http://www.brianmadden.com/forum/Welcome to Brian Madden.com Tech ForumAll rights reserveden-USbrian@brianmadden.comhttp://www.brianmadden.com/forumshttp://www.brianmadden.comTerminal Serviceshttp://www.brianmadden.com/Forum/Topic/102400
I am in the process of testing our new 64bit 2003 Citrix PS 4.5 servers and could do with some advice regarding folder redirection. We have 4 Citrix servers which are going to be load balanced, hence the need for roaming profiles and folder redirection.

I have setup the appropriate AD loopback and OU's.

What I want to know is if there is any problem in using the same path for users desktop and my documents and different paths for the app data. Users may log on to a fat client(XP SP3) or use thin clients and I want their desktops and my docs to be the same. I presumed the app data would conflict between XP and 2003.

Is this the best way to do this? Or should the app data path be the same for the XP box and the 2003?

Anyone tried this, it seems to work for me!

Thanks

JohnRead more:Group: Tech Support ForumsForum: Terminal Services]]>Mon, 01 Sep 2008 08:58:58 GMT102400Citrix Presentation Server / XenApphttp://www.brianmadden.com/Forum/Topic/102055Thu, 14 Aug 2008 14:50:14 GMT102055Citrix Presentation Server / XenApphttp://www.brianmadden.com/Forum/Topic/101952
I have farm of one metaframe server 4.0. I added one more metaframe server 4.0 to existing farm for load balancing and added that new server to my three published applications.load balancing is started from intranet but when any user use public IP address it gives error to two applicatns that ERROR: An error has occurred while connecting to the requested resource where as one application launched but always directed to old server. Now I am searching for a reliable solution if any one has please help me ASAP because it is quite critical to me. Waiting for reply
Read more:Group: Tech Support ForumsForum: Citrix Presentation Server / XenApp]]>Tue, 12 Aug 2008 01:39:45 GMT101952Citrix Presentation Server / XenApphttp://www.brianmadden.com/Forum/Topic/101437Hello,

If I wanted to see what the Load was on a given CPS box at a given time, what utility could I use to do that? I thought this was built in, but I'm starting to believe otherwise now.

Thanks in advance,
--MikeRead more:Group: Tech Support ForumsForum: Citrix Presentation Server / XenApp]]>Thu, 24 Jul 2008 10:26:12 GMT101437Citrix Presentation Server / XenApphttp://www.brianmadden.com/Forum/Topic/101436
I'm having an issue where users at a particular location cannot do session sharing. All other users in other locations all have the same Session ID when they open up multiple sessions published on the respective servers. I dont think its a client version issue because all the users have different versions ranging from 9 to 10. The servers are configured exactly the same way. I had to set the terminal server to 'Restrict each user to one session'. After making this change, each of their sessions have different Session ID's and they also wind up launching the multiple sessions that span more than one server. The other users are still able to do sessions sharing after this change. Any ideas?Read more:Group: Tech Support ForumsForum: Citrix Presentation Server / XenApp]]>Thu, 24 Jul 2008 10:16:22 GMT101436Citrix Presentation Server / XenApphttp://www.brianmadden.com/Forum/Topic/100818
This is my setup. Windows 2003 SP2, PS4.5 Fr1, SQL data store, default Load Eval.
After I reboot a Citrix server and do a Qfarm /load its giving a load of 10000, so it's unuseable. If I reboot the server again quickly it then reports correctly. I can reproduce this on every server i build. Effectively meaning I have to reboot the servers twice to get them to work.

I have patched with Rollup 2 and it seems to make the problem worse, sometimes no matter how many times I reboot it just won't get the load repoted correctly.

I have tried CTX112103 but with no joy. I've followed CTX112082 and can see it setting the DB table to 64(hex) =100 users for the Server user load counter.
If i look at the load monitor Server user load is saying 100%.

If I change the load Eval to advanced i get the same problem just with a different counter eg memory, or CPU

Anyone got any ideas?
CliffRead more:Group: Tech Support ForumsForum: Citrix Presentation Server / XenApp]]>Fri, 04 Jul 2008 05:49:33 GMT100818Citrix Presentation Server / XenApphttp://www.brianmadden.com/Forum/Topic/100760
Background:

Our current farm is win2k3 SP1/PS XP. Running $ Gb of memory.

