Citrix ADC monitoring requires its metrics enabled on at least one machine. See the documentation for details.

Appliance Inventory

uberAgent collects metrics like MAC address, model, and version for the primary as well as the secondary appliance.

Details

• Source type: uberAgent:CitrixADC:ApplianceInventory
• Used in dashboards: CitrixADC Inventory, Single CitrixADC Inventory
• Enabled through configuration setting: CitrixADCInventory
• Related configuration settings: [CitrixADC_Config]
• Supported platform: Windows

List of Fields in the Raw Agent Data

Field	Description	Data type	Unit	Example
HostName	Appliance name	String		CitrixADC1
Version	Firmware version	String		NS12.0: Build 59.8.nc Date: Sep 12 2018 06:16:17
License	Installed license	String		Platinum
Model	Appliance model	Number		1000
LicensingMode	Configured licensing mode. Possible values: Local, Pooled, CICO	String		Local
HwDescription	Hardware and its ports detail	String		NetScaler Virtual Appliance
SysId	System id	String		450088
ManufactureDay	Day the appliance was manufactured	Number		17
ManufactureMonth	Month the appliance was manufactured	Number		2
ManufactureYear	Year the appliance was manufactured	Number		2009
CpuFrequncy	CPU frequency	Number		3890
SerialNo	Serial number	Number		ABCDEFG12
EncodedSerialno	Encoded serial number	String		68310055cb267307ffg8
MACAddress	MAC address	String		00155d3d890d
HostId	Host id	String		123456789
LastConfigSaveTime	Time when the configuration was last saved	String		2018-12-07 12:06:36
Timezone	Timezone	String		GMT+01:00-CET-Europe/Berlin
WeakPassword	List of all weak passwords	String		password
SystemType	System type. Possible Values: Standalone, HA, Cluster	String		HA
LastConfigChangedTime	Time when the configuration was last changed	String		2018-12-07 12:06:21
LastStartupTime	Time when the appliance was last started	String		2018-11-24 15:26:25
CurrentHAStatus	Indicates the high availability state of the node. Possible values: Staysecondary, Primary, Secondary, Claiming, Force change	String		Primary
LastHAStatusChange	Time when the last master state transition occurred	String		2018-12-04 10:34:51
SSLCards2	Number of available SSL cards	Number		0
SSLCardsUp2	Number of working SSL cards	Number		0

List of Calculated Fields

Field	Description	Data type	Unit	Example	Where available
SSLCards	Number of available SSL cards	Number		0	Splunk data model
SSLCardsUp	Number of working SSL cards	Number		0	Splunk data model

Appliance Performance

uberAgent collects metrics like CPU usage, RAM usage as well as network throughput for the primary appliance.

Details

• Source type: uberAgent:CitrixADC:AppliancePerformance
• Used in dashboards: CitrixADC Appliance Performance
• Enabled through configuration setting: CitrixADCPerformance
• Related configuration settings: [CitrixADC_Config]
• Supported platform: Windows

List of Fields in the Raw Agent Data

Field	Description	Data type	Unit	Example
HostName	Appliance name	String		CitrixADC1
MemUsagePcnt	Memory usage	Number	%	17.62
MgmtCpuUsagePcnt	Management CPU usage	Number	%	14.6
PktCpuUsagePcnt	Packet CPU usage	Number	%	3
Disk0PerUsage	/flash disk usage	Number	%	41
Disk0Size	/flash disk size	Number	MB	1585
Disk0Used	/flash disk allocated space	Number	MB	598
Disk0Avail	/flash disk free space	Number	MB	860
Disk1PerUsage	/var disk usage	Number	%	45
Disk1Size	/var disk size	Number	MB	14179
Disk1Used	/var disk allocated space	Number	MB	5988
Disk1Avail	/var disk free space	Number	MB	7056
ApplianceBytesReceived	Amount of incoming network data	Number	Bytes	608359
ApplianceBytesSent	Amount of outgoing network data	Number	Bytes	616856
NumCpus2	Number of CPUs	Number		3
MemSizeMB2	Memory size	Number	MB	8096
MemUseInMB2	Memory usage	Number	MB	196

List of Calculated Fields

Field	Description	Data type	Unit	Example	Where available
ApplianceMBReceived	Amount of incoming network data	Number	MB	594.100	Splunk data model
ApplianceMBSent	Amount of outgoing network data	Number	MB	602.39	Splunk data model
NumCpus	Number of CPUs	Number		3	Splunk data model
MemSizeMB	Memory size	Number	MB	8096	Splunk data model
MemUseInMB	Memory usage	Number	MB	196	Splunk data model

Certificates

uberAgent collects certificate metrics like name, type and expiration date for the primary as well as the secondary appliance.

