Session Metrics
Session Detail
uberAgent collects metrics like the session ID, connection state, protocol latency, and foreground application per user session.
Details
- Source type:
uberAgent:Session:SessionDetail - Used in dashboards: Application Usage, Machine Uptime, SBC Sizing and Capacity Planning, Session 0, Session Info: Citrix, Session Info: VMware, User Session Overview, User Sessions, Single Application Performance, Single Machine Performance, Single User Performance, Analyze data over time
- Enabled through configuration setting:
SessionDetail - Related configuration settings: n/a
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Example | Platform |
|---|---|---|---|---|---|
| SessionID | Session ID generated by the OS. Session IDs are reused and cannot be used to uniquely identify a session. Use SessionGUID for that purpose instead. |
Number | 3 | all | |
| SessionLogonTime | Time when the user logged on. | String | 2018-07-23 10:06:02 | all | |
| SessionProtocol | Remoting protocol used to connect to the session. Possible values on Windows: Console, ICA, RDP, PCoIP, Blast, Frame, Protocol [ID].Possible values on macOS: Console, RFB, SSH, Protocol [ID].
|
String | ICA | all | |
| SessionConnectionState | Session connection state. Possible values: active, connected, connecting, shadowing,disconnected, idle, listening, reset, down,initializing, unknown, Unsupported state: [ID]. |
String | active | Win | |
| SessionProcessCount | Number of processes that are running in the session. | Number | 34 | all | |
| SessionCPUTimeMs | Session CPU usage (absolute usage in milliseconds). | Number | ms | 3000 | all |
| SessionCPUUsagePercent | Process CPU usage (relative usage in percent). | Number | % | 29 | all |
| SessionIOPS | I/O operations per second of all processes in the session combined. | Number | 500 | Win | |
| SessionIOCount | I/O operation count of all processes in the session combined. | Number | 300 | Win | |
| SessionIOMB | I/O data volume of all processes in the session combined. | Number | MB | 20 | all |
| SessionIOLatencyMs | Latency of I/O operations. | Number | ms | 300 | Win |
| SessionWorkingSetMB | RAM usage (working set) of all processes in the session combined. | Number | MB | 450.2 | all |
| SessionNetKBPS | Process network traffic data volume per second of all processes in the session combined. | Number | KB | 21 | Win |
| SessionUser | User name. | String | Domain\JohnDoe | all | |
| SessionGUID | Unique identifier for a session that is generated by uberAgent. | String | 00000002-f295-9109-e7c7-c964011dd401 | all | |
| SessionRpLatencyMs2 | Remoting protocol latency. This field is filled with the latency in ms at collection time. If the protocol is ICA, uberAgent uses the perfmon counter Latency - Last Recorded as the source.This metric is different from Citrix Round-Trip-Time (more information). |
Number | ms | 30 | Win |
| SessionClientMac | Remote client MAC address. Only collected for VMware sessions. | String | AC-ED-5C-02-F0-30 | Win | |
| SessionClientIp | Remote client IP address. | String | 192.168.178.40 | all | |
| SessionClientName | Remote client name. | String | Client1 | Win | |
| SessionClientDomain | Remote client Active Directory domain. | String | vastlimits.com | Win | |
| SessionClientUser | Remote client user name. | String | JohnDoe | Win | |
| SessionClientUserDomain | Remote client user Active Directory domain. | String | Domain | Win | |
| SessionHRes | Horizontal resolution. | String | 1920 | Win | |
| SessionVRes | Vertical resolution. | String | 1080 | Win | |
| SessionColorDepth | Color depth. | String | 32 | Win | |
| SessionClientPlatform | Remote client platform. | String | Windows | Win | |
| SessionClientVersion | Remote client version. | String | 13.0.0.256735 | Win | |
| SessionClientOsLanguage | Remote client operating system language. | String | en-us | Win | |
| SessionPublishedName | Published resource name. This resource was used to start or connect to the session. | String | Google Chrome | Win | |
| SessionPublishedAppsCtx | List of used Citrix published apps in the session. | String | Word Excel |
Win | |
| SessionAppStateCtx | Citrix application state. Possible values: n/a, active, pre-launched, lingering, app not running, unsupported. |
String | lingering | Win | |