Our ERP app is odd in that when you pull up sub applications and close them it keeps them in memory so the memory footprint of the app quickly baloons over the course of the day (from ~30Mb too 100-150 Mb)

I am migrating the old servers too PS 45, and adding a Win2k3R2 Ent server with 16 Gb of memory to the load balance group.

In my testing I am seeing 2 things

1) There is a bit more paging on the new server, from ~25 pages/sec on the old server too ~40 on the new server
2) The ammount of memory per session is actually less on the new server (From 95Mb avg too ~ 70 Mb). this is a rough calc based upon free memory/# of sessions


My question is this:

Has anyone else noticed a difference in how the enterprise memory manager handles paging in comparrison to standard? I guess it could be PS45 as well.

I can look at the working set of the app process for each session to see if it is paging more, but it would take alot of playing in perfmon to get an accurate assessment of this. If anyone knows for sure or could point me to any articles on the memory manager differences it would be very helpful.


Read more:Group: Tech Support ForumsForum: Citrix Presentation Server / XenApp]]>Tue, 01 Jul 2008 16:17:01 GMT100760Citrix Presentation Server / XenApphttp://www.brianmadden.com/Forum/Topic/100116
I'm troubleshooting a performance issue with a CPS farm that was migrated from CPS 3.0 to a new farm with CPS 4.5. Migration was really just a rebuild of all apps on new servers to a new farm. The CPS 3.0 farm is really just a performance reference.

The user complain of performance issues, typing delays, and disconnects on the new farm.

Summary of environment:

- ASP environment - essentially just one published app and MS Word in use
- CPS 4.5 (HRP-02) 32-bit servers running a very few published apps on W2K3 R2 SP2 - all server builds identical
- Data center houses Dell M600 blade center used for CPS farm - (2) quad core processors, 16 GB RAM per blade (these servers are new to this CPS 4.5 farm, old CPS 3.0 farm was on older rack mount Dell servers)
- ICA sessions are established via a static ICA file and are load balanced using an F5 Big-IP load balancer with sticky sessions (persistence) enabled
- CPS servers (blade center) are in a DMZ along with file server cluster, AD DCs are on inside LAN.
- Appropriate ports have been opened between DMZ and inside LAN for AD authentication.
- Client PCs run web client and static ICA file is launched via a custom web portal (in other words, connections don't actually go through a WI server, instead all ICA sessions target a FQDN that resolves to the VIP of the Big-IP load balancer)
- Citrix UPD is used exclusively
- Folder redirection in place with redirection of My Docs and Desktop to share on clustered file server (FC SAN - Dell CX400)
- TS Roaming profiles in use, hundreds of users but only 200 concurrent users max load balanced across farm.

Initially, the farm was built out with 64-bit CPS 4.5 servers where the performance issues arose. There was a good deal of troubleshooting done and issues with Citrix UPD on 64-bit OS were resolved yet performance issues continued. At first, troubleshooting revealed a problem with network connectivity on the edge as not all users were complaining (appeared to be limited to high latency, low bandwidth connections on edge). However, turned out that more users began to complain even from remote locations that had low latency, high bandwidth pipes. Perf mon analysis revealed that local disk I/O was getting queued too often and % disk idle was too low - other counters (CPU, network I/O, paging, memory, etc) OK. Upgrade of firmware and drivers appeared to have resolved the local disk I/O issues (although M600 blades do not have write caching). Again, focus was network issues, so we put in place bandwidth restrictions via Citrix policy. Unfortunately, performance issues persisted. The old CPS 3.0 farm never exhibited these issues, but servers were not blades; however, the Big-IP was load balancing that farm too.

Client decided to rebuild the entire farm with 32-bit CPS 4.5 instead, blaming the published app. Unfortunately, the 32-bit farm is showing the same issues as the 64-bit farm was. One blade server removed from the VIP pool on the Big-IP and targetted directly (tweaked host file) showed no performance issues; however, the user count on that box was pretty low (only 25 users - long story). As before farm rebuild, CPS servers in the VIP pool are suffering from performance issues yet Perf mon analysis shows no issues.

