EdgeSight: What’s the Point?

Intro

In my experience, EdgeSight is not typically deployed in XenApp environments. The reasons for this are many including, it seems redundant and overlaps with an already installed solution, it’s hard to use (sorry Citrix, this is a great tool, but it almost requires a dedicated resource to manage it), most XenApp administrators/managers do not know why or how it should be used, and finally you need a platinum license in order to run the agent in advanced mode which is a deal-breaker for some companies.

In this post, I will cover a use case for EdgeSight that measures memory utilization of IE after a registry change is made.

Why Internet Explorer will kill your memory

Trond Eirik Haavarstein at XenAppBlog wrote a 2-part series on running Internet Explorer 7 or 8 in a terminal server environment and its impact on memory utilization. He shows how memory is used by multiple tabs in IE and references an MSDN Blog about a registry change that will modify the Tab Process Growth.

Any XenApp/Terminal Services environment is an exercise in resource management so we wanted to apply this change in our staging environment (prior to applying it in production) to determine if it will have a positive impact.

EdgeSight – Oh I get it!

After applying the registry change via a GPO, we waited a few days in order to gather enough data in EdgeSight to make a before/after comparison. Now we will walk through selecting the report we need and running it with the correct criteria.

Log into EdgeSight and go to the Browse Tab to select the report we need:

image

Here’s what you see (click on the picture to make it bigger)…

image

What! 143 reports? How do I get what I need? Well, we need to report on the performance of Internet Explorer. EdgeSight refers to applications as processes.  These can be executables launched by users (published applications) or processes run by system accounts. Click on Process under the Object Type table. Now we see (click on the picture to make it bigger)…

image

We’ve filtered our report list to just 33 items. If we wish to further filter our results, we can select Historical for the time frame and Performance for Data Type which gives us 15 reports to look through.  Since we know we’re looking for a report related to memory, we could have just as easily typed “memory” in the search field which gives us the following…

image

Then click on Processes for the Object Type would give us just 3 results…

image

You can see that you can narrow your choices in a couple of different ways.  The report we need is the Process Memory Usage. Let’s click on this report and see what the default result is.

image

As you can see above, we are looking at the entire environment monitored by EdgeSight and looking at the top 20 processes for the past week. The resulting report is grouped by Process, then Device, and then user…

image

We need to narrow the parameters of this report to give us the info we need for Internet Explorer…

We can first choose to limit the Department to just our XenApp servers where we made the registry change. Next we can hit the Category drop down and select Web Browsers.

image

If you only have IE installed on your XenApp servers, this makes it easy. Otherwise, you will have to check the Optional Parameters and find the process in the Process Picker Window…

image

Type iexplore.exe into the Filter window, make sure the By File Name radio button is checked and click filter

image

Select it and click Ok. Now Internet Explorer is the selected process in the Optional Parameters section.

image

Clicking on Go will show us the top 20 instances of Internet Explorer’s usage of Virtual, Private, and Working Set memory over the period of 3/22 to 3/29. For a detailed explanation of memory, I would refer to Mark Russinovich’s blog post here.

image

We want to track the change in memory usage over time, so we have to modify how the data is grouped. Changing the grouping to Date, Process, and All gives us the following:

image

Now it’s a matter of selecting the correct dates and comparing the results to show how the change we made has positively impacted IE memory usage.

Here are the results I recorded with EdgeSight in our staging environment:

Before:

After:

image

I found that the IE memory footprint was reduced by 10,000 – 30,000 kb after applying the registry change. That works out to around 10-30 MB per user which isn’t too bad in shared environment.

Have you tried this registry change and if so what was your result? How did you measure it? Comment Below

Thanks,
Alain

Advertisements

Article: CTX131172 – Hotfix ES540ServerWX64001 (Version 5.4.6.3) – For Citrix EdgeSight 5.4 Server x64

CTX131172 – Hotfix ES540ServerWX64001 (Version 5.4.6.3) – For Citrix EdgeSight 5.4 Server x64

Link to x86 version: CTX131171 – Hotfix ES540ServerWX86001 (Version 5.4.6.3) – For Citrix EdgeSight 5.4 Server x86

Important Note(s)

Caution! This release may require you to edit the registry. Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

Where to Find Documentation

This document describes the issue(s) resolved by this release and includes installation instructions. For additional product information, see Citrix eDocs, the Citrix Product Documentation Library.

New Fixes in This Release

  1. Uploading the payload results in the following error message due to the violation of primary key constraint:

    “Cannot insert duplicate key in object ‘dbo.ctrx_session_autoreconnect’.”

