Data Collection Setup

Metric are collected via the OData API on the Desktop Delivery Controller servers.
Detailed Session metrics are collected from the DDCs and VDAs via remote Powershell calls.

Network Requirements

Ports:

• 80 (TCP) HTTP or 443 (TCP) HTTPS to OData API on the Desktop Delivery Controller.
• 5986 (TCP) for WinRM is REQUIRED for Session Latency metrics

❗️

For Session Latency Metrics

WinRM is required for Session Latency metrics. This setup and network port must be available on DDC and All VDA systems in the Citrix Site.

Least Privileged User

The user must be a Windows domain user that is defined as a XenApp/XenDesktop administrator in Citrix Studio. The user requires read-only privileges; however, the data returned is determined by XenApp/XenDesktop administrator roles and permissions. See also: Citrix Product Documentation's Delegated Administration topic.

Session Latency Metrics Requirements

To enable collection of Session Latency Metrics the following setup is needed. Users must install a signed certificate and set up WinRM HTTPS on each VDA and DDC (XenDesktop Delivery Controller) as outlined in the following sub-topics:

Create a Signed Certificate for the System to be Monitored

Note the following requirements for the certificate:

• The certificate can be self-signed or signed by an authority.
• If self-signed, vROps must be told to ignore SSL verification.
• The certificate must include the private key for the system.

📘

PEX Format for the certificate.

If creating the certificate manually, the PEX format (which includes both a certificate and private key) is required by Windows.

Install the Certificate on the Target System

1. Open MMC (Microsoft Management Console).
2. Add Snap-in Certificates:
   Select File -> Add Snap-in.
   Select Certificates.
   Select Computer Account.
   Select Local computer.
3. Click OK.

Expand the Certificates Tree:

1. Select Personal/Certificates (or just Personal if /Certificates does not exist).
2. Right-click inside the directory and select:
   All tasks -> Import.
3. Locate your certificate, then click OK.

Install Certificate Authority Certificate (Optional):

If the certificate installed above was signed by an authority, you will need to install a trusted authority certificate, provided by your authority.

Under the Certificates (Local Computer) snap-in, select:

• Trusted Root Certificates/Certificates.
• Right-click and select All tasks -> Import.
• Navigate to your certificate authority's provided certificate, then click OK.
• Any system connecting to the target system with WinRM HTTPS will also need your root certificate authority’s certificate.

Enable WinRM (Required for Session Metrics)

Launch the Command Prompt as an Administrator (NOTE: Do not use PowerShell).

Execute the following command:
winrm quickconfig

This will enable HTTP listening by default (using port 5985). The HTTP listener can be removed later.

Find your Certificate Thumbprint:

• Open the mmc snap-in and find your personal certificate.
  *Double-click the certificate. On the details tab, find Certificate Thumbprint.

Create the HTTPS Listener:

Execute the following command:
winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname="<YOUR_DNS_NAME>"; CertificateThumbprint="<COPIED_CERTIFICATE_THUMBPRINT>"}

📘

YOUR_DNS_NAME must match what the certificate specifies. The COPIED_CERTIFICATE_THUMBPRINT must match the thumbprint found in the previous step.

Verify that WinRM is using HTTPS:

Execute the following command:
winrm enumerate winrm/config/listener

The default port used is 5986 (HTTPS). The default HTTP port is 5985.

Delete HTTP Listener (Optional):

Execute the following command:
winrm delete winrm/config/Listener?Address=*+Transport=HTTP

Reference: Commands to Enable Supported Authentication Mechanisms

For use with the WinRM session data collection configuration above.
Note the following commands can be used to enable the supported authentication mechanisms:

Basic
winrm set winrm/config/service/auth @{Basic="true"}

NTLM
winrm set winrm/config/service/auth @{Negotiate="true"}

Kerberos
winrm set winrm/config/service/auth @{Kerberos="true"}

Supported Versions

XenDesktop/XenApp:

• Citrix XenDesktop 7.1+ (VDI, Enterprise, and Platinum)
• Citrix XenApp 7.5+ (Advanced, Enterprise, and Platinum)
• Citrix Virtual Apps and Desktop is the new product name from Citirix for this product line and is supported. Version 1808+

Connection Parameters

---

Metrics

Application

Application Instance

Catalog

DDC Machine

Delivery Group

Desktop

Hypervisor

Session

Site

User

VDA Machine