VMware vRealize Operations for Published Applications - 6.2 Installation Manual

VMware vRealize Operations for

Published Applications Installation and

Administration

vRealize Operations for Published Applications 6.2

This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions of this document, see http://www.vmware.com/support/pubs.

EN-001976-00

VMware vRealize Operations for Published Applications Installation and Administration

You can find the most up-to-date technical documentation on the VMware Web site at:

http://www.vmware.com/support/

The VMware Web site also provides the latest product updates.

If you have comments about this documentation, submit your feedback to:

docfeedback@vmware.com

VMware, Inc.

3401 Hillview Ave. Palo Alto, CA 94304 www.vmware.com

2 VMware, Inc.

VMware vRealize Operations for Published Applications Installation and

Administration 5

Introducing vRealize Operations for Published Applications 7

vRealize Operations for Published Applications Architecture 8

vRealize Operations for Published Applications Desktop Agent 8

vRealize Operations for Published Applications Broker Agent 9

vRealize Operations for Published Applications Adapter 9

System Requirements for vRealize Operations for Published Applications 11

Product Compatibility for vRealize Operations for Published Applications 11

Software Requirements for vRealize Operations for Published Applications 11

Installing and Configuring vRealize Operations for Published Applications 13

Install and Configure vRealize Operations for Published Applications 13

Monitoring Your Citrix XenDesktop and Citrix XenApp Environments 27

Using the XD-XA Dashboards 27

Using the XD-XA Reports 32

Managing RMI Communication in

vRealize Operations for Published Applications 35

RMI Services 35

Default Ports for RMI Services 36

Changing the Default RMI Service Ports 36

VMware, Inc.

Changing the Default TLS Configuration in

vRealize Operations for Published Applications 39

Default TLS Protocols and Ciphers for vRealize Operations for Published Applications 39

TLS Configuration Properties 40

Change the Default TLS Configuration for Servers 40

Change the Default TLS for Agents 40

Managing Authentication in vRealize Operations for Published Applications 43

Understanding Authentication for Each Component 43

Certificate and Trust Store Files 45

vRealize Operations for Published Applications Adapter Certificate and Trust Store Files 45

Broker Agent Certificate and Trust Store Files 46

VMware vRealize Operations for Published Applications Installation and Administration

Replacing the Default Certificates 47

Replace the Default Certificate for the vRealize Operations for Published Applications Adapter 47

Replace the Default Certificate for the Broker Agent 49

Certificate Pairing 51

SSL/TLS and Authentication-Related Log Messages 53

Create a vRealize Operations Manager Support Bundle 55

Download vRealize Operations for Published Applications Broker Agent Log

Files 57

Download vRealize Operations for Published Applications Desktop Agent Log

Files 59

View Collector and vRealize Operations for Published Applications Adapter

Log Files 61

Modify the Logging Level for vRealize Operations for Published Applications

Adapter Log Files 63

Index 65

4 VMware, Inc.

VMware vRealize Operations for Published Applications Installation

and Administration 1

VMware vRealize Operations for Published Applications Installation and Administration provides information about how to monitor the performance of your Citrix XenDesktop/Citrix XenApp 7.6 environments in VMware vRealize™ Operations Manager™.

Intended Audience

This information is intended for users who monitor the performance of a Citrix XenDesktop/Citrix XenApp

7.6 environments in VMware vRealize Operations Manager and administrators who are responsible for maintaining and troubleshooting a Citrix XenDesktop/Citrix XenApp 7.6 environments.

VMware, Inc. 5

VMware vRealize Operations for Published Applications Installation and Administration

6 VMware, Inc.

Introducing vRealize Operations for Published

Applications 2

vRealize Operations for Published Applications collects performance data from monitored software and hardware objects in your XenDesktop/XenApp 7.6, and vCenter environments and provides predictive analysis and real-time information about problems in your XD-XA infrastructure.

vRealize Operations for Published Applications presents data through alerts, on configurable dashboards, and on predefined pages in vRealize Operations Manager.

IT administrators can use vRealize Operations for Published Applications to quickly obtain an overview of how the XenDesktop and XenApp environments are behaving and view important metrics associated with that environment. Help desk specialists can view objects related to end user sessions, perform basic troubleshooting, and resolve user problems.

This chapter includes the following topics:

“vRealize Operations for Published Applications Architecture,” on page 8

“vRealize Operations for Published Applications Desktop Agent,” on page 8

“vRealize Operations for Published Applications Broker Agent,” on page 9

“vRealize Operations for Published Applications Adapter,” on page 9

VMware, Inc.

Desktop

agent

Desktop

agent

XD/XA Controller Server

Broker

agent

vRealize Operations Manager

vCenter adapter

Published Apps

adapter

vRealize Operations Manager User Interface

Published Apps

dashboards

Resources, metrics, relationships, KPIs, alerts, views and reports

XA metrics: CPU, memory,disk, ICA, session information, published app information, topology and Health monitoring

XD/XA

Session-host

Server

XD/XA

Licensing

Server

XD/XA

Storefront

Server

XA Powershell script/ Monitor Service API/WMI

vCenter Server

vSphere metrics:

ESXi, VM, datastore, datacenter

Desktop

agent

XD/XA Desktop

OS Machine

Desktop

agent

Desktop

agent

VMware vRealize Operations for Published Applications Installation and Administration

vRealize Operations for Published Applications Architecture

The vRealize Operations for Published Applications components include the XD-XA adapter, broker agent, and desktop agents.

VMware vRealize Operations for Published Applications Architecture

vRealize Operations for Published Applications Desktop Agent

The vRealize Operations for Published Applications desktop agent runs as a service on the XenDesktop Delivery Controller on each XenDesktop Session host server, Licence server, RDS host, Store Front server, and on all the VDI machines.

The desktop agent monitors Citrix ICA sessions and HDX sessions and applications launched in the Citrix ICA and HDX sessions by using standard functions and APIs of Windows OS. The desktop agent periodically collects the Citrix ICA sessions' data on properties and performance, and sends the data to the adapter using a secure connection.

8 VMware, Inc.

Chapter 2 Introducing vRealize Operations for Published Applications

The desktop agent service is configured to restart automatically by default. You can change the default configuration by accessing services.msc, right-click Desktop Agent Service, and select Properties > Recovery.

vRealize Operations for Published Applications Broker Agent

The vRealize Operations for Published Applications broker agent runs on an active delivery controller, and collects and sends information to the XD-XA adapter.

When you configure a broker agent, you pair the broker agent with a XD-XA adapter instance.

vRealize Operations for Published Applications Adapter

The vRealize Operations for Published Applications adapter collects Citrix XenDesktop inventory information from the broker agent and collects metrics and performance data from desktop agents. The vRealize Operations for Published Applications adapter sends that information to vRealize Operations Manager. The information is displayed in pre-configured XenDesktop dashboards in the vRealize Operations Manager user interface.

The vRealize Operations for Published Applications adapter runs on a cluster node or remote collector node in vRealize Operations Manager. You can create a single vRealize Operations for Published Applications adapter instance to monitor multiple XenDesktop 7.6 sites. During broker agent configuration, you pair the broker agent with a vRealize Operations for Published Applications adapter instance.

If you are monitoring multiple XenDesktop sites, you can pair the broker agent installed in each site with the same vRealize Operations for Published Applications adapter instance as long as the total number of objects that the vRealize Operations for Published Applications adapter instance handles does not exceed 10,000. You can create more vRealize Operations for Published Applications adapter instances on different remote nodes to support large scale environments.

IMPORTANT Creating more than one vRealize Operations for Published Applications adapter instance for each cluster node or remote collector is not supported. Also, creating more than one vRealize Operations for Published Applications adapter instance for each site is not supported. vRealize Operations for Published Applications 7.6 adapter cannot monitor the XenApp 6.5 environments.

If your vRealize Operations for Published Applications environment resembles one of the following configurations, VMware recommends that you create the vRealize Operations for Published Applications adapter instance on a remote collector node.

XenDesktop deployments with multiple sites

Remote datacenters

To improve scalability, create the vRealize Operations for Published Applications adapter instance on a remote collector node to offload processing from the vRealize Operations Manager cluster data nodes.