    [From ES540ServerWX64001][#238149]

  2. When Worker 101 (Performance Upload) and Worker 2 (Database Maintenance) run at the same time, an upload is attempted even though the database is not available. Although the status of Worker 101 is displayed as successful, this situation results in the following payload error:

    “Invalid payload, no ENV data found”

    [From ES540ServerWX64001][#242200]

  3. When exporting the Session Counts report to Microsoft Excel, the exported data displays “#Value!” in the peak columns.

    [From ES540ServerWX64001][#253058]

  4. If multiple users connect to different XenApp servers and are assigned the same session id by the terminal server, the payload from one XenApp Server can overwrite the principal id of the other XenApp Server, resulting in incorrect EdgeSight report data.

    [From ES540ServerWX64001][#253168]

  5. Users can run the “Assets for a Device” report against devices for which they do not have user permissions.

    [From ES540ServerWX64001][#256871]

  6. If the initial attempt to upgrade a server from EdgeSight Version 5.2 to Version 5.3 or later fails, an error might occur when making subsequent upgrade attempts. The following error message appears in the MSI log:

    “Error -2147217900: failed to execute SQL string, error detail: Ambiguous column name ‘appid’., SQL key: SchemaPost530”

    [From ES540ServerWX64001][#LA0402]

  7. Running any of the following reports on Version 5.4 of EdgeSight Web server (Version 5.4.0.5107 or earlier) in the EdgeSight database might generate errors messages:

    • Process Errors
    • Process Errors for a User Group
    • Process Faults
    • Process Faults for a User Group

    The following error messages are observed:

    • An error occurred during the client rendering
    • An error has occurred during the report processing (rsProcessingAborted)
    • Cannot read the next data row for the dataset edgesight (rserrorreadingnextdatarow)
    • Arithmetic over flow error converting expression to data type int

    This occurs when the ID generated by the alert table (alert ID) exceeds the maximum integer value (2147483648).

    [From ES540ServerWX64001][#LA0760]

Fixes from Replaced Hotfixes

No hotfixes were replaced by this release.

Installing This Release

Notes:

  • This version is packaged as a .zip file containing the replacement EdgeSightServerx64.msi file and Setup.exe file. For more information about deploying msi files, see Microsoft article 884016 or visit the Microsoft Web site and search on keyword msiexec.
  • To install this version successfully, servers must not have registry modification restrictions in place.

To install this version:

  1. Copy the file to a shared folder on the network.
  2. Extract the compressed file and save the EdgeSightServerx64.msi file and Setup.exe file on the computer you want to update.
  3. Run the Setup.exe file.
  4. Restart the computer if prompted to do so.

If it does not exist already, this will add a new entry, Citrix EdgeSight Server, to the Add/Remove Programs list.

This document applies to:

  • EdgeSight for XenApp 5.4

Thanks,
Alain

Article: Issues Fixed in EdgeSight 5.4

Update: This article was updated on March 10, 2012.

CTX129528 – EdgeSight 5.4 – Issues Fixed in This Release – Citrix Knowledge Center.

Citrix EdgeSight 5.4

Issues Fixed in This Release

Product: EdgeSight for XenApp 6; EdgeSight for XenApp; EdgeSight for Virtual Desktops; EdgeSight for Endpoints, EdgeSight Server
Current Product Version: 5.4
Previous Product Version: 5.3
Language: English (EN)
Fixed Issues List: 1.01

Revision History

Version Date Change Description
1.01 December, 2011 Documentation update
1.00 August, 2011 Initial release

Contents of This Release

The EdgeSight 5.4 release includes two updated components:

  • EdgeSight Server 5.4 (32-and 64-bit versions)
  • EdgeSight for XenApp 6 Agent 5.4 (64-bit only, due to the underlying Windows Server 2008 R2 operating system) – This agent replaces the EdgeSight for XenApp 6 Agent 5.3

The remaining components were not changed as part of the EdgeSight 5.4 release. Instead, the EdgeSight 5.4 release media included the most recent version of these components available at the time, as indicated below:

  • EdgeSight for XenApp Agent 5.3 Hotfix 4
  • EdgeSight for Endpoints Agent 5.3 Hotfix 2
  • EdgeSight for Virtual Desktops Agent 5.3 Hotfix 2
  • EdgeSight Agent Database Server 5.3
  • EdgeSight Active Application Monitoring (AAM) 5.3 SP2

To download the latest hotfixes, go to http://support.citrix.com/ and search for EdgeSight hotfix.