| SessionEncryptionCtx | Citrix remoting protocol encryption. Possible values: unknown, basic, logon, 40 bit, 56 bit, 128 bit, SecureICA, unsupported. |
String | SecureICA | Win | |
| SessionClientTypeCtx | Citrix client type. Possible values: WI, ICA Client. |
String | WI | Win | |
| SessionBrokerDnsVmw | VMware broker DNS name. | String | HorizonCS.vastlimits.com | Win | |
| SessionBrokerUrlVmw | VMware broker URL. | String | https://192.168.8.6:443 | Win | |
| SessionBrokerTunneledVmw | VMware: indicates if session is tunneled. Possible values: true, false. |
String | true | Win | |
| SessionBrokerTunnelUrlVmw | VMware: URL of the View Connection Server tunnel connection. | String | https://HorizonCS.vastlimits.com:443 | Win | |
| SessionBrokerRemoteIpVmw | VMware broker remote IP address. | String | 192.168.178.40 | Win | |
| SessionBrokerUserVmw | VMware broker user name. | String | John | Win | |
| SessionBrokerDomainVmw | VMware broker user domain name. | String | Doe | Win | |
| SessionClientTimezoneVmw | VMware client timezone. | String | Europe/Italy | Win | |
| SessionClientIdVmw | VMware client ID. | String | c47c60cf41ec44829ff91e1822b24dd8 | Win | |
| SessionTypeVmw | VMware session type. Possible values: application, desktop. |
String | application | Win | |
| SessionBrokerType | Remoting broker type. Possible values: Citrix, Microsoft, VMware, Nutanix Frame, none, unknown, Unsupported broker: [number]. |
String | Citrix | Win | |
| SessionFgAppId | Foreground application ID. Used by uberAgent to look up application names and populate the field SessionFgAppName. |
String | GglChrm | all | |
| SessionFgAppVersion | Foreground application version. | String | 67.0.3396.99 | all | |
| SessionFgProcessName | Foreground process name. | String | chrome.exe | all | |
| SessionFgProcessId | Foreground process ID. | Number | 456 | all | |
| SessionFgBrowserType | If the foreground window is a browser: browser type. Possible values: 1, 2, 3, 4. Also see the field SessionFgBrowserDisplayName. |
Number | 1 | Win | |
| SessionFgBrowserActiveTabHost | If the foreground window is a browser: the URL of active tab. See this KB article for troubleshooting empty values. | String | uberagent.com | Win | |
| SessionFgWindowTitle | The title of the active foreground window. | String | Search | Splunk 7.2.1 – Google Chrome | all | |
| SessionClientHwIdCtx2 | Citrix client hardware ID. | Number | 409D39C2 | Win | |
| SessionRoundTripTimeMs | Citrix session round trip time. | Number | ms | 50 | Win |
| SessionFps | Remoting protocol frames per second at collection time. Only available for Citrix and Nutanix Frame sessions. | Number | 20 | Win | |
| SessionTransportProtocols | The protocol chain used for this connection. Only available for Citrix sessions. | String | UDP-CGP-ICA | Win |
List of Calculated Fields
| Field | Description | Data type | Unit | Example | Where available |
|---|---|---|---|---|---|
| AppName | Application name. Source is the field SessionFgAppId. |
String | Google Chrome | Splunk data model, Splunk SPL | |
| SessionCPUTimeS | Session CPU usage (absolute usage in seconds). | Number | s | 3 | Splunk data model |
| SessionIODurationMs | SessionIOLatencyMs x SessionIOCount. |
Number | ms | 90000 | Splunk data model |
| SessionRAMUsagePercent | Percentage of the machine’s RAM used by the session. | Number | % | 34 | Splunk data model |
| User | Alias for SessionUser. |
String | Domain\JohnDoe | Splunk data model | |
| SessionUserLower | User name converted to lower case. | String | domain\johndoe | Splunk data model | |
| SessionDisplaySpecs | SessionHRes + "x" + SessionVRes + "x" + SessionColorDepth. |
String | 1920x1080x32 | Splunk data model | |
| SessionPublishedAppsCtxSplit | SessionPublishedAppsCtx split by semicolon. |
String | Word;Excel | Splunk data model | |
| SessionPublishedAppsCtxSplitLower | SessionPublishedAppsCtxSplit converted to lower case. |
String | word;excel | Splunk data model | |
| SessionFgAppName | Foreground application name. | String | Google Chrome | Splunk data model, Splunk SPL | |
| SessionFgBrowserDisplayName | Foreground browser name. Possible values: Chrome, Internet Explorer, Firefox, Edge. |
String | Chrome | Splunk data model, Splunk SPL | |
| SessionClientHwIdCtx | SessionClientHwIdCtx2 or SessionClientHwIdCtx, whichever is present. |
Number | 409D39C2 | Splunk data model |