To minimize network traffic across WAN or other slow connections, install a remote collector node with a separate vRealize Operations for Published Applications adapter instance in remote datacenters. Pair each vRealize Operations for Published Applications adapter instance with the broker agent that is located in the same remote datacenter.

VMware, Inc. 9

VMware vRealize Operations for Published Applications Installation and Administration

10 VMware, Inc.

System Requirements for vRealize Operations for Published

Applications 3

vRealize Operations for Published Applications has specific system requirements. Verify that your environment meets these system requirements before you install vRealize Operations for Published Applications.

This chapter includes the following topics:

“Product Compatibility for vRealize Operations for Published Applications,” on page 11

“Software Requirements for vRealize Operations for Published Applications,” on page 11

Product Compatibility for vRealize Operations for Published Applications

vRealize Operations for Published Applications is compatible with the following products.

vCenter Server 5.5 and 6.0

vRealize Operations Manager 6.0.3 and 6.1

Citrix XenDesktop/XenApp 7.6 running on Windows Server 2008R2 (SP1) and Windows Server 2012.

Citrix XenDesktop/XenApp 7.6 (FP3) for Windows 10 VDI support

NOTE Refer to vRealize Operations for Published Application 6.1 for support of Citrix XenApp 6.5.

Software Requirements for vRealize Operations for Published Applications

Each component of vRealize Operations for Published Applications has requirements for the software on the system where it is installed.

vRealize Operations for Published Applications Desktop Agent Software Requirements

You install the vRealize Operations for Published Applications desktop agent on Citrix Delivery Controllers, Session RDS servers, Store Front server, License server, and the VDI machines.

vRealize Operations for Published Applications Broker Agent Software Requirements

You install the vRealize Operations for Published Applications broker agent on an active delivery controller.

VMware, Inc.

VMware vRealize Operations for Published Applications Installation and Administration

The vRealize Operations for Published Applications broker agent has the following software requirements. Verify that you enable PS remoting on the deliver controller by using Microsoft PowerShell before you install the broker agent.

Windows Server 2008R2 SP1 or Windows Server 2012

Microsoft .Net Framework 4.5.1

vRealize Operations for Published Applications Adapter Software Requirements

You install the vRealize Operations for Published Applications adapter on a vRealize Operations Manager server that is running.

The vRealize Operations for Published Applications adapter has the following software requirements.

VMware vRealize Operations Manager 6.0.2, 6.0.3, and 6.1

Setting Remote Signed Execution Policy

To set the remote signed execution policy, perform the following steps:

Set-ExecutionPolicy RemoteSigned Enable-PSRemoting Restart WinRM service net stop winrm net start winrm Restart Broker-Agent service

12 VMware, Inc.

Installing and Configuring vRealize Operations for Published

Applications 4

Installing vRealize Operations for Published Applications involves downloading the installation files from the VMware product download page and installing and configuring software components on machines in your vRealize Operations for Published Applications environment.

Install and Configure vRealize Operations for Published Applications

You install and configure vRealize Operations for Published Applications software components on machines in your Citrix XenDesktop/XenApp 7.6 and vRealize Operations Manager environments.

Prerequisites

Verify that your environment meets product compatibility, hardware, and software requirements. See

Chapter 3, “System Requirements for vRealize Operations for Published Applications,” on page 11.

Verify that vRealize Operations Manager is deployed and running. If you need to upgrade

vRealize Operations Manager, perform the upgrade before you install vRealize Operations for Published Applications.

Download the vRealize Operations for Published Applications installation files from the product

download page. See “Downloading the vRealize Operations for Published Applications Installation

Files,” on page 15.

Verify that you have a license key for the vRealize Operations for Published Applications solution.

Verify that you have a license key for vRealize Operations Manager.

NOTE Upgrading from vRealize Operations for Published Applications 6.1 to vRealize Operations for Published Applications 6.2 is not supported.

NOTE vRealize Operations for Published Applications 6.1 and vRealize Operations for Published Applications 6.2 should be installed on different collector nodes.

Procedure

1 Downloading the vRealize Operations for Published Applications Installation Files on page 15

Registered VMware users can download the vRealize Operations for Published Applications installation files from the product download page.

2 Install the vRealize Operations for Published Applications Solution on page 15

You install the vRealize Operations for Published Applications solution from a PAK file in vRealize Operations Manager.

VMware, Inc.

VMware vRealize Operations for Published Applications Installation and Administration

3 Open the Ports Used by vRealize Operations for Published Applications on page 16

After you install the vRealize Operations for Published Applications adapter, you disable the firewall service, open the default ports, and restart the firewall.

4 Adding a vRealize Operations for Published Applications License Key on page 16

After you install the vRealize Operations for Published Applications solution, you must add a vRealize Operations for Published Applications license key in the vRealize Operations Manager user interface. vRealize Operations for Published Applications is not functional until it is licensed.

5 Associate XD-XA Objects with Your vRealize Operations for Published Applications License Key on

page 17

You must associate XD-XA objects with your vRealize Operations for Published Applications license key by editing license groups in vRealize Operations Manager.

6 Create an Instance of the vRealize Operations for Published Applications 6.2 Adapter on page 18

After you install the vRealize Operations for Published Applications solution, you must create an instance of the vRealize Operations for Published Applications adapter in vRealize Operations Manager.

7 Enabling Firewall Rules for XenDesktop Delivery Controllers and PVS Server on page 19

Before you install the broker agent and desktop agent, you must enable specific firewall rules for the XenDesktop Delivery Controller and PVS server.

8 Install the vRealize Operations for Published Applications Broker Agent on page 20

You install the vRealize Operations for Published Applications broker agent on an Active XenDesktop Delivery Controller.

9 Configure the vRealize Operations for Published Applications Broker Agent on page 21

After you install the broker agent, you use the Broker Agent Configuration wizard to configure the broker agent on the Citrix XenDesktop Delivery Controller where you installed the broker agent. You can also use the Broker Agent Configuration wizard to make changes to your broker agent configuration.

10 Configure Broker Agent to use Non-Admin User for Citrix Desktop Delivery Controller on page 22

You can configure broker agent to use non-admin user for Citrix Desktop Delivery Controller.

11 Install a vRealize Operations for Published Applications Desktop Agent on page 23

You install desktop agents on all Delivery Controllers, Store Front server, RDS host, License server, and VDI machines.

12 Push the vRealize Operations for Published Applications Desktop Agent Pair Token Using a Group

Policy on page 24

To use vRealize Operations for Published Applications to monitor a XenDesktop Site, you must create a Group Policy (GPO) to contain the vRealize Operations for Published Applications group policies. You then apply the GPO to the remote desktops that you want to monitor.

14 VMware, Inc.

Chapter 4 Installing and Configuring vRealize Operations for Published Applications

Downloading the vRealize Operations for Published Applications Installation Files

Registered VMware users can download the vRealize Operations for Published Applications installation files from the product download page.

Table 4‑1. vRealize Operations for Published Applications Installation Files

File Name Component Where to Install

VMware-vrops-v4paadapter-6.2.0buildnumber.pak

VMware-v4pabrokeragentx86_64-6.2.0-buildnumber.exe

VMware-v4padesktopagentx86_64-6.2.0-buildnumber.exe

VMware-v4padesktopagent-6.2.0buildnumber.exe

Adapter vRealize Operations Manager server

Broker agent installer for 64-bit Windows OS

Desktop agent installer for 64-bit Windows OS

Desktop agent installer for 32-bit Windows OS

On XenDesktop Controller

On XenDesktop Controllers and Session Host servers, RDS server, Store Front server, Licence server, and VDI machines

Install the vRealize Operations for Published Applications Solution

You install the vRealize Operations for Published Applications solution from a PAK file in vRealize Operations Manager.

Procedure

1 Copy the VMware-vrops-v4paadapter-6.2.0-buildnumber.pak file to a temporary folder.

2 Log in to the vRealize Operations Manager user interface with administrator privileges.

3 In the left pane of vRealize Operations Manager, click the Administration icon and click Solutions.

4 Install the vRealize Operations for Published Applications solution.

a On the Solutions tab, click the plus sign.

b Browse to locate the temporary folder and select the PAK file.

c Click Upload.

The upload might take several minutes.

d Read and accept the EULA and click Next.

Installation details appear in the window during the upload process.

e When the installation is complete, click Finish.