Issues Fixed in This Release

The following issues have been fixed since the previous release of this product. For information about new features and system requirements, see Citrix eDocs, the Citrix Product Documentation Library.

EdgeSight Agents:

EdgeSight for XenApp 6 Agent 5.4, 64-bit only

(These fixes were previously available in Hotfix ES530XA6AgentWX64004)

x64 only

Fix#

Description

x

234109

When an EdgeSight Agent upgrade is performed using the MSIEXEC command line, some registry values may be corrupted and the System Monitoring Service will not start.

x

234262

EdgeSight for XenApp Agent in Basic mode stops and records the following application log entry:

“Event ID : 41 The Citrix System Monitoring Agent can not run in reduced mode on a non Enterprise server.”

x

234266

Session Performance alerts are not generated when the poll interval selected is 360 seconds.

x

234273

After upgrading from XenApp Enterprise to XenApp Platinum Edition, the EdgeSight Agent remains in “Basic” mode instead of being upgraded to “Advanced” mode automatically. The upgrade also removes the Mode tab, making it impossible to upgrade the agent manually. This fix restores the Mode tab, allowing for the agent mode to be set manually.

x

239632

If the scheduled job for daily data deletion and the database maintenance worker run at the same time, the EdgeSight Agent hangs and is restarted.

x

240693

Large amounts of data were generated when monitoring Windows Event Log alerts. Event log alert data can be throttled using registry keys located at HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\4.00. There is one registry key per event log (System, Application, and Security). The registry key type is DWORD.

  • MaxSysEventLogThreshold
  • MaxAppEventLogThreshold
  • MaxSecEventLogThreshold

Specify a value to indicate the maximum number of event log messages allowed per 10 minute window. Event log alerts can be throttled to zero. Any missing value will be considered as unlimited, meaning that no throttling will be applied to alerts for the corresponding event log.

This feature is only included in EdgeSight 5.3. In future releases, the registry key will be ignored and an equivalent function will be available from the EdgeSight Server console.

x

241240

The XenApp server was slow to restart or logoff after upgrading the HP System Management Homepage to version 6.1.0.102.

x

242578

The EdgeSight Agent can exit unexpectedly with the following error:

“The application attempted to release a resource it did not own, ntdll!RtlpNotOwnerCriticalSection+0xac invoked by SemsCollector (SemsPerf, SessionDef).”

x

242580

Version 5.3 (or 5.3, Build 4109) of the EdgeSight Agent can exit unexpectedly with the following error:

“INVALID_POINTER_READ_c0000005_es_ext.dll!CProcessCounterSet::IterThreads.”

x

242581

Thread Hang Detection is tripped repeatedly resulting in an error message (“The queue thread has stopped responding” or “The Scheduler thread has stopped responding”) and a restart of the EdgeSight agent.

x

244070

Published application information is not collected when the application is launched from a script, for example a file with .cmd extension. This fix is dependent on the installation of hotfix EUEM100W001, which addresses the underlying EUEM issue for Windows Server 2003 32-bit and 64-bit systems.

x

244661

When the EdgeSight agent is started and worker 128 has run, the associated worker log file shows an undefined variable error.

x

245683

The EdgeSight Agent service (rscorsvc.exe) is terminated unexpectedly.

x

245749

The EdgeSight Agent service (rscorsvc.exe) experiences memory leaks.

x

249004

In the Session Memory report, data can be missing from the Virtual, Private and Working Set columns.

x

254596

The EdgeSight Agent can exit unexpectedly.

x

257898

When processing a payload (for example, from a shadow session), the EdgeSight server registers the following error message in the core_zpd_loader log and administrative emails:

“Cannot insert the value NULL into column ‘app_name’, table ‘EdgeSight.dbo.ctrx_published_app’.”

x

258478

The EdgeSight for XenApp Agent can exit unexpectedly with the following error:

“(0xc0000005 – The instruction at 0x%08lx referenced memory at 0x%08lx- generic symptom of following a null pointer).”

