Documentation

Contents
Contents
Contents
Contents

Session Metrics

Session Detail

uberAgent collects metrics like session ID, connection state, protocol latency and foreground application per user session.

Details

  • Source type: uberAgent:Session:SessionDetail
  • Used in dashboards: Application Usage, Machine Uptime, SBC Sizing and Capacity Planning, Session 0, Session Info: Citrix, Session Info: VMware, User Session Overview, User Sessions, Single Application Performance, Single Machine Performance, Single User Performance, Analyze data over time
  • Enabled through configuration setting: SessionDetail
  • Related configuration settings: n/a

List of Fields in the Raw Agent Data

Field Description Data type Unit Example Platform
SessionID Unique identifier that is generated by the machine when the session is created.
Will be reassigned to other sessions after logoff.
Number 3 all
SessionLogonTime Time when the user logged on String 2018-07-23 10:06:02 all
SessionProtocol Used protocol. Possible values: Console, ICA, RDP, PCoIP, Blast, Protocol [ID] String ICA Win
SessionConnectionState Connection state. Possible values are: active, connected, connecting, shadowing,disconnected, idle, listening, reset, down,
initializing, unknown, Unsupported state: [ID]
String active Win
SessionProcessCount Process count Number 34 all
SessionCPUTimeMs Consumed CPU time Number ms 3000 all
SessionCPUUsagePercent CPU usage Number % 29 all
SessionIOPS I/O operations per second Number 500 Win
SessionIOCount I/O operations count Number 300 Win
SessionIOMB I/O operations data volume Number MB 20 all
SessionIOLatencyMs I/O operations latency Number ms 300 Win
SessionWorkingSetMB Physical RAM allocation Number MB 450.2 all
SessionNetKBPS Generated network traffic Number KB 21 Win
SessionUser User name String Domain\JohnDoe all
SessionGUID Unique identifier that is generated by uberAgent when the session is created.
Valid for this session only.
String 00000002-f295-9109-e7c7-c964011dd401 all
SessionRpLatencyMs2 Represents the latency of remoting protocols of a user’s session. Field is filled with the latency in ms at collection time. If the protocol is ICA, uberAgent uses the perfmon counter Latency - Last Recorded as the source.
This metrik is different from Citrix Round-Trip-Time. More information.
Number ms 300 Win
SessionClientMac Client MAC address. Only collected for VMware sessions. String AC-ED-5C-02-F0-30 Win
SessionClientIp Client IP address String 192.168.178.40 Win
SessionClientName Client name String Client1 Win
SessionClientDomain Client Active Directory domain String vastlimits.com Win
SessionClientUser Client user name String JohnDoe Win
SessionClientUserDomain Client user Active Directory domain String Domain Win
SessionHRes Horizontal resolution String 1920 Win
SessionVRes Vertical resolution String 1080 Win
SessionColorDepth Color depth String 32 Win
SessionClientPlatform Client platform String Windows Win
SessionClientVersion Client version String 13.0.0.256735 Win
SessionClientOsLanguage Client operating system language String en-us Win
SessionPublishedName Published resource’s name. This resource was used to initiate the session. String Google Chrome Win
SessionPublishedAppsCtx List of used Citrix published apps in one session String Word
Excel
Win
SessionAppStateCtx Application state. Possible values: n/a, active, pre-launched, lingering, app not running, unsupported. Citrix only. String lingering Win
SessionEncryptionCtx Used encryption.Possible values: unknown, basic, logon, 40 bit, 56 bit, 128 bit, SecureICA, unsupported. Citrix only. String SecureICA Win
SessionClientTypeCtx Client type. Possible values: WI, ICA Client. Citrix only. String WI Win
SessionBrokerDnsVmw Broker DNS name. VMware only. String HorizonCS.vastlimits.com Win
SessionBrokerUrlVmw Broker URL. VMware only. String https://192.168.8.6:443 Win
SessionBrokerTunneledVmw Indicates if session is tunneled. Possible values: true, false. VMware only. String true Win
SessionBrokerTunnelUrlVmw The URL of the View Connection Server tunnel connection. VMware only. String https://HorizonCS.vastlimits.com:443 Win
SessionBrokerRemoteIpVmw Client IP address. VMware only. String 192.168.178.40 Win
SessionBrokerUserVmw User name. VMware only. String John Win
SessionBrokerDomainVmw User domain name. VMware only. String Doe Win
SessionClientTimezoneVmw Client timezone. VMware only. String Europe/Italy Win
SessionClientIdVmw Client ID. VMware only. String c47c60cf41ec44829ff91e1822b24dd8 Win
SessionTypeVmw Session type. Possible values: application, desktop. VMware only. String application Win
SessionBrokerType Broker type. Possible values: Citrix, Microsoft, VMware, none, unknown, Unsupported broker: [number] String Citrix Win
SessionFgAppId Foreground application ID. Used by uberAgent to lookup application names and populate field SessionFgAppName. String GglChrm all
SessionFgAppVersion Foreground application version String 67.0.3396.99 all
SessionFgProcessName Foreground process name String chrome.exe all
SessionFgProcessId Foreground process ID Number 456 all
SessionFgBrowserType If the foreground window is a browser: browser type. Possible values: 1, 2, 3, 4. Also see the field SessionFgBrowserDisplayName below. Number 1 Win
SessionFgBrowserActiveTabHost If the foreground window is a browser: the URL of active tab. See this KB article for troubleshooting empty values. String uberagent.com Win
SessionFgWindowTitle The title of the active foreground window String Search | Splunk 7.2.1 – Google Chrome all
SessionClientHwIdCtx2 Client hardware ID. Citrix only. Number 409D39C2 Win

List of Calculated Fields

Field Description Data type Unit Example Where available
AppName Application name. Source is the field SessionFgAppName. String Google Chrome Splunk data model, Splunk SPL
SessionCPUTimeS Consumed CPU time Number s 3 Splunk data model
SessionIODurationMs I/O operations duration Number ms 90000 Splunk data model
SessionRAMUsagePercent RAM usage Number % 34 Splunk data model
User User name String DomainJohnDoe Splunk data model
SessionUserExpanded User name String DomainJohnDoe Splunk SPL
SessionUserLower User name converted to lower case String domainjohndoe Splunk data model
SessionDisplaySpecs SessionHRes + "x" + SessionVRes + "x" + SessionColorDepth String 1920x1080x32 Splunk data model
SessionPublishedAppsCtxSplit List of used Citrix published apps in one session split by semicolon String Word;Excel Splunk data model
SessionPublishedAppsCtxSplitLower List of used Citrix published apps in one session split by semicolon converted to lower case String word;excel Splunk data model
SessionFgAppName Foreground application name String Google Chrome Splunk data model, Splunk SPL
SessionFgBrowserDisplayName Foreground browser name. Possible values: Chrome, Internet Explorer, Firefox, Edge String Chrome Splunk data model, Splunk SPL
SessionClientHwIdCtx Client hardware ID. Citrix only. Number 409D39C2 Splunk data model

Leave a Reply

Your email address will not be published. Required fields are marked *