How to enable/collect logs on WEM Agent machine

TYPES OF LOGS AVAILABLE:

FOR LOGGING INFORMATION RELATING TO WEM BROKERS, SEE CTX228742

There are a number of logs that can be collected from the WEM Agent to help with troubleshooting/diagnosing an issue

#1: WEM Agent Session Logs

These logs are created be default in the base of the user’s profile

a: Citrix WEM Agent Init.log

This is the initialization log for the Agent, which will log the Agent starting up once the end user logs in. If the Agent fails to start up, this log will likely contain the relevant error message. Errors in this log are listed as Exceptions.

b: Citrix WEM Agent.log

This is the main Agent log which will list what instructions the Agent is processing. If one of the actions assigned to the current user is not showing, this log will likely contain the relevant error message. Errors in this log are listed as exceptions.

#2: WEM Agent Debug Log

These logs are created be default in the program directory

a: Citrix WEM Agent Host Service Debug.log

This log must be manually enabled for the WEM Agent Service. There are 2 ways to manually enable these logs:

#1: From the WEM Administration Console per “Configuration Set”, Navigate to “Advanced Settings”, select “Configurations” click on “Agent Options” tab & place a checkmark next to “Debug Mode”.

#2: In the Registry of the individual WEM Agent Machine: Navigate to HKLMSystemCurrentControlSetControlNorskaleAgent Host and change the value of the AgentDebugModeLocalOverride & AgentServiceDebugModeLocalOverride to 1 and restart the Citrix WEM Agent Host Service.

#3: WEM Agent Event Viewer log

This log is located in the Applications and Services Logs section of Event Viewer

a: WEM Agent Service

This event viewer log is present by default and contains basic events pertaining directly to the Agent service (cached settings, refresh event & connection events).

#4: WCF Traces:

These WCF traces must be manually configured and are normally helpful when there are communication issues between the WEM Agent and the WEM Broker. For example, you may need to review a WCF trace of the VUEMUIAgent.exe service if the WEM Agent is not checking in with the WEM Broker

a: VUEMUIAgent.exe

b: Citrix.Wem.Agent.Service.exe

HOW TO IMPLEMENT AND GATHER LOGS:

#1: WEM Agent Session Logs

***Created by default after user logs in***


Filenames: Citrix WEM Agent Init.log & Citrix WEM Agent.log

Location: %userprofile%

#2: WEM Agent Debug Log

***Must be manually enabled***


Filename: Citrix WEM Agent Host Service Debug.log

Location: “%PROGRAMFILES(X86)%CitrixWorkspace Environment Management Agent”


#3: WEM Agent Event Viewer log

***Created by default***


Event log name: WEM Agent Service

Location: Inside Event Viewer under the section titled: Applications and Services Logs

#4: WCF Traces:

***Must be manually enabled***

a: VUEMUIAgent.exe

Filename:
vuemUIAgent-Traces.svclog

Location: “C:Trace”

#1: Close the WEM Agent by exiting the Agent from the taskbar at the bottom right hand side of the screen.

#2: Make a backup copy of the VUEMUIAgent.exe.config file located in the default location of “%PROGRAMFILES(X86)%CitrixWorkspace Environment Management Agent”.

#3: Using Notepad or Wordpad, edit the original .config file adding the multiple lines of code from the attached document named VuemUIAgent.txt to the file. Paste the code into the file starting on the 3rd line in between the <configuration> and </configuration> markers, then save the file.

Here are contents of the attached file:

User-added image

#4: Create a directory on the root of the C: drive called “trace” if one does not already exist.

#5: Reproduce the issue, stop the VUEMUIAgent.exe process if it is still running & collect the log file.

b: Citrix.Wem.Agent.Service.exe

Filename:
NorskaleAgentHostService-Traces.svclog

Location: “C:Trace” ​

#1: Stop the Windows Service called Citrix WEM Agent Host Service

#2: Make a backup copy of the Citrix.Wem.Agent.Service.exe.config file located in the default location of “%PROGRAMFILES(X86)%CitrixWorkspace Environment Management Agent”.

#3: Using Notepad or Wordpad, edit the original .config file adding the multiple lines of code from the attached document named “Norskale Agent Host Service.txt” to the file. Paste the code into the file starting on the 5th line just after the </configSections> marker, then save the file.

