Session Detail

uberAgent collects metrics like session ID, connection state, protocol latency, and foreground application per user session.

Details

• Source type: uberAgent:Session:SessionDetail
• Used in dashboards: Application Usage, Machine Uptime, SBC Sizing and Capacity Planning, Session 0, Session Info: Citrix, Session Info: VMware, User Session Overview, User Sessions, Single Application Performance, Single Machine Performance, Single User Performance, Analyze data over time
• Enabled through configuration setting: SessionDetail
• Related configuration settings: n/a

List of Fields in the Raw Agent Data

Field	Description	Data type	Unit	Example
SessionID	Unique identifier that is generated by the machine when the session is created. Will be reassigned to other sessions after logoff.	Number		3
SessionLogonTime	Time when the user logged on	String		2018-07-23 10:06:02
SessionProtocol	Used protocol. Possible values: Console, ICA, RDP, PCoIP, Blast, Protocol [ID]	String		ICA
SessionConnectionState	Connection state. Possible values are: active, connected, connecting, shadowing,disconnected, idle, listening, reset, down, initializing, unknown, Unsupported state: [ID]	String		active
SessionProcessCount	Process count	Number		34
SessionCPUTimeMs	Consumed CPU time	Number	ms	3000
SessionCPUUsagePercent	CPU usage	Number	%	29
SessionIOPS	I/O operations per second	Number		500
SessionIOCount	I/O operations count	Number		300
SessionIOMB	I/O operations data volume	Number	MB	20
SessionIOLatencyMs	I/O operations latency	Number	ms	300
SessionWorkingSetMB	Physical RAM allocation	Number	MB	450.2
SessionNetKBPS	Generated network traffic	Number	KB	21
SessionUser	User name	String		Domain\JohnDoe
SessionGUID	Unique identifier that is generated by uberAgent when the session is created. Valid for this session only.	String		00000002-f295-9109-e7c7-c964011dd401
SessionRpLatencyMs	Represents the latency of remoting protocols of a user’s session. Field is filled with the latency in ms at collection time. If the protocol is ICA, uberAgent uses the perfmon counter Latency – Last Recorded as the source. This metrik is different from Citrix Round-Trip-Time. More information.	Number	ms	300
SessionClientMac	Client MAC address. Only collected for VMware sessions.	String		AC-ED-5C-02-F0-30
SessionClientIp	Client IP address	String		192.168.178.40
SessionClientName	Client name	String		Client1
SessionClientDomain	Client Active Directory domain	String		vastlimits.com
SessionClientUser	Client user name	String		JohnDoe
SessionClientUserDomain	Client user Active Directory domain	String		Domain
SessionHRes	Horizontal resolution	String		1920
SessionVRes	Vertical resolution	String		1080
SessionColorDepth	Color depth	String		32
SessionClientPlatform	Client platform	String		Windows
SessionClientVersion	Client version	String		13.0.0.256735
SessionClientOsLanguage	Client operating system language	String		en-us
SessionPublishedName	Published resource’s name. This resource was used to initiate the session.	String		Google Chrome
SessionPublishedAppsCtx	List of used Citrix published apps in one session	String		Word Excel
SessionAppStateCtx	Application state. Possible values: n/a, active, pre-launched, lingering, app not running, unsupported. Citrix only.	String		lingering
SessionEncryptionCtx	Used encryption.Possible values: unknown, basic, logon, 40 bit, 56 bit, 128 bit, SecureICA, unsupported. Citrix only.	String		SecureICA
SessionClientTypeCtx	Client type. Possible values: WI, ICA Client. Citrix only.	String		WI
SessionBrokerDnsVmw	Broker DNS name. VMware only.	String		HorizonCS.vastlimits.com
SessionBrokerUrlVmw	Broker URL. VMware only.	String		https://192.168.8.6:443
SessionBrokerTunneledVmw	Indicates if session is tunneled. Possible values: true, false. VMware only.	String		true
SessionBrokerTunnelUrlVmw	The URL of the View Connection Server tunnel connection. VMware only.	String		https://HorizonCS.vastlimits.com:443
SessionBrokerRemoteIpVmw	Client IP address. VMware only.	String		192.168.178.40
SessionBrokerUserVmw	User name. VMware only.	String		John
SessionBrokerDomainVmw	User domain name. VMware only.	String		Doe
SessionClientTimezoneVmw	Client timezone. VMware only.	String		Europe/Italy
SessionClientIdVmw	Client ID. VMware only.	String		c47c60cf41ec44829ff91e1822b24dd8
SessionTypeVmw	Session type. Possible values: application, desktop. VMware only.	String		application
SessionBrokerType	Broker type. Possible values: Citrix, Microsoft, VMware, none, unknown, Unsupported broker: [1]	String		Citrix
SessionFgAppId	Foreground application ID. Used by uberAgent to lookup application names and populate field SessionFgAppName.	String		GglChrm
SessionFgAppVersion	Foreground application version	String		67.0.3396.99
SessionFgProcessName	Foreground process name	String		chrome.exe
SessionFgProcessId	Foreground process ID	Number		456
SessionClientHwIdCtx	Client hardware ID. Citrix only.	Number		409D39C2
SessionFgBrowserType	Foreground browser. Possible values: 0, 1, 2	Number		1
SessionFgBrowserActiveTabHost	The URL used in the foreground browser’s active tab	String		uberagent.com
SessionFgWindowTitle	The title of the active foreground window	String		Search | Splunk 7.2.1 – Google Chrome

List of Calculated Fields

Field	Description	Data type	Unit	Example	Where available
AppName	Application name. Source is the field SessionFgAppName.	String		Google Chrome	Splunk data model, Splunk SPL
SessionCPUTimeS	Consumed CPU time	Number	s	3	Splunk data model
SessionIODurationMs	I/O operations duration	Number	ms	90000	Splunk data model
SessionRAMUsagePercent	RAM usage	Number	%	34	Splunk data model
User	User name	String		DomainJohnDoe	Splunk data model
SessionUserExpanded	User name	String		DomainJohnDoe	Splunk SPL
SessionUserLower	User name converted to lower case	String		domainjohndoe	Splunk data model
SessionDisplaySpecs	SessionHRes + “x” + SessionVRes + “x” + SessionColorDepth	String		1920x1080x32	Splunk data model
SessionPublishedAppsCtxSplit	List of used Citrix published apps in one session split by semicolon	String		Word;Excel	Splunk data model
SessionPublishedAppsCtxSplitLower	List of used Citrix published apps in one session split by semicolon converted to lower case	String		word;excel	Splunk data model
SessionFgAppName	Foreground application name	String		Google Chrome	Splunk data model, Splunk SPL
SessionFgBrowserDisplayName	Foreground browser name. Possible values: Unknown, Chrome, Internet Explorer	String		Chrome	Splunk data model, Splunk SPL

Session Count

uberAgent collects the total session count.

Details

• Source type: uberAgent:Session:SessionCount
• Used in dashboards: n/a
• Enabled through configuration setting: SessionCount
• Related configuration settings: n/a

List of Fields in the Raw Agent Data

Field	Description	Data type	Unit	Example
SessionCount	Session count	Number		10