After the installation is finished, vRealize Operations for Published Applications is listed as a solution.

NOTE Upgrading from vRealize Operations for Published Applications 6.1 to vRealize Operations for Published Applications 6.2 is not supported.

What to do next

Provide licensing information for the vRealize Operations for Published Applications solution. See “Adding

a vRealize Operations for Published Applications License Key,” on page 16.

VMware, Inc. 15

VMware vRealize Operations for Published Applications Installation and Administration

Open the Ports Used by vRealize Operations for Published Applications

After you install the vRealize Operations for Published Applications adapter, you disable the firewall service, open the default ports, and restart the firewall.

Prerequisites

Install the vRealize Operations for Published Applications adapter.

Verify that you have root privileges.

Procedure

1 Log in to vRealize Operations Manager collector server.

2 Access the command prompt and run the service vmware-vcops-firewall stop to disable the

vRealize Operations Manager firewall service.

3 Open the default ports by editing the configuration file.

Option Action

Linux

Windows

4 Run the vmware-vcops-firewall start command to start the service.

Access the vmware-vcops-firewall.conf file in the/opt/vmware/etc/vmware-vcops-firewall.conf directory.

b In a text editor, modify the properties for the RMI service ports that

you want to change, for example TCPPORTS="$TCPPORTS 3095:3098" .

a Access Windows Firewall and select Windows Firewall > Advanced

Settings > Inbound Rules > New Rule > Port and click Next.

b Select Specific local ports and type the ports that you are using, for

example3095-3098.

The default ports are 3095-3098. If you changed the default ports, specify the ports that you are using.

If the service vmware-vcops-firewall start command does not enable the ports, start the collector server.

What to do next

Add a vRealize Operations for Published Applications license key. See “Adding a vRealize Operations for

Published Applications License Key,” on page 16

Adding a vRealize Operations for Published Applications License Key

NOTE You must also add a license key for vRealize Operations Manager.

You can have an evaluation license key or a product license key for vRealize Operations for Published Applications. The evaluation license key (eval/EVAL) provides 60 days of unlimited product use. A product license key is encoded with an expiration date and a license count.

To add your vRealize Operations for Published Applications license key, select Administration > Licensing in the vRealize Operations Manager user interface and add your license key to VMware Published Apps Solution on the License Keys tab.

16 VMware, Inc.

Chapter 4 Installing and Configuring vRealize Operations for Published Applications

For detailed information about adding license keys, see the vRealize Operations Manager Customization and Administration Guide.

If your vRealize Operations for Published Applications license key expires, the vRealize Operations for Published Applications adapter stops populating vRealize Operations Manager with data. If you have a valid license key but you exceed the license count, vRealize Operations Manager generates alerts on certain dashboards. The vRealize Operations for Published Applications adapter does not restrict data when the license count is exceeded.

Associate XD-XA Objects with Your vRealize Operations for Published Applications License Key

You must associate XD-XA objects with your vRealize Operations for Published Applications license key by editing license groups in vRealize Operations Manager.

A license group is a way to gather certain objects, called license group members, under a particular license key. By default, the vRealize Operations Manager and vRealize Operations for Published Applications license groups both include all host, virtual machine, and datastore objects. Because these objects are members of both license groups, they are covered by both your vRealize Operations Manager license and your vRealize Operations for Published Applications license.

Each license group includes membership criteria that you can use to filter the objects that are members of the license group. By editing the membership criteria for the vRealize Operations Manager and vRealize Operations for Published Applications license groups, you can specify that certain objects are covered only under your vRealize Operations for Published Applications license key.

Prerequisites

Add your vRealize Operations for Published Applications license key. See “Adding a vRealize Operations

for Published Applications License Key,” on page 16.

Procedure

1 Log in to the vRealize Operations Manager user interface.

2 In the left pane, select Administration > Licensing.

3 Click the License Groups tab.

License groups appear in the top pane. The license group for vRealize Operations for Published Applications is called VMware VRealize Operations for Published Apps 6.2 Licensing. The license group for vRealize Operations Manager is called Product Licensing.

4 Edit the membership criteria for the VMware Published Application Licensing group.

a Select VMware Published Applications Licensing and click Edit on the toolbar.

b Select the vRealize Operations for Published Applications license key under VMware vRealize

Operations for Published Applications and click Next.

c In the first Select the Object Type that matches all of the following criteria drop-down menu,

select XSite, define the criteria Relationship, Descendant of, is, and type XEnvironment in the Object name text box.

d In the second Select the Object Type that matches all of the following criteria drop-down menu,

select Host System, define the criteria Relationship, Descendant of, is, and type XEnvironment in the Object name text box.

e In the third Select the Object Type that matches all of the following criteria drop-down menu,

select Virtual Machine, define the criteria Relationship, Descendant of, is, and type XEnvironment in the Object name text box.

VMware, Inc. 17

VMware vRealize Operations for Published Applications Installation and Administration

f In the fourth Select the Object Type that matches all of the following criteria drop-down menu,

select Datastore, define the criteria Relationship, Descendant of, is, and type XEnvironment in the Object name text box.

g Click Next and then click Finish to save your configuration.

5 Edit the membership criteria for the Product Licensing group.

You must edit the membership criteria for the Product Licensing group to exclude the objects that you included in the VMware Published Application Licensing group.

a Select Product Licensing and click Edit on the toolbar.

b Select the vRealize Operations Manager license key under vRealize Operations Manager and click

Next.

c In the first Select the Object Type that matches all of the following criteria drop-down menu,

select Host System, define the criteria Relationship, Descendant of, is not, and type Xenvironment in the Object name text box.

d In the second Select the Object Type that matches all of the following criteria drop-down menu,

select Virtual Machine, define the criteria Relationship, Descendant of, is not, and type

Xenvironment in the Object name text box.

e In the third Select the Object Type that matches all of the following criteria drop-down menu,

select Datastore, define the criteria Relationship, Descendant of, is not, and type Xenvironment in the Object name text box.

f In the fourth Select the Object Type that matches all of the following criteria drop-down menu,

select Datastore, define the criteria Relationship, Descendant of, is not, and type Xenvironment in the Object name text box.

g Click Next and then click Finish to save your configuration.

Create an Instance of the vRealize Operations for Published Applications 6.2 Adapter

You can create a single vRealize Operations for Published Applications adapter instance to monitor multiple XenDesktop sites. If you need to create multiple vRealize Operations for Published Applications adapter instances, you must create each adapter instance on a unique cluster node or remote collector.

When you restart a vRealize Operations for Published Applications adapter instance, it takes several minutes before the vRealize Operations for Published Applications desktop agent and broker agent send information to the vRealize Operations for Published Applications adapter.

Prerequisites

Install the vRealize Operations for Published Applications solution and add your license key.

Procedure

1 Log in to the vRealize Operations Manager user interface with administrator privileges.

2 Click the Administration icon and click Solutions.

3 Select VMware vRealize Operations for Published Apps 6.2 and click the Configure (gear) icon on the

toolbar.

4 Select vRealize Operations for Published Apps 6.2 in the adapter table.

5 Click the Add (plus sign) icon on the lower pane toolbar to add an adapter instance.

18 VMware, Inc.

Chapter 4 Installing and Configuring vRealize Operations for Published Applications

6 In Adapter Settings, type a name and description for the adapter instance.

7 In Basic Settings, configure an adapter ID and credential for the adapter instance.

a Type an identifier for the adapter instance in the Adapter ID text box.

The identifier must be unique across all vRealize Operations for Published Applications adapter instances in the cluster.

b Configure the credential to use when the broker agent pairs with the

vRealize Operations for Published Applications adapter instance.

Option Action

Use an existing credential

Add a new credential

Select the credential from the Credential drop-down menu. When you create a vRealize Operations for Published Applications adapter instance for the first time, the Credential drop-down menu is empty.

1 Click the Add New (plus sign) icon .

2 Type a name for the credential in the Credential name text box.

3 Type a server key for the adapter instance in the Server Key text

box. The server key is required to enable pairing between the broker agent and the adapter. You must provide the server key when you configure the broker agent.

4 Click OK to save the new credential.

5 Select the new credential from the Credential drop-down menu.

c Click Test Connection to test the connection with the credential that you selected.