Here are contents of the attached file:

User-added image

#4: Create a directory on the root of the C: drive called “trace” if one does not already exist.

#5: Start the Windows Service called Citrix WEM Agent Host Service, reproduce the issue & collect the log file.

****REVERT ALL CHANGES AFTER COLLECTING THE APPROPRIATE LOGS****

FOR LOGGING INFORMATION RELATING TO WEM BROKERS, SEE CTX228742

Related:

Session Recording stopped due to insufficient Disk space. Events logged : Event ID 1004 (Citrix Session Recording Logging) and Event ID 2005 (Citrix Session Recording Storage Manager)

Description: The storage to save recordings ran out of available disk space.

Event ID : Event ID 1004 (Citrix Session Recording Logging)

The description for the event ID “1004” from the source “Citrix Session Recording Logging” was not found. Either the component that triggers this event is not installed on the local computer, or the installation is damaged. You can install or repair the component on the local computer.

If the event occurred on another computer, the display information had to be saved with the event.

The following information was saved with the event:

Exception caught while in unknown context. Exception caught by unhandled exception handler.

— Exception Details —

Type: System.Runtime.InteropServices.COMException

Message: The object invoked has disconnected from its clients. (Exception from HRESULT: 0x80010108 (RPC_E_DISCONNECTED))

Stack trace:

at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal (Int32 errorCode, IntPtr errorInfo)

at System.Runtime.InteropServices.Marshal.ThrowExceptionForHR (Int32 errorCode, IntPtr errorInfo)

at System.Management.SinkForEventQuery.Cancel ()

at System.Management.ManagementEventWatcher.Stop ()

at System.Management.ManagementEventWatcher.Finalize ()

And

Event ID 2005 (Citrix Session Recording Storage Manager)

Data lost while recording file: E:SessionRecordings20191113i_e571b4cf-###-###-##########.icl

3779688 bytes missing.

Session Recording does not save even after the disk space is increased.

Related:

How to enable/collect logs on WEM Broker

TYPES OF LOGS AVAILABLE:

FOR LOGGING INFORMATION RELATING TO WEM AGENTS, SEE CTX220635

There are a number of logs that can be collected from the WEM Broker to help with troubleshooting/diagnosing an issue

A: WEM Infrastructure Broker Service issues:

#1: WEM Infrastructure Broker Event logs

These logs are created be default in Event viewer. This event viewer log is where the Infrastructure Broker Service will log all basic errors.

a: Norskale Broker Service

This log can be found inside Event Viewer under the “Applications and Services logs” section.

#2: WEM Infrastructure Debug Log

This log must be manually enabled for the WEM Infrastructure Broker Service.

a: Citrix WEM Infrastructure Service Debug.log

To enable Debug logging for the Infrastructure Broker Service, go to the “Advanced Settings” tab in the Infrastructure Broker Service Configuration console (a/k/a “WEM Infrastructure Service Configuration Utility”), tick the “Enable Debug Mode” checkbox & click “Save Configuration”.

#3: WCF Trace:

This WCF trace must be manually configured and is normally helpful when there is a communication issue which involves the WEM Broker.

a: Norskale Broker Service.exe

B: WEM Console issues:

This is the main log for the WEM Administration Console; If the WEM Administration Console is erroring out, this log will likely contain the cause of the error. This log is NOT enabled by default.

#1: Citrix WEM Console Trace.Log:

To enable verbose logging (debug mode), open the WEM Administration Console, click on the “Options” tab in the top ribbon, tick the “Enable Debug Mode” checkbox & click “Apply”.

#2: WCF Trace

This WCF trace must be manually configured and is normally helpful when there is a communication issue between any WEM Console and the WEM site/database.

a: Norskale Administration Console.exe


C: WEM Database issues:

This log is created whenever the Database Management Console/Utility attempts a database creation or upgrade & logs all errors pertaining to those operations.