Details

• Source type: uberAgent:CitrixADC:Certificate
• Used in dashboards: Single CitrixADC Inventory
• Enabled through configuration setting: CitrixADCInventory
• Related configuration settings: [CitrixADC_Config]
• Supported platform: Windows

List of Fields in the Raw Agent Data

Field	Description	Data type	Unit	Example
HostName	Appliance name	String		CitrixADC1
CertName	Certificate name	String		nsmgmtcer
CertFile	Certificate file	String		nsmgmt.cer
CertType	Certificate type. Possible values: Client, Server, Client;Server, Root, Intermediate	String		Client;Server
CertExpirationDate	Certificate expiration date	String		2020-11-22 11:06:46

Gateways

uberAgent collects gateway metrics like network throughput and SSL as well as authentication policies for the primary appliance.

Details

• Source type: uberAgent:CitrixADC:Gateway
• Used in dashboards: Citrix ADC Gateway Performance, Single CitrixADC Inventory
• Enabled through configuration setting: CitrixADCGateway
• Related configuration settings: [CitrixADC_Config]
• Supported platform: Windows

List of Fields in the Raw Agent Data

Field	Description	Data type	Unit	Example
HostName	Appliance name	String		CitrixADC1
vServerName	Gateway name	String		_XD_10.1.1.22_443
PrimaryIpAddress	IP address	IPv4		10.1.1.22
PrimaryPort	Port	Number		443
Type	vServer type. Possible values: SSL	String		SSL
State	vServer state	String		Up
RequestBytesRate	Incoming network traffic	Number	Bytes	1024
ResponseBytesRate	Outgoing network traffic	Number	Bytes	1024
AuthLDAPPolicies	Bound LDAP authentication policies	String		pol_ldap1;pol_ldap2
AuthRadiusPolicies	Bound Radius authentication policies	String		pol_radius1;pol_radius2
AuthSAMLPolicies	Bound SAML authentication policies	String		pol_saml1
SessionPolicies	Bound session policies	String		sp_storefront
STAs	Secure ticket authorities	String		http://DDC.vastlimits.com
ResponderPolicies	Bound responder policies	String		rp_storefront
RewritePolicies	Bound rewrite policies	String		rw_clientname
Certificates	Bound certificates	String		wildcard.vastlimits.com
PortalTheme	Bound portal theme	String		Default
SSL2*	Indicates if SSL2 is enabled	String		0
SSL3*	Indicates if SSL3 is enabled	String		0
TLS1*	Indicates if TLS1 is enabled	String		0
TLS11*	Indicates if TLS1.1 is enabled	String		0
TLS12*	Indicates if TLS1.2 is enabled	String		1
DiffeHellman*	Indicates if Diffie-Hellman is enabled	String		1
SSLProfile	Name of the bound SSL profile	String		ns_default_ssl_profile_frontend
Ciphers*	Bound ciphers	String		DEFAULT
CipherSuites*	Bound cipher suites	String		DEFAULT
TotalRequests2	Total number of requests received	Number		456789
TotalResponses2	Total number of responses	Number		456789
SessionTimeout2*	Session timeout	Number		120

* If an SSL profile is bound, then these settings are taken from it.

List of Calculated Fields

Field	Description	Data type	Unit	Example	Where available
RequestResponseBytesRate	RequestBytesRate + ResponseBytesRate	Number	Bytes	2048	Splunk data model
RequestResponseRateMB	RequestResponseBytesRate / 1024	Number	MB	2	Splunk data model
TotalRequests2	Total number of requests received	Number		456789	Splunk data model
TotalResponses2	Total number of responses	Number		456789	Splunk data model
SessionTimeout2*	Session timeout	Number		120	Splunk data model

Ips

uberAgent collects Ip metrics like address, type and if it is used for management access for the primary as well as the secondary appliance.

Details

• Source type: uberAgent:CitrixADC:Ip
• Used in dashboards: Single CitrixADC Inventory
• Enabled through configuration setting: CitrixADCInventory
• Related configuration settings: [CitrixADC_Config]
• Supported platform: Windows

List of Fields in the Raw Agent Data

Field	Description	Data type	Unit	Example
HostName	Appliance name	String		CitrixADC1
IpAddress	IP address	IPv4		10.1.1.25
IpNetmask	IP netmask	String		255.255.0.0
IpType	IP type. Possible values: SNIP, VIP, NSIP, GSLBsiteIP, CLIP, LSN	String		VIP
IpvServer	Indicates if the IP is bound to a vServer	String		Yes
IpMgmtAccess	Indicates if management access is allowed	String		0

Services

uberAgent collects service metrics like protocol, state as well as bound monitors for the primary appliance.

Details

• Source type: uberAgent:CitrixADC:Service
• Used in dashboards: Single Virtual Server Performance
• Enabled through configuration setting: CitrixADCvServer
• Related configuration settings: [CitrixADC_Config]
• Supported platform: Windows

List of Fields in the Raw Agent Data

Field	Description	Data type	Unit	Example
HostName	Appliance name	String		CitrixADC1
ServiceName	Service name	String		webserver1
Protocol	Service protocol. Possible values: HTTP, FTP, TCP, UDP, SSL, SSL_BRIDGE, SSL_TCP, DTLS, NNTP, DNS, DHCPRA, ANY, SIP_UDP, SIP_TCP, SIP_SSL, DNS_TCP, RTSP, PUSH, SSL_PUSH, RADIUS, RDP, MYSQL, MSSQL, DIAMETER, SSL_DIAMETER, TFTP, ORACLE, SMPP, SYSLOGTCP, SYSLOGUDP, FIX, SSL_FIX, USER_TCP, USER_SSL_TCP	String		HTTP
PrimaryIpAddress	IP address	IPv4		10.1.1.11
PrimaryPort	Port	Number		80
State	Service state. Possible values: UP, DOWN, UNKNOWN, OFS (Out of Service), TROFS (Transition Out of Service), TROFS_DOWN (Down When going Out of Service)	String		Up
vServerName	Name of the vServer the service is bound to	String		lbvs_CompanyWebserver
ServiceMonitors	Bound service monitors	String		tcp-default

List of Calculated Fields

Field	Description	Data type	Unit	Example	Where available
ServiceMonitorsSplit	ServiceMonitors split by semicolon	Number	MB		Splunk data model

Service Groups

uberAgent collects service group metrics like protocol, state as well as bound monitors for the primary appliance.

Details

• Source type: uberAgent:CitrixADC:ServiceGroup
• Used in dashboards: Single Virtual Server Performance
• Enabled through configuration setting: CitrixADCvServer
• Related configuration settings: [CitrixADC_Config]
• Supported platform: Windows

List of Fields in the Raw Agent Data

Field	Description	Data type	Unit	Example
HostName	Appliance name	String		CitrixADC1
ServiceGroupName	Service group name	String		sgr1
Protocol	Service group protocol: ADNS, DNS, MYSQL, RTSP, SSL_DIAMETER, ADNS_TCP, DNS_TCP, NNTP, SIP_UDP, SSL_TCP, ANY, FTP, RADIUS, SNMP, TCP, DHCPRA, HTTP, RDP, SSL, TFTP, DIAMETER, MSSQL, RPCSVR, SSL_BRIDGE, UDP	String		HTTP
State	Service group state. Possible values: UP, DOWN, UNKNOWN, OFS (Out of Service), TROFS (Transition Out of Service), TROFS_DOWN (Down When going Out of Service)	String		Up
EffectiveState	Indicates the effective servicegroup state based on the state of the bound service items. Possible values: UP, DOWN, OUT OF SERVICE, PARTIAL-UP, PARTIAL-DOWN	String		Up
vServerName	Name of the vServer the service group is bound to	String		lbvs_Storefront
ServiceGroupMembers	Services which are member of the service group	String		Service1;Service2
ServiceGroupMonitors	Bound service group monitors	String		ping;tcp

List of Calculated Fields

Field	Description	Data type	Unit	Example	Where available
ServiceGroupMembersSplit	ServiceGroupMembers split by semicolon	Number	MB	Service1 Service2	Splunk data model
ServiceGroupMonitorsSplit	ServiceGroupMonitors split by semicolon	Number	MB	ping tcp	Splunk data model

Virtual Server

uberAgent collects virtual server (load-balancing virtual server only) metrics like network throughput and bound policies for the primary appliance.

Details

• Source type: uberAgent:CitrixADC:vServer
• Used in dashboards: Citrix ADC Virtual Server Performance, Single Virtual Server Performance, Single CitrixADC Inventory
• Enabled through configuration setting: CitrixADCGateway
• Related configuration settings: [CitrixADC_Config]
• Supported platform: Windows

List of Fields in the Raw Agent Data

Field	Description	Data type	Unit	Example
HostName	Appliance name	String		CitrixADC1
vServerName	Virtual server name	String		vs_Storefront
PrimaryIpAddress	IP address	IPv4		10.1.1.5
PrimaryPort	Port	Number		443
Type	vServer type. Possible values: HTTP, FTP, TCP, UDP, SSL, SSL_BRIDGE, SSL_TCP, DTLS, NNTP, DNS, DHCPRA, ANY, SIP_UDP, SIP_TCP, SIP_SSL, DNS_TCP, RTSP, PUSH, SSL_PUSH, RADIUS, RDP, MYSQL, MSSQL, DIAMETER, SSL_DIAMETER, TFTP, ORACLE, SMPP, SYSLOGTCP, SYSLOGUDP, FIX, SSL_FIX, USER_TCP, USER_SSL_TCP	String		SSL
State	vServer state	String		Up
RequestBytesRate	Incoming network traffic	Number	Bytes	1024
ResponseBytesRate	Outgoing network traffic	Number	Bytes	1024
RewritePolicies	Bound rewrite policies	String		rw_clientname
ResponderPolicies	Bound responder policies	String		rp_storefront
Certificates	Bound certificates	String		Cert1;Cert2
SSL2*	Indicates if SSL2 is enabled	String		0
SSL3*	Indicates if SSL3 is enabled	String		0
TLS1*	Indicates if TLS1 is enabled	String		0
TLS11*	Indicates if TLS1.1 is enabled	String		0
TLS12*	Indicates if TLS1.2 is enabled	String		1
DiffeHellman*	Indicates if Diffie-Hellman is enabled	String		1
SSLProfile	Name of the bound SSL profile	String		vastlimits_ssl_profile
Ciphers*	Bound ciphers	String		Secure_Cipher_Group
CipherSuites*	Bound cipher suites	String		DEFAULT
ActSvcs2	Active services	Number		2
TotHits2	Total Hits	Number		456789
TotalRequests2	Total number of requests received	Number		31888
TotalResponses2	Total number of responses	Number		31888
VSLBHealth2	The health of the vserver. This gives the percentage of UP services bound to this vserver.	Number	%	100
SessionTimeout2*	Session timeout	Number		120

* If an SSL profile is bound, then these settings are taken from it.

List of Calculated Fields

Field	Description	Data type	Unit	Example	Where available
RequestMBRate	Incoming network traffic	Number	MB	1	Splunk data model
ResponseMBRate	Outgoing network traffic	Number	MB	1	Splunk data model
ActSvcs	Active services	Number		2	Splunk data model
TotHits	Total Hits	Number		456789	Splunk data model
TotalRequests	Total number of requests received	Number		31888	Splunk data model
TotalResponses	Total number of responses	Number		31888	Splunk data model
VSLBHealth	The health of the vserver. This gives the percentage of UP services bound to this vserver.	Number	%	100	Splunk data model
SessionTimeout	Session timeout	Number		120	Splunk data model