8 In Advanced Settings, select a collector to manage the adapter processes from the Collector/Groups

drop-down menu.

To run the adapter instance on a remote collector, select the remote collector. If you do not have a remote collector, select Default collector group.

9 Click Save Settings to save the adapter instance.

The adapter instance is added to the list.

What to do next

Install the vRealize Operations for Published Applications broker agent. See “Install the vRealize Operations

for Published Applications Broker Agent,” on page 20.

Enabling Firewall Rules for XenDesktop Delivery Controllers and PVS Server

Before you install the broker agent and desktop agent, you must enable specific firewall rules for the XenDesktop Delivery Controller and PVS server.

The broker agent cannot communicate with the XenDesktop Delivery Controller and PVS server if the firewall is enabled on these servers.

Enable the following rules in XenDesktop Delivery Controller servers and PVS server.

Enable Ping in the firewall for all servers using the File and Printer Sharing (Echo Request - ICMPv4-In)

rule.

Enable Remote WMI in the firewall for all servers using the Windows Management Instrumentation

(WMI-In) rule.

Enable the following rule in XenDesktop Delivery Controller Server.

Enable Remote Powershell by running the Enable-PSRemoting command in PowerShell command

prompt.

VMware, Inc. 19

VMware vRealize Operations for Published Applications Installation and Administration

If the PVS Server in Citrix XenDesktop environment is not in same domain as Delivery Controller, you can add a new field manually in broker agent configuration file: <pvs_server_credentials> </pvs_server_credentials>

Broker Agent configuration file can be found at following location: C:\ProgramData\VMware\vRealize

Operations for Published Apps\Broker Agent\conf\v4pa-brokeragent.config.

Install the vRealize Operations for Published Applications Broker Agent

You install the vRealize Operations for Published Applications broker agent on an Active XenDesktop Delivery Controller.

You only install one broker agent for each XenDesktop Site.

A check box in the Broker Agent Setup wizard controls whether the Broker Agent Configuration wizard opens immediately after you install the broker agent. This check box is selected by default.

Prerequisites

Install the vRealize Operations for Published Applications solution, add your license key, and create an

instance of the vRealize Operations for Published Applications adapter.

Verify that you downloaded the broker agent installation file.

Verify that you configured the XenDesktop Controller, Store Front, and PVS server for remote WMI by

granting DCOM remote access/activation permissions to the servers. The user name must include the user name that you indicated for the servers.

XenDesktop Delivery controller's SSL certificate should be added as a trusted certificate if HTTPS (SSL)

is enabled for OData (Monitoring Service).

If OData (Citrix Monitoring Service) is configured on listen on SSL, the Broker Agent will create

connections to XenDesktop Delivery Controller using HTTPS.

So a valid certificate should be installed on Delivery Controller and this certificate should be added as a trusted certificate in Delivery Controller.

If the certificate is issued by a Certificate Authority, this CA should be a trusted publisher in Delivery Controller.

Procedure

1 Log in to the machine where you plan to install the broker agent using a domain account that is part of

the local administrators group.

2 Install the broker agent.

Option Action

Command line

EXE file

a Access the command prompt.

Install the broker agent for your environment using the /s, v, or /qn options.

Run the VMware-v4pabrokeragent-x86_64-6.2.0buildnumber.exe command.

a Copy the file for your environment to a temporary folder, and double-

click the EXE file to start the installation procedure.

Double-click the VMware-v4pabrokeragent-x86_64-6.2.0- buildnumber.exe file.

b Follow the steps in the installer.

The broker agent is installed and saved to the Program Files folder.

20 VMware, Inc.

Chapter 4 Installing and Configuring vRealize Operations for Published Applications

What to do next

Configure the broker agent. See “Configure the vRealize Operations for Published Applications Broker

Agent,” on page 21.

Configure the vRealize Operations for Published Applications Broker Agent

A check box in the Broker Agent Setup wizard controls whether the Broker Agent Configuration wizard opens immediately after you install the broker agent. This check box is selected by default.

During broker agent configuration, you pair the broker agent with a vRealize Operations for Published Applications adapter instance. Pairing the broker agent with a vRealize Operations for Published Applications adapter instance is a necessary authentication step that enables the broker agent and desktop agents to communicate with the vRealize Operations for Published Applications adapter. The broker agent and desktop agents cannot communicate with the vRealize Operations for Published Applications adapter until the pairing process is complete.

If you are monitoring multiple XenDesktop Sites, you can pair the broker agent installed in each Site with the same vRealize Operations for Published Applications adapter instance as long as the total number of desktops that the vRealize Operations for Published Applications adapter instance handles does not exceed 10,000.

Each time you restart the broker agent service, a new log file is created.

If a log file was created for the day and the broker agent is restarted on that day, a new log file is created. The name of the new log file is v4pa_brokeragent_svc_<date>_00.log, and the log rotation follows this series.

Prerequisites

Install the vRealize Operations for Published Applications broker agent. See “Install the vRealize

Operations for Published Applications Broker Agent,” on page 20.

Verify that you have the server key for the vRealize Operations for Published Applications adapter.

You specified the server key when you created a credential for the adapter instance.

Verify that you have the IP address or FQDN of the machine where you installed the

vRealize Operations for Published Applications adapter.

Procedure

1 If the Broker Agent Configuration wizard is not already open, start it by selecting Start > VMware >

vRealize Operations for Published Apps Broker Agent Settings.

2 In the Adapter IP/FQDN Address text box, type the IP address of the vRealize Operations Manager

node or remote collector where the vRealize Operations for Published Applications adapter instance is running.

3 In the Port text box, type the port used to connect to the vRealize Operations for Published Applications

adapter.

By default, the broker agent uses port 3095 to communicate with the vRealize Operations for Published Applications adapter. You can modify the default port number, depending on your network configuration.

4 Type and confirm the pairing key for the vRealize Operations for Published Applications adapter.

VMware, Inc. 21

VMware vRealize Operations for Published Applications Installation and Administration

5 Click Pair to pair the broker agent with the vRealize Operations for Published Applications adapter,

and click Test to test the connection.

The status of the pairing process appears in the Text area.

6 After the pairing process succeeds, click Next.

7 On the Copy Information page, click Copy to copy the certificate string to the clipboard and click Next.

Save this text to copy to the GPO Template.

8 Provide the requested information on the Citrix Delivery Controller Information window.

a Type the XenDesktop environment domain name, domain administrator, and credentials.

b Click Test to validate the connection to the XenDesktop Controller server.

c Click Next.

9 (Optional) Edit the interval values on the Intervals and Timeouts page, and click Next.

10 (Optional) Configure the logging level and log rotation on the Configure the logging parameters page,

and click Next.

11 When the Service Configuration window appears, select Start/Restart, and then click Next.

12 Review the configurations and click Finish to apply the configurations.

The vRealize Operations for Published Applications broker agent is configured and available.

NOTE To configure the Broker-Agent to use a Read-Only/Custom Administrator account for XenDesktop Delivery Controller, go to “Configure Broker Agent to use Non-Admin User for Citrix Desktop Delivery

Controller,” on page 22.

What to do next

Verify the status of the vRealize Operations for Published Applications broker agent in the Windows Services Management Console.

Review the logs by browsing to the C:\ProgramData\VMware\VMware vRealize Operations for Published

Apps\Broker Agent\logs directory.

Configure Broker Agent to use Non-Admin User for Citrix Desktop Delivery Controller

You can configure broker agent to use non-admin user for Citrix Desktop Delivery Controller.

Prerequisites

If you want to configure broker agent to use Read-Only/Custom administrator for connecting to Citrix delivery controller, follow these steps:

Ensure that the Read-Only/Custom Administrator has read access to Site and Monitoring Databases.

Ensure that Read-Only/Custom Administrator has read/execute/remote access over WinRM,

RemotePowershell and WMI (Root\CIMV2).

Procedure

1 You can achieve this by adding the user to local "Administrators" group of the delivery controller

machine.

22 VMware, Inc.

Chapter 4 Installing and Configuring vRealize Operations for Published Applications

2 Follow these steps if you don't want the user to have Administrator access on delivery controller.

a Login to delivery controller as full administrator.

b Run command winrm configSDDL default from command prompt. Add Read/Execute permissions

for Read-Only/Custom Administrator.

c Run Set-PSSessionConfiguration -name Microsoft.PowerShell -ShowSecurityDescriptorUI from

powershell prompt. Add Read/Execute permissions for Read-Only/Custom Administrator.

d Go to Computer Management > Services and Applications > WMI Control.

e Right click and select Properties.

f Go to Security tab.

g Click CIMV2 > Security.

Add Execute Methods and Remote Enable permissions for Read-Only/Custom Administrator.

h Restart the WinRM Service.

i Download and install the "subinacl" tool from

http://www.microsoft.com/en-us/download/details.aspx?id=23510.

j Add Execute Methods and Remote Enable permissions for Read-Only/Custom Administrator.

k From Command Prompt, navigate to subinacl installation directory. By default, it gets installed in

"C:\Program Files (x86)\Windows Resource Kits\Tools".

l Run subinacl.exe /service CitrixBrokerService /grant=DOMAIN\USER_NAME=S.

Install a vRealize Operations for Published Applications Desktop Agent

You install desktop agents on all Delivery Controllers, Store Front server, RDS host, License server, and VDI machines.

Prerequisites

Verify that you downloaded the desktop agent installation file.

Procedure

1 Log in to the machine where you plan to install the desktop agent, using a domain account that is part

of the local administrators group.

2 Install the desktop agent.

Option Action

Command line

EXE file

a Access the command prompt.

b Run the Desktop agent:

For 64-bit: Run the VMware-v4padesktopagent-x86_64-6.2.0buildnumber.execommand using the /s, v, or /qn options.

For 32-bit: Run the VMware-v4padesktopagent-6.2.0buildnumber.execommand using the /s, v, or /qn options.

Copy the VMware-v4padesktopagent-x86_64-6.2.0-

buildnumber.exe (64-bit) or VMwarev4padesktopagent-6.2.0-buildnumber.exe (32-bit) file to a

temporary folder.

Double-click the VMware-v4padesktopagent-x86_64-6.2.0-

buildnumber.exe or the VMware-v4padesktopagent- x86_64-6.2.0-buildnumber.exe (64-bit) or VMwarev4padesktopagent-6.2.0-buildnumber.exe (32-bit)file.

c Follow the steps to complete the installer.

VMware, Inc. 23

VMware vRealize Operations for Published Applications Installation and Administration

The desktop agent is installed in Program Files folder.

Push the vRealize Operations for Published Applications Desktop Agent Pair Token Using a Group Policy

You use the Microsoft Group Policy Editor to create the GPO. After you create the GPO, you must apply it to a base image or to an Organizational Unit (OU) on your Active Directory server, depending on your configuration.

vRealize Operations for Published Applications group-policy settings are provided in the

v4pa_desktopagent.admx file that is installed in the %programfiles%\VMware\vRealize Operations for Published Apps\Broker Agent\extras\GroupPolicyFiles directory.

The language-specific resources, for example .adml files, are installed in the %programfiles

%\VMware\vRealize Operations for Published Apps\Broker Agent\extras\GroupPolicyFilese\language

directory.

If there is an Authentication Failure for a desktop agent you must update the GPO policy for desktop agent authentication. When you update the GPO policy for desktop agent authentication, and there are other policies that require updating, all pending policies are updated, not just the GPO policy for desktop agent authentication.

Procedure

1 Create an organizational unit (OU) in the domain controller machine.

2 If the XD-XA server was already added to the computer account, move the XD-XA server to the OU.

a Access Active Directory Users Computers, and select Computer, right-click your XD-XA server,

and in the context menu select Move....

b In the Move object into container window, select the OU you created.

The XD-XA server is now moved to the OU.

3 Create a Group Policy object using the Group Policy Management Console (GPMC).

4 Copy the certificate string and the RMI URL from the broker agent configuration utility.

5 Copy the v4pa_desktopagent.admx file to PolicyDefinitions folder, which is in the

c:\Windows\PolicyDefinitions directory.

The v4pa_desktopagent.admx file is in the "%ProgramFiles%\VMware\vRealize Operations for

Published Apps\Broker Agent\extras\GroupPolicyFiles directory.

6 Copy the v4pa_desktopagent.adml file to en-us folder, which is in the

c:\Windows\PolicyDefinitions\en-us directory.

The v4pa_desktopagent.adml file is in the "%ProgramFiles%\VMware\vRealize Operations for

Published Apps\Broker Agent\extras\GroupPolicyFiles\en_us directory.

7 Set the Group Policy.

a On the controller machine, click Start and type the gpmc.msc command in the search box.

b Right-click the GPO that you created and select Edit.

c Select Computer Configuration > Policies > Administrative Templates > VMware Published

Apps Agent Configuration > vRealize Operations, and double-click the item in the right pane.

24 VMware, Inc.

Chapter 4 Installing and Configuring vRealize Operations for Published Applications

d Select Enable and copy the RMI URL and certificate string in the policy template.

You might receive a warning that you exceeded the maximum number of characters per line.

e (Optional) Break the line by pressing Enter, and click Apply, and then click OK.

8 Verify on the XD-XA server machine that the RMI URL and certificate string in the

HKLM\Software\Policies\VMware, Inc.\vRealize operations for published Apps\Desktop Agent

directory. RMI URL is of the format rmi://<vrops_ip>:3095.

What to do next

Install desktop agent on the VDI and RDSH hosts you want to monitor. If you already installed a desktop agent and planned to push through GPO at later stage, there might be exceptions in the desktop agent log files. After the pair token is pushed using the GPO, you should restart the desktop agent service.

VMware, Inc. 25

VMware vRealize Operations for Published Applications Installation and Administration

26 VMware, Inc.

Monitoring Your Citrix XenDesktop

and Citrix XenApp Environments 5

When you install the vRealize Operations for Published Applications solution, preconfigured dashboards and predefined report templates appear in the vRealize Operations Manager user interface. You can use the Citrix XenDesktop and Citrix XenApp dashboards and reports along with the standard vRealize Operations Manager object monitoring features to monitor your Citrix XenDesktop and Citrix XenApp environments.

This chapter includes the following topics:

“Using the XD-XA Dashboards,” on page 27

“Using the XD-XA Reports,” on page 32

Using the XD-XA Dashboards

The XD-XA dashboards are in the Published Applications group in the Dashboard List menu in the vRealize Operations Manager user interface.

Widget Interaction in XD-XA Dashboards

vRealize Operations Manager supports interaction between widgets in a single dashboard. Widgets are combined so that the content of the destination widget is updated according to the value selected in the source widget.

For information about creating and modifying dashboards and customizing widgets see vRealize Operations Manager Customization and Administration Guide.

Table 5‑1. Widget Interaction in XD-XA Dashboards

Dashboard Source Widget Destination Widget

XD-XA Overview Sites Site Capacity Metrics

XD-XAOverview Sites Site Session Metrics

XD-XA Server Desktops Session-host Servers Session Host Server Resource

Utilization

XD-XA Servers Desktops Session-host Servers Session Host Server Indicator Metrics

XD-XA Servers Applications Applications Application Instance Trend

XD-XA Servers Applications Applications Application Instances

XD-XA Servers Applications Applications Application Launch Duration Trend

XD-XA Servers Applications Applications Application Users

XD-XA Servers Applications Applications Instances Application Instance Resource Trend

XD-XA Servers Applications Session Host Servers Session Indicator Metrics

VMware, Inc. 27

VMware vRealize Operations for Published Applications Installation and Administration

Table 5‑1. Widget Interaction in XD-XA Dashboards (Continued)

Dashboard Source Widget Destination Widget

XD-XA VDI Desktops VDI Desktops VDI Session Details

XD-XA VDI Desktops VDI Session Details VDI Desktop Resource Utilization

XD-XA VDI Desktops VDI Session Details Running Application List

XD-XA Session Details Session Details Session logon Breakdown

XD-XA Session Details Session Details Session Metrics

XD-XA Session Details Session Details Session Processes

XD-XA Session Details Session Details Users

XD-XA Session Details Users User Logon Duration Trend

XD-XA Session Details Users Application Launched by User

XD-XA User Experience vCPU Experience vCPU Relationship

XD-XA User Experience vCPU Experience vCPU Ready % Chart

XD-XA User Experience vDisk Experience vDisk Relationship

XD-XA User Experience vDisk Experience vDisk Latency Chart

XD-XA User Experience vRAM Experience vRAM Relationship

XD-XA User Experience vRAM Experience vRAM Latency Chart

Introducing the XD-XA Dashboards

You can use the preconfigured XD-XA dashboards to monitor the performance of your XenDesktop environment.