Attention is focused again on network infrastructure - this time in the data center, but it's proving difficult to troubleshoot. Also, new Dell M600 blade servers are suspect, but it's not currently possible to directly target a blade server with 60 user sessions outside of the VIP pool of the Big-IP. The reason is that all user's reference the same ICA file that in turn references a public FQDN that resolves to VIP of the Big-IP, so targetting a single server requires inserting an entry in the host file on the client side to override the public DNS resolve. My client doesn't want to make these client side changes.

Ideally, I would like to get the Big-IP load balancer out of the equation by implementing a CSG/WI server; however, I don't think this will work with a static ICA file for launching sessions due to STA ticket expiry issues. So, my client cannot abandon the use of the static ICA file launching the app for now as users are accustomed to launching published app via web portal and AD credentials are embedded within the ICA file (not secure, I know).

Help!!!

Any ideas would be greatly appreciated.
Read more:Group: Tech Support ForumsForum: Citrix Presentation Server / XenApp]]>Mon, 09 Jun 2008 15:45:10 GMT100116Citrix Presentation Server / XenApphttp://www.brianmadden.com/Forum/Topic/99574
I'm still a newbie to this forum but I wanted to share with you a technology I discovered that blew me away when I first saw it in action. We are currently testing it in Citrix/RDP environments to see what level of improvement we can generate.

I just finished a great blog post and video on it:

http://www.tredent.com/RAIDforWANs/

We also included some of our extensive test results. This is a technology you have to take a look at.

Would love to get your feedback!


Justin Lofton
VP of Engineering
Tredent Data Systems, Inc.
justinl@tredent.com
V: 1-866-873-3368 x317
M: 1-818-254-7013

Facebook: http://profile.to/justinlofton
Linkedin: http://www.linkedin.com/in/justinlofton
Twitter: http://twitter.com/JustinLofton

Grab your hard copy of the Aberdeen Report - http://www.tredent.com/free-report/
Read more:Group: Tech Support ForumsForum: Citrix Presentation Server / XenApp]]>Wed, 21 May 2008 23:24:35 GMT99574Citrix Presentation Server / XenApphttp://www.brianmadden.com/Forum/Topic/99413

Environment: PS4.0 RollUp 4, Windows Server 2003 SP2. Servers spread across multiple subnets in the same server room. All of the servers are in the same zone.

The load for this server (qfarm /app appname) shows it to be the least loaded (1300 as opposed to 4500 on the other servers). Qfarm /load also reports it to be least loaded (1300). Users should be directed to this server.

We are using the Default load evaluator on all of the servers. The published application (Application type: desktop) does not have any load evaluators assigned.


When looking at the "Load Manager Monitor" for this server the Load Evaluator and Rule percentages are different. They will stay equal for a while (Load Evaluator: 13.0 %, Rule: 13.0%) then when a user logs on they will change (Load Evaluator: 14.0%, Rule: 13.0%). This looks to be normal whan a user logs on as I see this behavior from the other servers. However, the other servers will soon change to where the Load Evaluator and the Rule are the same percentage again. On the problem server these numbers never come back into alignment.


If I restart the IMA service the numbers will come into alignment and the server will take on a few more users (2 - 3 more users within 3 minutes, none after that). I have used the registry settings to disable ILB. This tends to make the server take more users for a longer period of time(8 - 10 minutes). I've also tried to adjust the ILBMultiplier (with ILB enabled), as well as adjusting the LoadBias, all suggestions from CTX112082.


Presentation Server 4.0 has been removed and reinstalled. The local host cache has been recreated many times. The only thing that seems to work is restarting the IMA service every few minutes. Any suggestions would be appreciated.Read more:Group: Tech Support ForumsForum: Citrix Presentation Server / XenApp]]>Fri, 16 May 2008 10:32:56 GMT99413Virtualization + Server-Based Computinghttp://www.brianmadden.com/Forum/Topic/99264
This is my first post on here so apologies if has been asked before. If you where to design a new Citrix farm and after initial sizing it looks like around 10 physical servers will be required, based on 25 users per server. However, as Citrix is quite resource intesive, would you use Vmware to host the Citrix farm?

I was thinking of worst case scenario of using the same amount of servers, but using VMWare VI3.5 to add resillience and DRS for balancing load across servers when required. I am aware of the cost implications of adding VMware but I also have to build new servers which I can add as virtual hosts and also add additional hardware to cover the resource requirements.

Storage would be provided using fibre channel storage to keep costs relativlty low.

Can anyone suggest any potential problems with doing this?

thanks,

KevRead more:Group: Tech Support ForumsForum: Virtualization + Server-Based Computing]]>Tue, 13 May 2008 06:31:20 GMT99264Citrix Presentation Server / XenApphttp://www.brianmadden.com/Forum/Topic/98859
This is probably something I am overlooking or something that is by design, but I want to get some opinions.

We have a MPS farm of 8 servers running MPS 4.0 and some running MPS 4.5. Users connect to the servers desktop (published desktop) via a Wyse (non-domain attached) terminal using the latest program neighborhood. PN has provided the easiest to use interface for our users is why we use PN. What is happening is that users will disconnect (voluntarily, say to goto lunch) and return and try to reconnect, but they don't always get the same session that was disconnected. They might get the same session or they might create a totally new session on another server. What it looks like is happening is that load balancing is trumping any disconnected session. So for example, if the user has a disconnected session on Server A and Server A is loaded down more that Server B, they will create a new session on Server B. I believe the workspace control feature would solve this, but correct me if I am wrong, PN is not capable of workspace control? Also when we had MPS 4.0 the problem existed and it looks like MPS 4.5 makes no difference.

Has anyone ever ran into this before? Any workarounds where we can still use PN on our terminals and still have load balancing?

Thanks so much everyone, this one has plagued us for some time now!

-ShaneRead more:Group: Tech Support ForumsForum: Citrix Presentation Server / XenApp]]>Mon, 28 Apr 2008 11:08:30 GMT98859Network Performance / WAN Optimizationhttp://www.brianmadden.com/Forum/Topic/98540Abstract:
Many of us in the Federal Government have been instructed to meet FIPS 140-2 (Soon 140-3) Compliance. For those of us delivering applications over https have likely seen an increase of calls to our collective service desks regarding the ?Page Cannot Be Displayed? message that results from an improperly configured browser. Because this is not a server-side error, you cannot write a custom page for it and it seemed as though no matter how much information we placed on the landing page about the TLS page they are about to be directed to we never seemed to be able to get users to read it. This has the potential to result in a near meltdown of a service desk or help desk that supports such applications.

Our Scenario:
In our case, we were migrating from a Secure Gateway to clustered set of CAG devices. Per FIPS compliance, we enabled TLS (aka FIPS Compliance checkbox on the CAG). Since we were using an SSL_BRIDGE to load balance the CAG devices we did not have the luxury of interrogating the certificate and using some of the features that come with the Netscaler. As a result, on the day we rolled the system out, there were over 7000 TLS errors experienced by our end users (The CAG lets me log the errors but I can see who it is happening to). Of course?the service desk turned into Ground Zero. Then kicking myself, it occurred to me that since we were using a landing page to direct them to the CAG?s we were able to use the SSL Offload to place the landing page?s certificate on the Netscaler.

Inventory:
1. Netscaler 7000 Enterprise running 8.0 (yeah?we?re Jones-IN? for the 9000)
2. An HTTP ?Landing Page? with instructions on how to configure your browser for TLS.
3. Another HTTP Landing Page with a ?Response.Redirect? programmed into it forwarding those with successful TLS Settings to your TLS-enabled destination, be it CAGS or other Web Servers.
4. A Certificate placed on the Netscaler to begin interrogating https sessions.
5. John Smith (Systems Engineer III, Perot Systems)
6. Michael Dean (Systems Engineer, Citrix Systems)

Steps:
1. Upload (winSCP) the cert for the landing page to the Netscaler
2. Convert the CERT to PEM Format using the openssl available via the ?shell? on the Netscaler.
3. Bind the Cert to the SSL Offload Virtual Server
4. Configure the ?LANDING? page over HTTP as a ?Service? on the Netscaler
5. Configure the SSL Offload Virtual Server to consume the lading page.
a. Go to the SSL Settings for the SSL Offload Virtual Server
i. Click ?CIPHERS?
ii. Select only the TLS Ciphers you want to allow (I selected the TLS Ciphers) and remove the ?DEFAULT? Setting.
iii. Click SSL Parameters
1. In the CIPHER REDIRECT section put the URL to your TLS Failover page.
6. Change the DNS Record to point to the Netscaler VIP.