EdgeSight for XenApp Agent 5.3 Hotfix 4

(Hotfix ES530XAAgentWX86004 and ES530XAAgentWX64004)

x86

x64

Fix#

Description

x

x

234028

The EdgeSight for XenApp Agent, Version 5.3, crashes repeatedly if the XenApp server is licensed using the server property set in the Access Management Console (AMC).

x

x

234109

When an EdgeSight Agent upgrade is performed using the MSIEXEC command line, some registry values may be corrupted and the System Monitoring Service will not start.

x

x

234262

EdgeSight for XenApp Agent in Basic mode stops and records the following application log entry:

“Event ID : 41 The Citrix System Monitoring Agent can not run in reduced mode on a non Enterprise server.”

x

x

234266

Session Performance alerts are not generated when the poll interval selected is 360 seconds.

x

x

234273

After upgrading from XenApp Enterprise to XenApp Platinum Edition, the EdgeSight Agent remains in “Basic” mode instead if being upgraded to “Advanced” mode automatically. The upgrade also removes the Mode tab, making it impossible to upgrade the agent manually. This fix restores the Mode tab, allowing for the agent mode to be set manually.

x

x

239632

If the scheduled job for daily data deletion and the database maintenance worker run at the same time, the EdgeSight Agent hangs and is restarted.

x

x

240693

Large amounts of data were generated when monitoring Windows Event Log alerts. Event log alert data can be throttled using registry keys located at HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\4.00. There is one registry key per event log (System, Application, and Security). The registry key type is DWORD.

  • MaxSysEventLogThreshold
  • MaxAppEventLogThreshold
  • MaxSecEventLogThreshold

Specify a value to indicate the maximum number of event log messages allowed per 10 minute window. Event log alerts can be throttled to zero. Any missing value will be considered as unlimited, meaning that no throttling will be applied to alerts for the corresponding event log.

This feature is only included in EdgeSight 5.3. In future releases, the registry key will be ignored and an equivalent function will be available from the EdgeSight Server console.

x

241240

The XenApp server was slow to restart or logoff after upgrading the HP System Management Homepage to version 6.1.0.102.

x

x

242578

The EdgeSight Agent can exit unexpectedly with the following error:

“The application attempted to release a resource it did not own, ntdll!RtlpNotOwnerCriticalSection+0xac invoked by SemsCollector (SemsPerf, SessionDef).”

x

x

242580

Version 5.3 (or 5.3, Build 4109) of the EdgeSight Agent can exit unexpectedly with the following error:

“INVALID_POINTER_READ_c0000005_es_ext.dll!CProcessCounterSet::IterThreads.”

x

x

242581

Thread Hang Detection is tripped repeatedly resulting in an error message (“The queue thread has stopped responding” or “The Scheduler thread has stopped responding”) and a restart of the EdgeSight agent.

x

x

244070

Published application information is not collected when the application is launched from a script, for example a file with .cmd extension. This fix is dependent on the installation of hotfix EUEM100W001, which addresses the underlying EUEM issue for Windows Server 2003 32-bit and 64-bit systems.

x

x

244661

When the EdgeSight agent is started and worker 128 has run, the associated worker log file shows an undefined variable error.

x

x

245683

The EdgeSight Agent service (rscorsvc.exe) is terminated unexpectedly.

x

x

245749

The EdgeSight Agent service (rscorsvc.exe) experiences memory leaks.

x

x

249004

In the Session Memory report, data can be missing from the Virtual, Private and Working Set columns.

x

x

254596

The EdgeSight Agent can exit unexpectedly.

x

x

257898

When processing a payload (for example, from a shadow session), the EdgeSight server registers the following error message in the core_zpd_loader log and administrative emails:

“Cannot insert the value NULL into column ‘app_name’, table ‘EdgeSight.dbo.ctrx_published_app’.”

x

x

258478

The EdgeSight for XenApp Agent can exit unexpectedly with the following error:

“(0xc0000005 – The instruction at 0x%08lx referenced memory at 0x%08lx- generic symptom of following a null pointer).”

EdgeSight for Endpoints Agent 5.3 Hotfix 2

(Hotfix ES530EPAgentWX86002 and ES530EPAgentWX64002)

x86

x64

Fix#

Description

x

x

234109

When an EdgeSight Agent upgrade is performed using the MSIEXEC command line, some registry values may be corrupted and the System Monitoring Service will not start.

x

x

234266

Session Performance alerts are not generated when the poll interval selected is 360 seconds.

x

x

239632

If the scheduled job for daily data deletion and the database maintenance worker run at the same time, the EdgeSight Agent hangs and is restarted.

x

x

240693

Large amounts of data were generated when monitoring Windows Event Log alerts. Event log alert data can be throttled using registry keys located at HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\4.00. There is one registry key per event log (System, Application, and Security). The registry key type is DWORD.

MaxSysEventLogThreshold

MaxAppEventLogThreshold

MaxSecEventLogThreshold

Specify a value to indicate the maximum number of event log messages allowed per 10 minute window. Event log alerts can be throttled to zero. Any missing value will be considered as unlimited, meaning that no throttling will be applied to alerts for the corresponding event log.