Table 5‑2. XD-XA Dashboard Summary

Dashboard What It Shows When To Use It

“XD-XA Overview,” on

page 30

“XD-XA Server Desktops,” on

page 31

“XD-XA Session Details,” on

page 31

Status of your end-to-end XD-XA environment, including the XD-XA-related alerts, key Site metrics, Site related vCenter capacity.

Session-host server metrics and related vSphere VMs, server resource utilization and server indicator metrics.

Detailed information of all the sessions, session logon breakdown, session performance metrics, running processes of the session, Horizon users summary, User logon duration trend, and the report of what application are launched by a user and when.

Assess overall XD-XA

performance, and the overall user experience.

View the top XD-XA-related

alerts.

View Site related vCenter

remaining capacity and reclaimable capacity.

Check servers alerts, server

indicator metrics, and resource utilization metrics.

Check detailed session

information, check session logon details, retrieve session running processes for trouble shooting, check users summary, check user logon duration trend, and look at the report of what application are launched by a user and when.

28 VMware, Inc.

Chapter 5 Monitoring Your Citrix XenDesktop and Citrix XenApp Environments

Table 5‑2. XD-XA Dashboard Summary (Continued)

Dashboard What It Shows When To Use It

“XD-XA Server Applications,”

on page 31

“XD-XA VDI Desktops,” on

page 32

“XD-XA User Experience,” on

page 32

Application summary data, application instance number trend, application instance summary data, application instance resource utilizaiton, application launch duration trend, application users, Application related servers, and server indicator metrics.

VDI Desktops related alerts, VDI Desktop summary information and VDI session detailed information, VDI desktop session resource utilization, and running application list of a VDI desktop session.

vCPU Experience heatmap, vDisk Experience heatmap, vRAM Experience heatmap, vCPU relationship, vDisk relationship, vRAM relationship, vCPU chart, vDisk chart, vRAM chart, and Delivery Group critical alerts.

Check application summary

data, performance data, launch duration historical trend, the report of which users launched applications and when, application related server indicator metrics.

Check VDI Desktop overall

status, top alerts, resource utilization, and retrieving session running application list for troubleshooting.

Check overall and detailed

vCPU/vDisk/vRAM experience, check delivery controller critial alerts.

Understanding the Health Badge

The health badge indicates immediate issues that might require your attention. It helps you identify the current health of your system.

vRealize Operations Manager combines workload, anomalies, and faults to assess the overall health of your system and to determine the expected workload level in that environment. A low health score might indicate a potential issue.

The health badge is enabled on vRealize Operations for Published Applications objects.

Table 5‑3. Understanding the Health Badge

Object Description

XD-XA Application Instance

XD-XA Application Session

XD-XA Broker Agent Collector

XD-XA Desktop OS Machine

XD-XA Desktop Session The Desktop Session Network alert is triggered when the session latency is too high.

The Application Performance Problem alert is triggered when application instance performance problem is detected, when CPU processor time is too high, or memory consumed is more.

The Application Session Network alert is triggered when the session latency is too high.

The Application Session performance Problem alert is triggered when CPU processor time is too high or memory consumed is more.

Not receiving data from the Broker Agent alert is triggered when Broker agent is not reachable.

Desktop OS Machine is not available for use alert is triggered when VDA machine is not available

Published Apps Adapter is not receiving Data from the Desktop Agent alert is triggered when Desktop agent is not working/not working on server on Store front.

Desktop OS Machine Performance Problem alert is triggered when CPU processor time is too high.

The Desktop Session performance Problem alert is triggered when CPU processor time is too high or memory consumed is more.

VMware, Inc. 29

VMware vRealize Operations for Published Applications Installation and Administration

Table 5‑3. Understanding the Health Badge (Continued)

Object Description

XD-XA Delivery Controller

XD-XA Licensing Server Published Apps Adapter is not Receiving Data from the Desktop Agent alert is triggered

XD-XA PVS The PVS Server is not reachable from XD Controller alert is triggered when PVS server is not

XD-XA Store Front StoreFront Server cannot be accessed alert is triggered when store front service is down.

XD-XA Site The Site Database service has Failed alert is triggered when site database is down.

XD-XA Server OS machine

Delivery Controller Database Configuration Fault alert is triggered when Citrix Broker Service is down or there is no connectivity.

The StoreFront Service has Failed alert is triggered when store front service is not accessible from Delivery Controller

The Host service has failed alert is triggered when Citrix host service is down.

The Monitor service has failed alert is triggered when Citrix monitor service is down.

The Machine Creation Service has failed alert is triggered when machine service is down service is down.

Published Apps adapter is not receiving data from the Desktop Agent alert is triggered when Desktop agent is not working on Delivery controller.

Delivery Controller Performance Problem alert is triggered when CPU processor time is too high.

when Desktop agent is not working on licensing server.

License Server Performance Problem alert is triggered when CPU processor time is too high.

reachable.

Published Apps Adapter is not Receiving Data from the desktop agent alert is triggered when Desktop agent is not working on the Store Front.

StoreFront Performance Problem alert is triggered when CPU processor time is too high.

This alert is triggered in the following scenarios:

A site performance problem has been detected. One or more store front servers of this site have performance problem. Check the CPU usage or memory for possible cause.

A site performance problem has been detected. One or more license servers of this site have performance problem. Check the CPU usage or memory for possible cause.

A site performance problem has been detected. One or more delivery controllers of this site have performance problem. Check the CPU usage or memory for possible cause.

A site performance problem has been detected. One or more desktop os machines of this site have performance problem. Check the CPU usage or memory for possible cause.

A site performance problem has been detected. One or more server os machines of this site have performance problem. Check the CPU usage or memory for possible cause.

Published Apps Adapter is not receiving data from the desktop agent alert is triggered when Desktop agent is not working on session host machine.

Server OS Machine Performance Problem alert is triggered when CPU processor time is too high.

XD-XA Overview

The XD-XA Overview dashboard shows the overall status of your environment. Use the XD-XA Overview dashboard to visualize the end-to-end XenDesktop and XenApp environments, XD-XA-related alerts, key Site metrics, and Site-related vCenter capacity.

Tips for using the XD-XA Overview Dashboard

To view the overall status of a Site, view the values of the Site Session Metrics and Site Capacity Metrics

widgets.

Use the Virtual Machine of Controller Server widget to view badge health and badge workload for the

VM of the controller server.

To view the overall status of a Site, view the Top Alerts, values of the Site Session Metrics widgets.

30 VMware, Inc.

Chapter 5 Monitoring Your Citrix XenDesktop and Citrix XenApp Environments

To view the overall capacity of the site related vCenter, view Remaining Capacity and reclaimable

capacity widgets.

XD-XA Server Desktops

Use the XD-XA Servers dashboard to assess server metrics and related vSphere VMs, server resource utilization, and server indicator metrics.

Tips for using the XD-XA Server Desktops Dashboard

Use the Virtual Machine of Session-host Server widget to view the badge health and badge workload

for the VM of the session-host server.

Use the Session-host Server Resource Utilization widget to view the CPU Processor Time, Disk Read

and Write, and Memory Available.

Use the Top Alert and Session-host Servers widget to view the server alerts and server summary data.

Use the Session-host server resource utilization widget to view server resource utilization data.

Use the Session-host Server Indicator Metrics widget to view server users and sessions summary data.

XD-XA Session Details

Use the XD-XA Session Details dashboard to view detailed information about sessions, application sessions, and server sessions.

Tips for using the XD-XA Session Details Dashboard

To view session processes, select a session from the Sessions widget and view the information in the

Session Processes widget.

Use the Session Indicator Metrics widget to view session health, reconnect duration, logon duration,

profile load duration, session duration and session state.

To view session processes, select a session from the Sessions widget and view the information in the

Session Processes widget.

Use the Session Logon Breakdown widget to view various session logon sections.