#1: Citrix WEM Database Management Utility Debug Log.log:

This log is created by default and is located in the following default location: “C:Program Files (x86)NorskaleNorskale Infrastructure Services”

HOW TO IMPLEMENT AND GATHER LOGS:

A: WEM Infrastructure Broker Service issues:

#1: WEM Infrastructure Broker Event logs

***Created by default during normal WEM Broker operations***

Filename: Norskale Broker Service

Location: Event Viewer >> “Applications and Services Logs”

#2: WEM Infrastructure Debug Log

***Must be manually enabled***

Filename: Citrix WEM Agent Host Service Debug.log

Location: “%PROGRAMFILES(X86)%NorskaleNorskale Agent Host”

#3: WCF Traces:

***Must be manually enabled***

a: Norskale Broker Service

Filename: NorskaleInfrastructureBrokerService-Traces.svclog

Location: “C:Trace”

#1: Stop the “Norskale Infrastructure Service”.

#2: Make a backup copy of the “Norskale Broker Service.exe.config” file located in the default location of “%PROGRAMFILES(X86)%NorskaleNorskale Infrastructure Services”.

#3: Using Notepad or Wordpad, edit the original .config file adding the multiple lines of code from the attached document named “Norskale Infrastructure Broker Service.txt” to the file. Paste the code into the file starting on the 2nd line just after the <configuration> marker, then save the file.

#4: Create a directory on the root of the C: drive called “trace” if one does not already exist.

#5: Start the “Norskale Infrastructure Service”.

Here are contents of the attached file:

User-added image

B: WEM Console issues:

#1: WEM Console Debug Log

***Must be manually enabled***

Filename: Citrix WEM Console Trace.log

Location: “%userprofile%”

a: Citrix WEM Console Trace.Log

#1: To enable verbose logging (debug mode), open the WEM Administration Console, click on the “Options” tab in the top ribbon, tick the “Enable Debug Mode” checkbox & click “Apply”.

#2: Launch the WEM Administration Console

#2: WCF Trace:

***Must be manually enabled***

a: Norskale Broker Service

Filename: WEMConsole-Traces.svclog

Location: “C:Trace”

#1: Close the WEM Administration Console if open.

#2: Make a backup copy of the “Norskale Administration Console.exe.config” file located in the default location of “%PROGRAMFILES(X86)%NorskaleNorskale Administration Console”.

#3: Using Notepad or Wordpad, edit the original .config file adding the multiple lines of code from the attached document named “WEM Administration Console.txt” to the file. Paste the code into the file starting on the 3rd line just after the <configuration> marker, then save the file.

Here are contents of the attached file:

User-added image

#4: Create a directory on the root of the C: drive called “trace” if one does not already exist.

#5: Launch the WEM Administration Console and connect to the WEM site, reproduce issue & close the console to write the logs.

C: WEM Database issues:

#1: Citrix WEM Database Management Utility Debug Log.log:

***Created by default when performing any database creation/upgrade from the WEM Broker server***

Filenames: Citrix WEM Database Management Utility Debug Log.log

Location: “%PROGRAMFILES(X86)%NorskaleNorskale Infrastructure Services”

****REVERT ALL CHANGES AFTER COLLECTING THE APPROPRIATE LOGS****

FOR LOGGING INFORMATION RELATING TO WEM AGENTS, SEE CTX220635

Related:

Virtual Apps and Desktops 7.X: Logon Duration in MonitorData.Session Table in Monitoring Database shows “Null”

Custom Security Descriptor was set for the Application Event logs on the VDA’s.

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetserviceseventlogApplication]

“customsd”=”O:BAG:SYD:(D;; 0xf0007;;;AN)(D;; 0xf0007;;;BG)(A;; 0xf0007;;;SY)(A;; 0x5;;;BA)(A;; 0x7;;;SO)(A;; 0x3;;;IU)(A;; 0x2;;;BA)(A;; 0x2;;;LS)(A;; 0x2;;;NS)(A;;0x1;;;S-1-5-21-905980934-1232030010-646806464-20420)”

Due to CustomSD set on that Application Event Logs, UPMPlugin loaded in BrokerAgent (that runs under Network Service account) was denied permission to read the Application events . Hence, it couldn’t get the Desktop Ready event, and so no ‘upmlogon’ payload was sent to Citrix Monitor Service and so logon duration was not logged.

Related:

Citrix Director is unable to display personalization data under user data section with error “Unexpected server error”.

