Session Metrics
Session Detail
uberAgent collects metrics like session ID, connection state, protocol latency and foreground application per user session.
Details
- Source type:
uberAgent:Session:SessionDetail - Used in dashboards: Application Usage, Machine Uptime, SBC Sizing and Capacity Planning, Session 0, Session Info: Citrix, Session Info: VMware, User Session Overview, User Sessions, Single Application Performance, Single Machine Performance, Single User Performance, Analyze data over time
- Enabled through configuration setting:
SessionDetail - Related configuration settings: n/a
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Example | Platform |
|---|---|---|---|---|---|
| SessionID | Unique identifier that is generated by the machine when the session is created. Will be reassigned to other sessions after logoff. |
Number | 3 | all | |
| SessionLogonTime | Time when the user logged on | String | 2018-07-23 10:06:02 | all | |
| SessionProtocol | Used protocol. Possible values on Windows: Console, ICA, RDP, PCoIP, Blast, Protocol [ID]Possible values on macOS: Console, SSH, Protocol [ID]
|
String | ICA | all | |
| SessionConnectionState | Connection state. Possible values are: active, connected, connecting, shadowing,disconnected, idle, listening, reset, down,initializing, unknown, Unsupported state: [ID] |
String | active | Win | |
| SessionProcessCount | Process count | Number | 34 | all | |
| SessionCPUTimeMs | Consumed CPU time | Number | ms | 3000 | all |
| SessionCPUUsagePercent | CPU usage | Number | % | 29 | all |
| SessionIOPS | I/O operations per second | Number | 500 | Win | |
| SessionIOCount | I/O operations count | Number | 300 | Win | |
| SessionIOMB | I/O operations data volume | Number | MB | 20 | all |
| SessionIOLatencyMs | I/O operations latency | Number | ms | 300 | Win |
| SessionWorkingSetMB | Physical RAM allocation | Number | MB | 450.2 | all |
| SessionNetKBPS | Generated network traffic | Number | KB | 21 | Win |
| SessionUser | User name | String | Domain\JohnDoe | all | |
| SessionGUID | Unique identifier that is generated by uberAgent when the session is created. Valid for this session only. |
String | 00000002-f295-9109-e7c7-c964011dd401 | all | |
| SessionRpLatencyMs2 | Represents the latency of remoting protocols of a user’s session. Field is filled with the latency in ms at collection time. If the protocol is ICA, uberAgent uses the perfmon counter Latency - Last Recorded as the source.This metrik is different from Citrix Round-Trip-Time. More information. |
Number | ms | 300 | Win |
| SessionClientMac | Client MAC address. Only collected for VMware sessions. | String | AC-ED-5C-02-F0-30 | Win | |
| SessionClientIp | Client IP address | String | 192.168.178.40 | all | |
| SessionClientName | Client name | String | Client1 | Win | |
| SessionClientDomain | Client Active Directory domain | String | vastlimits.com | Win | |
| SessionClientUser | Client user name | String | JohnDoe | Win | |
| SessionClientUserDomain | Client user Active Directory domain | String | Domain | Win | |
| SessionHRes | Horizontal resolution | String | 1920 | Win | |
| SessionVRes | Vertical resolution | String | 1080 | Win | |
| SessionColorDepth | Color depth | String | 32 | Win | |
| SessionClientPlatform | Client platform | String | Windows | Win | |
| SessionClientVersion | Client version | String | 13.0.0.256735 | Win | |
| SessionClientOsLanguage | Client operating system language | String | en-us | Win | |
| SessionPublishedName | Published resource’s name. This resource was used to initiate the session. | String | Google Chrome | Win | |
| SessionPublishedAppsCtx | List of used Citrix published apps in one session | String | Word Excel |
Win | |
| SessionAppStateCtx | Application state. Possible values: n/a, active, pre-launched, lingering, app not running, unsupported. Citrix only. |
String | lingering | Win | |
| SessionEncryptionCtx | Used encryption.Possible values: unknown, basic, logon, 40 bit, 56 bit, 128 bit, SecureICA, unsupported. Citrix only. |
String | SecureICA | Win | |
| SessionClientTypeCtx | Client type. Possible values: WI, ICA Client. Citrix only. |
String | WI | Win | |
| SessionBrokerDnsVmw | Broker DNS name. VMware only. | String | HorizonCS.vastlimits.com | Win | |
| SessionBrokerUrlVmw | Broker URL. VMware only. | String | https://192.168.8.6:443 | Win | |
| SessionBrokerTunneledVmw | Indicates if session is tunneled. Possible values: true, false. VMware only. |
String | true | Win | |
| SessionBrokerTunnelUrlVmw | The URL of the View Connection Server tunnel connection. VMware only. | String | https://HorizonCS.vastlimits.com:443 | Win | |
| SessionBrokerRemoteIpVmw | Client IP address. VMware only. | String | 192.168.178.40 | Win | |
| SessionBrokerUserVmw | User name. VMware only. | String | John | Win | |
| SessionBrokerDomainVmw | User domain name. VMware only. | String | Doe | Win | |
| SessionClientTimezoneVmw | Client timezone. VMware only. | String | Europe/Italy | Win | |
| SessionClientIdVmw | Client ID. VMware only. | String | c47c60cf41ec44829ff91e1822b24dd8 | Win | |
| SessionTypeVmw | Session type. Possible values: application, desktop. VMware only. |
String | application | Win | |
| SessionBrokerType | Broker type. Possible values: Citrix, Microsoft, VMware, none, unknown, Unsupported broker: [number] |
String | Citrix | Win | |
| SessionFgAppId | Foreground application ID. Used by uberAgent to lookup application names and populate field SessionFgAppName. |
String | GglChrm | all | |
| SessionFgAppVersion | Foreground application version | String | 67.0.3396.99 | all | |
| SessionFgProcessName | Foreground process name | String | chrome.exe | all | |
| SessionFgProcessId | Foreground process ID | Number | 456 | all | |
| SessionFgBrowserType | If the foreground window is a browser: browser type. Possible values: 1, 2, 3, 4. Also see the field SessionFgBrowserDisplayName below. |
Number | 1 | Win | |
| SessionFgBrowserActiveTabHost | If the foreground window is a browser: the URL of active tab. See this KB article for troubleshooting empty values. | String | uberagent.com | Win | |
| SessionFgWindowTitle | The title of the active foreground window | String | Search | Splunk 7.2.1 – Google Chrome | all | |
| SessionClientHwIdCtx2 | Client hardware ID. Citrix only. | Number | 409D39C2 | Win |
List of Calculated Fields
| Field | Description | Data type | Unit | Example | Where available |
|---|---|---|---|---|---|
| AppName | Application name. Source is the field SessionFgAppName. |
String | Google Chrome | Splunk data model, Splunk SPL | |
| SessionCPUTimeS | Consumed CPU time | Number | s | 3 | Splunk data model |
| SessionIODurationMs | I/O operations duration | Number | ms | 90000 | Splunk data model |
| SessionRAMUsagePercent | RAM usage | Number | % | 34 | Splunk data model |
| User | User name | String | DomainJohnDoe | Splunk data model | |
| SessionUserExpanded | User name | String | DomainJohnDoe | Splunk SPL | |
| SessionUserLower | User name converted to lower case | String | domainjohndoe | Splunk data model | |
| SessionDisplaySpecs | SessionHRes + "x" + SessionVRes + "x" + SessionColorDepth |
String | 1920x1080x32 | Splunk data model | |
| SessionPublishedAppsCtxSplit | List of used Citrix published apps in one session split by semicolon | String | Word;Excel | Splunk data model | |
| SessionPublishedAppsCtxSplitLower | List of used Citrix published apps in one session split by semicolon converted to lower case | String | word;excel | Splunk data model | |
| SessionFgAppName | Foreground application name | String | Google Chrome | Splunk data model, Splunk SPL | |
| SessionFgBrowserDisplayName | Foreground browser name. Possible values: Chrome, Internet Explorer, Firefox, Edge |
String | Chrome | Splunk data model, Splunk SPL | |
| SessionClientHwIdCtx | Client hardware ID. Citrix only. | Number | 409D39C2 | Splunk data model |