Use the Users widget to view all Users in XD-XA environment.

Use the User logon duration trend to view user logon historical trend.

Use the Applications Launched By User widget to get the report of what application are launched by a

user and when.

XD-XA Server Applications

Use the XD-XA Server Applications dashboard to check application summary data, performance data, launch duration historical trend, the report of which users launched applications and when, and application-related server indicator metrics.

Tips for using the XD-XA Server Applications Dashboard

Use the Application Launch Duration widget to view application launch historical trend.

Use the Application User widget to view the report of which users launched applications and when and

application-related server indicator metrics.

VMware, Inc. 31

VMware vRealize Operations for Published Applications Installation and Administration

XD-XA VDI Desktops

Use the XD-XA VDI Desktops dashboard to view VDI Desktops-related alerts, VDI Desktop summary information and VDI session detailed information, VDI desktop session resource utilization. and running application list of a VDI desktop session.

NOTE Get Process to retrieve applications running in a VDI session is not supported.

Tips for using the XD-XA VDI Desktops Dashboard

Use the Top Alerts widet to view all desktop OS machine-related alerts.

Use the Running Application List widget to view the current running applications on a VDI desktop.

XD-XA User Experience

Use the XD-XA User Experience dashboard to view detailed information of vCPU Experience heatmap, vDisk Experience heatmap, vRAM Experience heatmap, vCPU relationship, vDisk relationship, vRAM relationship, vCPU chart, vDisk chart, vRAM chart, and Delivery Group critical alerts.

Tips for using the XD-XA User Experience Dashboard

Use the vCPU/vDisk/vRAM experience heat map widgets to view overall user experience.

Use the Delivery Group Critical Alerts widget to view overall critical alert number of all Delivery

Groups.

Using the XD-XA Reports

VMware vRealize Operations Manager has several report templates that you can generate for detailed information about sites, license usage, and servers. You can also create new report templates, edit existing report templates, and clone report templates.

To access the vRealize Operations for Published Applications report templates, select Content > Report in vRealize Operations Manager.

Introducing the XD-XA Reports

The predefined report templates provide detailed information about your XenDesktop and XenApp environments. You can generate the report as a PDF or CSV file.

Table 5‑4. Summary of XD-XA Report Templates

XD-XA Report Templates Report Content

XD-XA Application Report Includes information about your applications.

XD-XA Server Report Includes overall information about your servers.

XD-XA Site Overview Report Includes summary information about your Sites. You can

XD-XA License Trend Report Includes information about the trend of XenDesktop and

XD-XA License Usage Report Includes information about the total duration of three

see application statistics, application instance trend, and session trend.

XenApp license usage.

kinds of session (VDI desktop session, RDS desktop session, and application session) of the users.

32 VMware, Inc.

Chapter 5 Monitoring Your Citrix XenDesktop and Citrix XenApp Environments

Subjects for Reports

When you configure reports, vRealize Operations Manager generates the report subjects according to your configurations.

To ensure the best possible reports, use the following report subjects.

Table 5‑5. Subjects for Reports

Report Subject

XD-XA Site Overview Report Site

XD-XA Server Report Server OS Machine

XD-XA Application Report Application and Site

XD-XA License Usage Report Licensing Server

XD-XA License Trend Report License

XD-XA User Usage Summary Report Site

Subjects for Report Views

When you configure the views for a report, vRealize Operations Manager generates the views according to your configurations.

To ensure the best possible report views, use the following view subjects.

Table 5‑6. Subjects for Report Views

Report View Subject

XD-XA Application Daily User Count Trend Application

XD-XA Application Instance Count Trend Application

XD-XA Application Instance Summary Application Instance

XD-XA Application Launch Duration Trend Application

XD-XA Farm Application Summary Application

XD-XA License Usage Summary Licensing Server

XD-XA License Usage Trend License

XD-XA Site App Instance Trend Site

XD-XA Site Session Trend Site

XD-XA Site Summary Site

XD-XA Server CPU Trend Server OS Machine, Delivery Controller

XD-XA Server Disk Trend Server OS Machine, Delivery Controller

XD-XA Server ICA Bandwidth Trend Server OS Machine

XD-XA Server Memory Trend Server OS Machine, Delivery Controller

XD-XA Server Network Trend Server OS Machine, Delivery Controller

XD-XA Server Summary Server OS Machine, Delivery Controller

XD-XA User Session Logon Duration Trend User

XD-XA User Usage View User

VMware, Inc. 33

VMware vRealize Operations for Published Applications Installation and Administration

34 VMware, Inc.

Managing RMI Communication in vRealize Operations for Published

Applications 6

The vRealize Operations for Published Applications components communicate by using Remote Method Invocation (RMI). The vRealize Operations for Published Applications adapter exposes RMI services that can be called by an external client. The vRealize Operations for Published Applications adapter acts as a server and the broker agents and desktop agents act as clients. You can change the default ports for these RMI services.

For detailed descriptions of the vRealize Operations for Published Applications components, see “vRealize

Operations for Published Applications Architecture,” on page 8.

This chapter includes the following topics:

“RMI Services,” on page 35

“Default Ports for RMI Services,” on page 36

“Changing the Default RMI Service Ports,” on page 36

RMI Services

The vRealize Operations for Published Applications adapter exposes various RMI service.

RMI registry service

Desktop message server

Broker message server

Certificate management server

The broker and desktop agents initially connect to the RMI registry service and request the address of a specific RMI server. Because the RMI registry service is used only for lookup and no sensitive data is transmitted to it, it does not use an encrypted channel.

The desktop agents connect to the desktop message server and use it to send XD-XA performance data collected by the desktop agent. The desktop message server uses an SSL/TLS channel to encrypt the data that is sent from the desktop agents.

The broker agent connects to the broker message server and uses it for sending XD-XA inventory information to the vRealize Operations for Published Applications adapter. The broker message server uses an SSL/TLS channel to encrypt the data that is sent from the broker agent.

The broker agent connects to the certificate management server during the certificate pairing process. The certificate management server does not use an encrypted channel. Certificates are encrypted by using the server key during the certificate pairing process. For information, see Chapter 11, “Certificate

Pairing,” on page 51.

VMware, Inc. 35

VMware vRealize Operations for Published Applications Installation and Administration

Default Ports for RMI Services

The RMI services use certain default ports. The default ports are left open on the firewall on cluster nodes and remote collector nodes.

Table 6‑1. Default Ports for RMI Services

RMI Service Default Port

RMI registry 3095

Desktop message server 3096

Broker message server 3097

Certificate management server 3098

Changing the Default RMI Service Ports

You can change the default ports for the RMI registry service, desktop message server, broker message server, and certificate management server.

RMI Service Port Properties

The RMI service ports are defined in properties in the msgserver.properties file on the server where the vRealize Operations for Published Applications adapter is running.

Table 6‑2. RMI Service Port Properties

RMI Service Property

RMI registry registry-port

Desktop message server desktop-port

Broker message server broker-port

Certificate management server certificate-port

Change the Default RMI Service Ports

You can change the default RMI service ports by modifying the msgserver.properties file on the server where the vRealize Operations for Published Applications adapter is running.

Prerequisites

Verify that you can connect to the node where the vRealize Operations for Published Applications

adapter is running.

Become familiar with the RMI service port properties. See “RMI Service Port Properties,” on page 36.

Procedure

1 Log in to the node where the vRealize Operations for Published Applications adapter is running.

36 VMware, Inc.

Chapter 6 Managing RMI Communication in vRealize Operations for Published Applications

2 In a text editor, open the msgserver.properties file.

Platform File Location

Linux

Windows

/usr/lib/vmwarevcops/user/plugins/inbound/V4PA_adapter3/work/msgserver.pro perties

C:\vmware\vcenteroperations\user\plugins\inbound\V4PA_adapter3\work\msgserve r.properties

3 Modify the properties for the RMI service ports that you want to change.

4 Save your changes and close the msgserver.properties file.

What to do next

Open the new RMI service port or ports on the vRealize Operations Manager firewall. See “Open the Ports

Used by vRealize Operations for Published Applications,” on page 16.

Update the vRealize Operations Manager Firewall

If you change the default port for an RMI service, you must open the new port on the vRealize Operations Manager firewall.