NOTE: There were two certificates involved in this solution. One certificate was on the Netscaler that housed the Virtual Server for the Landing Page. We had to configure a responder to force http traffic to the https port so that their browser settings would be interrogated. The Certificate that was on the CAG devices was not used as a part of the solution other than as a downstream host of an SSL_BRIDGE.

How it played out:
So?we had our DNS Record moved to the new Netscaler VIP that housed our SSL Offload Virtual server and we were ready to go. I browsed to the site with SSLv2 and SSLv3 checked and TLS 1.0 unchecked. Immediately we were sent to the TLS Redirect web page. After following the directions we wrote on the TLS-failure page we added a ?Continue? button to take us back to the original URL to try again.

It worked like a charm!! We had configured our syslog agent to log IIS logs and I would watch the users and the IP?s get redirected to the TLS-Failure page and I would immediately run a ./nstcpdump.sh host %ipaddress%? and watch the user session begin within two minutes after being redirected to the TLS Fix page. (Too fast for a service desk call so we are very confident the fixed it themselves). I don?t think we prevented every phone call to the service desk but at least users got a window telling them what the problem was instead of ?PAGE CANNOT BE DISPLAYED? which makes non-IT people think your site is down.

For us, we estimate this prevented about 200 calls a day to an already overworked service desk. After talking with Mike Dean at Citrix we agreed that the true ?Plumb? of the solution was the Cipher interrogation because protocols are going to come and go but as long as you can enforce a minimum cipher you are going to stay out of trouble with auditors as the security ?screws continue to tighten?.

Now someone will probably respond to this post with something that takes five minutes and I will go on a one week drinking binge but at the time we were researching the issue we could find NOTHING! We googled, we yahooed, we searched NIST forums, NOTHING!






Citations:
No one seemed to want to touch this issue with a ten foot pool until the issue was given to Michael Dean at Citrix. Like me, he met hurdle after hurdle and never quit on the issue. We opened up a gotoassist session and slowly tried one idea after another until we figured out how to get it to work. He is a huge reason why we got this to work and he was the only person not to back down from what was a very difficult problem.



Conclusion:
As I stated earlier, I would have preferred to just do the Cipher Interrogation on the Netscaler but the SSL_Bridge VIP cannot do that. We are looking into bypassing the CAGs altogether and just going with the Netscalers acting as a portal to the AAC?s. We have customized our user interface so we are married to the AAC?s for awhile yet. If there was another way to do this I sure would have loved to know. I am not posting this to gloat or beat my chest. I am sure someone probably figured this out before me and in case someone has this issue again, I just wanted provide what worked for me. Feel free to email me if you have any questions with this, I?d be glad to help. Or better yet?call Citrix and demand Michael Dean!

This was a toughie?

John M. Smith, CCEA 3.0
System Engineer III
Perot Systems
John.smith@psgs.comRead more:Group: Tech Support ForumsForum: Network Performance / WAN Optimization]]>Fri, 18 Apr 2008 09:20:48 GMT98540Citrix Presentation Server / XenApphttp://www.brianmadden.com/Forum/Topic/98421Dear all,

We would like to re-build our existing Citrix farm, and distribute the servers over two different sites. We have enterprise licenses, and end-users connect via a Web Interface...

I'm interested in the Zone Preference Failover possibilities, but I have a very specific question: in the Admin Guide, I read : "The Zone Preference and Failover policy rule enables you to set preferred zones and establish failover to other zones when the preferred servers are unavailable." How do I have to interprete "unavailable" in this sentence ? Will Presentation Server also establish failover when _all_ Presentation servers in the primary group/zone report a full load ?

I would like to configure a custom load evaluator that sets the full load treshold to 75 sessions per server. However, if we get more than 150 concurrent users in our primary zone (consisting of 2 Presentation Servers), I would hope that the Zone Preference Failover considers the primary site as "unavailable", and load balance the new connections to the backup group/zone (where two other Presentation Servers will be installed).

However, I would like to have some more re-assurance than just "hoping" it works :-)

Thanks for your feedback,
Kris.Read more:Group: Tech Support ForumsForum: Citrix Presentation Server / XenApp]]>Wed, 16 Apr 2008 07:48:23 GMT98421Citrix Presentation Server / XenApphttp://www.brianmadden.com/Forum/Topic/98407
Any information from the forum would be appreciated.

Thanks

EricRead more:Group: Tech Support ForumsForum: Citrix Presentation Server / XenApp]]>Tue, 15 Apr 2008 18:03:36 GMT98407Citrix Presentation Server / XenApphttp://www.brianmadden.com/Forum/Topic/98361
I currently have a Citrix Presentation Server 4 environment that I did not design or
implement (was done by the person in the IT role before me).

It's a single farm that has web interface server. Behind the web interface server is a
separate secure gateway server that appears to be setup and working with no errors when I
run "Secure Gateway Diagnostics".

Although the secure gateway does not appear to be working because I see no https or
indication of SSL when I go the the Citrix web logon user page.

I now need the web interface to be fault tolerant so I am planning on doing either a cluster
or NLB setup via 2003 windows server.

My question is... should I have 2 gateway servers setup as well? Or can Citrix be setup to
just not use SSL if I only have one gateway server and it goes down?

Thanks for any help or resources you can point me to.

-MikeRead more:Group: Tech Support ForumsForum: Citrix Presentation Server / XenApp]]>Mon, 14 Apr 2008 13:42:44 GMT98361Citrix (MetaFrame) Web Interfacehttp://www.brianmadden.com/Forum/Topic/97983
I?ve tested this configuration in a lab and at multiple offices and have been quite un-successful.

The problem is that ?when load balanced?, the STA ID?s will constantly change. If the Web Interface and the Access Gateway receive different STA ID?s, the ICA connection will fail. Web Interface and Access Gateway Enterprise have their own load balancing method for the XML and STA servers. This is done by listing the same STA servers on the AGEE Vserver as you list in the Web interface.

Anyone else run into this issue?Read more:Group: Tech Support ForumsForum: Citrix (MetaFrame) Web Interface]]>Wed, 02 Apr 2008 23:29:07 GMT97983Advanced Access Control / Citrix Access Gatewayhttp://www.brianmadden.com/Forum/Topic/97696
Thanks,
PaulRead more:Group: Tech Support ForumsForum: Advanced Access Control / Citrix Access Gateway]]>Wed, 26 Mar 2008 07:47:48 GMT97696Terminal Serviceshttp://www.brianmadden.com/Forum/Topic/97541
We are exploring the scenario of moving away from Citrix Presentation Server 4.0 to Terminal Server 2008. Our environment is rather basic and so our decision really comes down to the cost of licensing. In reading up on the Session Broker service, it seems that it is only recommended for farms of 10 servers or less. Our farm will be around 15 servers with a load of 22-25 per server. Does anyone have any experience with Session Broker in a farm of this size? Might I be better off going with a hardware solution? If I did that I suppose I should have two available for redundancy? Any recommendations?

Thank you for your time.Read more:Group: Tech Support ForumsForum: Terminal Services]]>Fri, 21 Mar 2008 21:17:56 GMT97541Citrix (MetaFrame) Web Interfacehttp://www.brianmadden.com/Forum/Topic/97443
The goal is to have users directed to the NY CSG server (csg-ny.mycompany.com) when they click on a NY published app and to the CA CSG server (csg-ca.mycompany.com) when they click on a CA published app. That way, ICA traffic destined for each physical location routes through its local CSG server and therefore over our Internet pipe rather than ride our bandwidth constrained backbone between NY and CA.
We don?t want our users to have to remember 2 different WI URLs nor have users login to 2 different WI instances: we want our users to hit one WI but connect to 2 different CSG?s simultaneously based on the published app.

Any suggestions on how to achieve this? Read more:Group: Tech Support ForumsForum: Citrix (MetaFrame) Web Interface]]>Tue, 18 Mar 2008 20:54:09 GMT97443