This feature is only included in EdgeSight 5.3. In future releases, the registry key will be ignored and an equivalent function will be available from the EdgeSight Server console.

x

241240

The XenApp server was slow to restart or logoff after upgrading the HP System Management Homepage to version 6.1.0.102.

x

x

242581

Thread Hang Detection is tripped repeatedly resulting in an error message (“The queue thread has stopped responding” or “The Scheduler thread has stopped responding”) and a restart of the EdgeSight agent.

x

x

245683

The EdgeSight Agent service (rscorsvc.exe) is terminated unexpectedly.

x

x

245749

The EdgeSight Agent service (rscorsvc.exe) experiences memory leaks.

EdgeSight for Virtual Desktops Agent 5.3 Hotfix 2

(Hotfix ES530VDAAgentWX86002 and ES530VDAAgentWX64002)

x86

x64

Fix#

Description

x

x

234109

When an EdgeSight Agent upgrade is performed using the MSIEXEC command line, some registry values may be corrupted and the System Monitoring Service will not start.

x

x

239632

If the scheduled job for daily data deletion and the database maintenance worker run at the same time, the EdgeSight Agent hangs and is restarted.

x

x

240693

Large amounts of data were generated when monitoring Windows Event Log alerts. Event log alert data can be throttled using registry keys located at HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\4.00. There is one registry key per event log (System, Application, and Security). The registry key type is DWORD.

  • MaxSysEventLogThreshold
  • MaxAppEventLogThreshold
  • MaxSecEventLogThreshold

Specify a value to indicate the maximum number of event log messages allowed per 10 minute window. Event log alerts can be throttled to zero. Any missing value will be considered as unlimited, meaning that no throttling will be applied to alerts for the corresponding event log.

This feature is only included in EdgeSight 5.3. In future releases, the registry key will be ignored and an equivalent function will be available from the EdgeSight Server console.

x

241240

The XenApp server was slow to restart or logoff after upgrading the HP System Management Homepage to version 6.1.0.102.

x

x

242581

Thread Hang Detection is tripped repeatedly resulting in an error message (“The queue thread has stopped responding” or “The Scheduler thread has stopped responding”) and a restart of the EdgeSight agent.

x

x

245683

The EdgeSight Agent service (rscorsvc.exe) is terminated unexpectedly.

x

x

245749

The EdgeSight Agent service (rscorsvc.exe) experiences memory leaks.

EdgeSight Server 5.4

(These fixes were previously available in Hotfix ES530ServerWX86002 and ES530ServerWX64002)

x86

x64

Fix#

Description

x

x

233723

The Process Faults and Process Faults for a User Group reports are formatted much too wide.

x

x

233724

The EdgeSight installer replaces the value for the EdgeSight Web Server address (ZTECH_WEB_ADDR) during an upgrade installation instead of retaining the original value. During an upgrade, a customized EdgeSight Server name is overwritten.

x

x

233727

The IMA Service Availability report does not account for the last hour of the last day in the reporting period.

x

x

233735

The IMA Service Availability report does not filter by Device name.

x

x

233736

The maximum value of the System calls per second parameter in an alert (System Low Resources and System Performance alert rules) is limited to 200000.

x

x

233737

A payload update from an EdgeSight for XenApp agent might fail with the following error: Violation of PRIMARY KEY constraint ‘PK_ctrx_published_app_event_1’.

x

x

233740

User cannot configure the EdgeSight Server name to match an SSL certificate or to generate an FQDN URL for email notification for alerts. To set the EdgeSight Server name, open the EdgeSight Server Console, select the Configure tab, navigate to Server Configuration > Settings, select the Notifications tab, and enter the FQDN for the server in the EdgeSight Server field.

x

x

234275

If an EdgeSight Server 5.3 upgrade installation has failed, a subsequent upgrade attempt will fail and not be rolled back properly due to the existance of the ctrx_published_app_temp table. Simply installing this hotfix will not resolve the problem once this situation has occurred. You must restore a backup of the previous Edgesight database and then run the hotfix installation.

x

x

237544

Additional fix for issue where a payload update from an EdgeSight for XenApp agent might fail with the following error: Violation of PRIMARY KEY constraint ‘PK_ctrx_published_app_event_1’.

x

x

240210

The IMA Service State report displayed the time in coordinated universal time (UTC) rather than in the timezone assigned in the Company settings.

x

x

240540

SNMP alerts sent from EdgeSight have an object identifier (OID) value that does not match the value defined in the EdgeSight MIB file.