Below symptoms and errors are observed:

1. Personalization Data under user data section displays error “Unexpected server error”.

2. Event ID 6 with source Citrix Director Service is logged under Application logs with below description:

The following information was included with the event:

An unexpected error occurred.

User: ‘domainuser’

Console operation: ‘Retrieving desktops profile and vDisk details…’

Additional information:

‘Value was either too large or too small for an Int32.’

Related:

Reboot Schedule Doesn't work for two Delivery Groups in XenApp

Use Case: “We have a schedule to restart the machines in the delivery group every Sunday. The problem is that a few machines don’t turn back on, others don’t even receive the command to turn off.”

Checking the Event Viewer logs in the Delivery Controller we see these errors:

Event ID 3105

Log name: Application

Source: Citrix Broker Service

Text: The Citrix Broker Service has terminated the processing of the GroupReboot for Desktop ‘[Delivery Group name]’ The reboot cycle UID = 999 ended with the final state ‘Abandoned’ Summary: ‘0’ machines successfully rebooted, ‘2’ machines failed to reboot. ‘1’ machines were not processed

Related:

DLP 15.5 Agent – EDPA Service will stop and change to “manual”

I need a solution

When installing DLP 15.5 agent on Windows 7 Enterprise, the EDPA service “stops” and the start up for that service turns to “Manual”.    Event viewer shows “The EDPA service terminated with the following error:   The handle is invalid.  Event 7023.

Has anyone else run into this issue?  If so, can they share how they resolved it?  We want to test out 15.5 agent but this is preventing us from installing and testing on Windows 7 machines.

Thanks in advance. 

0

Related:

XenApp/XenDesktop 7.15 LTSR CU3: AppDataRoaming Folder Redirection Fails When Configured Using UPM Policies From Citrix Studio

  • You enable the below policy. However, AppDataRoaming folder redirection fails on VDA’s with Windows 10 and Windows Server 2016 installed. In the user’s UPM profile store directory AppDataRoaming does not get created.

appdata2

  • Below error 2007 is seen in the Application Event logs:

appdata1

  • In CDF logs collected from the VDA you see the below error:

188938,2,2018/12/05 18:36:14:81092,6712,2616,0,upmGpCse,134,CreateDirectoryAPIWrapper,9,Error,”CreateDirectoryAPIWrapper: CreateDirectory \?UNCxxxupm10$yyyAppDataRoaming failed: 0x3″,””

188940,2,2018/12/05 18:36:14:81092,6712,2616,0,upmGpCse,793,UpmShell::RedirectFullPath,9,Error,”UpmShell::RedirectFullPath: Creating the user’s folder <\xxxupm10$yyyAppDataRoaming> failed: 0x3″,””

Related:

Security Center DC040780 Error

I need a solution

I’m running the latest Windows 10 Pro 1809 with SEP 12.1.6 and noticed that Event ID 17 (Security Center failed to validate caller with error DC040780) appears every 5 minutes in my Windows Application event log.  A quick Internet search seems to indicate it’s antivirus related where my Security Center service is running.  Is this error a known issue with SEP 12.1.6 and Win10 Pro 1809?  Doesn’t seem to be affecting my workstation’s functionality but was wondering if there was a fix to stop this repeating event log entry; aside from upgrading SEP.  Thanks in advance!

0

Related:

  • No Related Posts

Need to search for text inside SMSMSE Event Log

I need a solution

When I’m troubleshooting missing email that is not in the quarantine, I can’t find any way to look up a sender in the Event Log and say, “Oh, here’s what went wrong.” The SMSMSE Event Log gets 1000 entries a day so scrolling with eyballs is not a solution. I have a tool to search in the Exchange SMTP logs but that will only say “550 5.7.1 Requested action not taken: message refused,” which brings me back to the SMSMSE Event Log. Without finding it in that log, I can’t even tell if it was a sender typo, server problem or anything. I can’t find text logs and can’t access the SMSMSE database via SQL Server Management Studio.
 
BTW Symantec: THANK YOU SO MUCH for including “Subject” field in the Quarantine listing!!!!! That is immensely useful and I’ve been hoping for it for years.
 
-frank

0

Related: