Logon performance difference between uberAgent and Citrix Director


I'm having some questions regarding the logon performance metrics collected by uberAgent:

At times, the differences of total logon duration between our two monitoring products, uberAgent and Citrix Director are very large. For example: a user could have a total logon time of 90 seconds in Director and if you take a look at the same session in the uberAgent, this reflects as 21 seconds. I have a feeling that uberAgent mostly tells us that the logon performance is actually quite a bit worse than Citrix Director would tell.

This makes us sometimes worry about a performance issue that really is not there. 

My second question is when you add up all the time of the subsections of a logonsession (fe pre-logon init, user profile, group policy, shell start...) you never seem to get the total duration. Is there some kind of interim time between those seperate steps? Could this "interim time" be visualized somewhere?

1 comment

  • Avatar
    Dominik Britz Official comment

    Hi Sven,

    There is no event in Windows that says "logon has finished". Every monitoring product has to define the end of a logon on its own. For uberAgent that's when the shell is fully initialized.

    As for your second question. Total logon duration is defined as the time from the actual logon until the shell is fully initialized. See here. It's not the sum of individual phases. To get the difference, you could do something like the following in Splunk. It takes the data table at the bottom of the User Logon Duration dashboard as a base and ads the field Difference.

    | pivot `uA_DM_Logon_LogonDetail` Logon_LogonDetail
    latest(User) as User
    latest(host) as Host
    values(SessionLogonTime) as SessionLogonTime
    sum(TotalLogonTimeMs) as TotalLogonTimeMs
    sum(ProfileLoadTimeMs) as ProfileLoadTimeMs
    sum(GroupPolicyTotalProcessingTimeMs) as GroupPolicyTotalProcessingTimeMs
    sum(ADLogonScriptTimeMs) as ADLogonScriptTimeMs
    sum(GroupPolicyLogonScriptTimeMs) as GroupPolicyLogonScriptTimeMs
    sum(ShellStartupTimeMs) as ShellStartupTimeMs
    filter SessionLogonTime is "*"
    | eval ProfileLoadTimeMs = coalesce(ProfileLoadTimeMs,0)
    | eval GroupPolicyTotalProcessingTimeMs = coalesce(GroupPolicyTotalProcessingTimeMs,0)
    | eval ADLogonScriptTimeMs = coalesce(ADLogonScriptTimeMs,0)
    | eval GroupPolicyLogonScriptTimeMs = coalesce(GroupPolicyLogonScriptTimeMs,0)
    | eval ShellStartupTimeMs = coalesce(ShellStartupTimeMs,0)
    | eval TotalLogonTimeMs = coalesce(TotalLogonTimeMs,0)
    | eval Difference = round((TotalLogonTimeMs - ProfileLoadTimeMs - GroupPolicyTotalProcessingTimeMs - ADLogonScriptTimeMs - GroupPolicyLogonScriptTimeMs - ShellStartupTimeMs) / 1000,2)
    | eval "Logon time"=strftime(strptime(SessionLogonTime,"%Y-%m-%d %H:%M:%S.%Q %z"), "%Y-%m-%d %H:%M:%S")
    | eval "Total duration"=round(TotalLogonTimeMs/1000,2)
    | eval "User profile"=round(ProfileLoadTimeMs/1000,2)
    | eval "Group policy"=round(GroupPolicyTotalProcessingTimeMs/1000,2)
    | eval "AD logon script"=round(ADLogonScriptTimeMs/1000,2)
    | eval "GP logon script"=round(GroupPolicyLogonScriptTimeMs/1000,2)
    | eval "Shell start"=round(ShellStartupTimeMs/1000,2)
    | eval sortfield=lower('Logon time')
    | sort limit=0 -sortfield
    | table
    "Logon time"
    "Total duration"
    "User profile"
    "Group policy"
    "AD logon script"
    "GP logon script"
    "Shell start"

    The search above requires uberAgent 6. Let me know if you need it for version 5.3.1 or belower.


Please sign in to leave a comment.