitrixADCvServer - Related configuration settings:
[CitrixADC_Config] - Supported platform: Windows
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Example |
|---|---|---|---|---|
| HostName | Appliance name. | String | CitrixADC1 | |
| ServiceGroupName | Service group name. | String | sgr1 | |
| Protocol | Service group protocol: ADNS, DNS, MYSQL, RTSP, SSL_DIAMETER, ADNS_TCP, DNS_TCP, NNTP, SIP_UDP, SSL_TCP, ANY, FTP, RADIUS, SNMP, TCP, DHCPRA, HTTP, RDP, SSL, TFTP, DIAMETER, MSSQL, RPCSVR, SSL_BRIDGE, UDP. |
String | HTTP | |
| State | Service group state. Possible values: UP, DOWN, UNKNOWN, OFS (Out of Service), TROFS (Transition Out of Service), TROFS_DOWN (Down when going Out of Service). |
String | Up | |
| EffectiveState | Indicates the effective servicegroup state based on the state of the bound service items. Possible values: UP, DOWN, OUT OF SERVICE, PARTIAL-UP, PARTIAL-DOWN. |
String | Up | |
| vServerName | Name of the vServer the service group is bound to. | String | lbvs_Storefront | |
| ServiceGroupMembers | Services which are members of the service group. | String | Service1;Service2 | |
| ServiceGroupMonitors | Bound service group monitors. | String | ping;tcp |
List of Calculated Fields
| Field | Description | Data type | Unit | Example | Where available |
|---|---|---|---|---|---|
| ServiceGroupMembersSplit | ServiceGroupMembers split by semicolon. |
Number | MB | Service1 Service2 |
Splunk data model |
| ServiceGroupMonitorsSplit | ServiceGroupMonitors split by semicolon. |
Number | MB | ping tcp |
Splunk data model |
Virtual Server
uberAgent collects virtual server (load-balancing virtual server only) metrics like network throughput and bound policies for the primary appliance.
Details
- Source type:
uberAgent:CitrixADC:vServer - Used in dashboards: Citrix ADC Virtual Server Performance, Single Virtual Server Performance, Single CitrixADC Inventory
- Enabled through configuration setting:
CitrixADCGateway - Related configuration settings:
[CitrixADC_Config] - Supported platform: Windows
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Example |
|---|---|---|---|---|
| HostName | Appliance name. | String | CitrixADC1 | |
| vServerName | Virtual server name. | String | vs_Storefront | |
| PrimaryIpAddress | IP address. | IPv4 | 10.1.1.5 | |
| PrimaryPort | Port. | Number | 443 | |
| Type | vServer type. Possible values: HTTP, FTP, TCP, UDP, SSL, SSL_BRIDGE, SSL_TCP, DTLS, NNTP, DNS, DHCPRA, ANY, SIP_UDP, SIP_TCP, SIP_SSL, DNS_TCP, RTSP, PUSH, SSL_PUSH, RADIUS, RDP, MYSQL, MSSQL, DIAMETER, SSL_DIAMETER, TFTP, ORACLE, SMPP, SYSLOGTCP, SYSLOGUDP, FIX, SSL_FIX, USER_TCP, USER_SSL_TCP. |
String | SSL | |
| State | vServer state. | String | Up | |
| RequestBytesRate | Incoming network traffic. | Number | Bytes | 1024 |
| ResponseBytesRate | Outgoing network traffic. | Number | Bytes | 1024 |
| RewritePolicies | Bound rewrite policies. | String | rw_clientname | |
| ResponderPolicies | Bound responder policies. | String | rp_storefront | |
| Certificates | Bound certificates. | String | Cert1;Cert2 | |
| SSL2* | Indicates if SSL2 is enabled. | String | 0 | |
| SSL3* | Indicates if SSL3 is enabled. | String | 0 | |
| TLS1* | Indicates if TLS1 is enabled. | String | 0 | |
| TLS11* | Indicates if TLS1.1 is enabled. | String | 0 | |
| TLS12* | Indicates if TLS1.2 is enabled. | String | 1 | |
| DiffeHellman* | Indicates if Diffie-Hellman is enabled. | String | 1 | |
| SSLProfile | Name of the bound SSL profile. | String | vastlimits_ssl_profile | |
| Ciphers* | Bound ciphers. | String | Secure_Cipher_Group | |
| CipherSuites* | Bound cipher suites. | String | DEFAULT | |
| ActSvcs2 | Active services. | Number | 2 | |
| TotHits2 | Total Hits. | Number | 456789 | |
| TotalRequests2 | Total number of requests received. | Number | 31888 | |
| TotalResponses2 | Total number of responses. | Number | 31888 | |
| VSLBHealth2 | The health of the vserver. This gives the percentage of UP services bound to this vserver. |
Number | % | 100 |
| SessionTimeout2* | Session timeout. | Number | 120 | |
| HSTS | State of HSTS protocol support for the SSL Virtual Server. Using HSTS, a server can enforce the use of an HTTPS connection for all communication with a client. Can be Enabled or Disabled. |
String | Disabled | |
| HSTSMaxAge | The maximum time, in seconds, in the strict transport security (STS) header during which the client must send only HTTPS requests to the server. | Number | 0 | |
| HSTSInclSubdom | Indicates if HSTS for subdomains is enabled or disabled. If set enabled, a client must send only HTTPS requests for subdomains. Can be Yes or No. |
String | No | |
| TLS13 | Indicates if TLS1.3 is enabled. | String | Enabled |
* If an SSL profile is bound, then these settings are taken from it.
List of Calculated Fields
| Field | Description | Data type | Unit | Example | Where available |
|---|---|---|---|---|---|
| RequestMBRate | Incoming network traffic. The field is deprecated and will be removed in a future release. Use RequestMbpsRate instead. |
Number | MB | 1 | Splunk data model |
| ResponseMBRate | Outgoing network traffic. The field is deprecated and will be removed in a future release. Use ResponseMbpsRate instead. |
Number | MB | 1 | Splunk data model |
| RequestMbpsRate | Incoming network traffic. | Number | Mbps | 1 | Splunk data model |
| ResponseMBRate | Outgoing network traffic. | Number | Mbps | 1 | Splunk data model |
| ActSvcs | Active services. | Number | 2 | Splunk data model | |
| TotHits | Total Hits. | Number | 456789 | Splunk data model | |
| TotalRequests | Total number of requests received. | Number | 31888 | Splunk data model | |
| TotalResponses | Total number of responses. | Number | 31888 | Splunk data model | |
| VSLBHealth | The health of the vserver. This gives the percentage of UP services bound to this vserver. |
Number | % | 100 | Splunk data model |
| SessionTimeout | Session timeout. | Number | 120 | Splunk data model |