NOTE If the vRealize Operations for Published Applications adapter is running on a remote collector, see the documentation for the firewall on the remote collector node for information about updating the firewall.

Procedure

1 On the cluster node where the vRealize Operations for Published Applications adapter is running, use a

text editor to open the vmware-vcops-firewall.conf file.

The vmware-vcops-firewall.conf file is in the /opt/vmware/etc/ directory.

2 Update the appropriate ports in the vmware-vcops-firewall.conf file and save the file.

3 Restart the firewall service to make your changes take effect.

a Execute service vmware-vcops-firewall restart.

4 On windows, Access Windows Firewall and select Windows Firewall > Advanced Settings > Inbound

Rules > New Rule > Port and click Next. Select Specific local ports and type the ports that you are using, for example, 3095-3098. The default ports are 3095-3098.

VMware, Inc. 37

VMware vRealize Operations for Published Applications Installation and Administration

38 VMware, Inc.

Changing the Default TLS Configuration in vRealize Operations for Published

Applications 7

The vRealize Operations for Published Applications broker message server uses an TLS channel to communicate with the broker agents. The vRealize Operations for Published Applications desktop message server uses an TLS channel to communicate with the desktop agents. You can change the default TLS configuration for servers and agents by modifying TLS configuration properties.

This chapter includes the following topics:

“Default TLS Protocols and Ciphers for vRealize Operations for Published Applications,” on page 39

“TLS Configuration Properties,” on page 40

“Change the Default TLS Configuration for Servers,” on page 40

“Change the Default TLS for Agents,” on page 40

Default TLS Protocols and Ciphers for vRealize Operations for Published Applications

When an RMI connection is established between an agent and a server, the agent and server negotiate the protocol and cipher to use

Each agent and server has a list of protocols and ciphers that it supports. The strongest protocol and cipher that is common to both the agent list and server list is selected for the TLS channel.

By default, RMI agents and servers are configured to accept only TLSv1.2 connections with the following ciphers.

TLS_DHE_DSS_WITH_AES_128_GCM_SHA256

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

VMware, Inc.

VMware vRealize Operations for Published Applications Installation and Administration

TLS Configuration Properties

The TLS protocols and ciphers for the desktop and broker message servers are specified in properties in the

msgserver.properties file. The TLS protocols and ciphers for the desktop and broker agents are specified in

properties in the msgclient.properties file.

Table 7‑1. SSL/TLS Configuration Properties

Property Default Value

sslProtocols List of accepted TLS protocols,

separated by commas.

sslCiphers List of accepted TLS ciphers, separated

by commas.

TLSv1.2

TLS_DHE_DSS_WITH_AES_128_GCM_SHA256

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

Change the Default TLS Configuration for Servers

You can change the default TLS configuration that the desktop message server and broker message server use by modifying the msgserver.properties file on the server where the vRealize Operations for Published Applications adapter is running.

Prerequisites

Verify that you can connect to the node where the vRealize Operations for Published Applications

adapter is running.

Become familiar with the TLS configuration properties. See “TLS Configuration Properties,” on page 40.

Procedure

1 Log in to the node where the vRealize Operations for Published Applications adapter is running.

2 In a text editor, open the msgserver.properties file.

Platform File Location

Linux

Windows

/usr/lib/vmwarevcops/user/plugins/inbound/V4PA_adapter3/work/msgserver.pro perties

C:\vmware\vcenteroperations\user\plugins\inbound\V4PA_adapter3\work\msgserve r.properties

3 Modify the SSL/TLS configuration properties.

4 Save your changes and close the msgserver.properties file.

Change the Default TLS for Agents

You can change the TLS configuration that the desktop agents and broker agents use to connect to the desktop and broker message servers by modifying the msgclient.properties file.

Prerequisites

For the desktop agents, verify that you can connect to the remote XD-XA server.

For a broker agent, verify that you can connect to the host where the XD-XA broker agent is installed.

Become familiar with the TLS configuration properties. See “TLS Configuration Properties,” on page 40.

40 VMware, Inc.

Chapter 7 Changing the Default TLS Configuration in vRealize Operations for Published Applications

Procedure

1 Modify the TLS configuration properties for a desktop agent.

a Log in to the XD-XA server where the XD-XA agent is running.

b In a text editor, open the msgclient.properties file.

The msgclient.properties file is in the C:\ProgramData\VMware\vRealize Operations for

Published Apps\Desktop Agent\conf directory.

c Modify the TLS configuration properties.

d Save your changes and close the msgclient.properties file.

2 Modify the TLS configuration properties for a broker agent.

a Log in to the remote collector host where the broker agent is installed.

b In a text editor, open the msgclient.properties file.

The msgclient.properties file is in the C:\ProgramData\VMware\vRealize Operations for

Published Apps\Broker Agent\conf directory.

c Modify the TLS configuration properties.

d Save your changes and close the msgclient.properties file.

VMware, Inc. 41

VMware vRealize Operations for Published Applications Installation and Administration

42 VMware, Inc.

Managing Authentication in vRealize Operations for Published

Applications 8

RMI servers provide a certificate that the agents use to authenticate the vRealize Operations for Published Applications adapter. Broker agents use SSL/TLS client authentication with a certificate that the vRealize Operations for Published Applications adapter uses to authenticate the broker agents. Desktop agents provide tokens that the vRealize Operations for Published Applications adapter uses to authenticate the desktop agents.

To increase security, you can replace the default self-signed certificates that the vRealize Operations for Published Applications adapter and broker agents use.

Understanding Authentication for Each Component

Each vRealize Operations for Published Applications component handles authentication differently.

vRealize Operations for Published Applications Adapter Authentication

When an RMI connection is established between the desktop message server and a desktop agent, or between the broker message server and a broker agent, the agent requests a certificate from the server to perform authentication. This certificate is validated against the agent's trust store before proceeding with the connection. If the server does not provide a certificate, or the server certificate cannot be validated, the connection is rejected.

When the vRealize Operations for Published Applications adapter is first installed, a self-signed certificate is generated. The desktop message server and broker message server use this self-signed certificate by default to authenticate to their agents. Because this certificate is generated dynamically, you must manually pair the vRealize Operations for Published Applications adapter and broker agent before the agents can communicate with the vRealize Operations for Published Applications adapter. See Chapter 11, “Certificate

Pairing,” on page 51.

Desktop Agent Authentication

Connections to the desktop message server require an authentication token to verify that the connection is coming from a valid desktop agent. The desktop agent generates a unique authentication token for each remote desktop.

In addition, the desktop agent generates a serverID for the XD-XA server and write the serverID into vRealize Operations Manager. When a desktop agent attempts to send data to the vRealize Operations for Published Applications adapter, the adapter will verify whether the authentication token has been cached in memory. If there is no server with same name, the adapter caches the server name and authentication token in memory. If the server has been cached, compare the cached authentication token and the one sent. If the tokens are same, accept the message, else reject the desktop agent message.

VMware, Inc.

VMware vRealize Operations for Published Applications Installation and Administration

The vRealize Operations for Published Applications adapter also checks whether a VM with same serverID exists in vRealize Operations Manager, and adds the VM into the topology when a VM with the same name exists.

Broker Agent Authentication

When an RMI connection is established to the broker message server, the broker message server requests a certificate from the client to perform client authentication. The certificate is validated against the trust store for the vRealize Operations for Published Applications adapter before proceeding with the connection.

If the client does not provide a certificate, or the agent's certificate cannot be validated, the connection is rejected. When you first install the broker agent, a self-signed certificate is generated. The broker agent uses this self-signed certificate by default to authenticate to the vRealize Operations for Published Applications adapter. Because this certificate is generated dynamically, you must manually pair the vRealize Operations for Published Applications adapter and broker agent before the broker agent can communicate with the vRealize Operations for Published Applications adapter. For more information, see

Chapter 11, “Certificate Pairing,” on page 51.

44 VMware, Inc.

Certificate and Trust Store Files 9

The vRealize Operations for Published Applications components use a certificate trust store to store trusted certificates and root certificates for certificate authorities. Certificates and trust stores are stored in Java key store format.

This chapter includes the following topics:

“vRealize Operations for Published Applications Adapter Certificate and Trust Store Files,” on

page 45

“Broker Agent Certificate and Trust Store Files,” on page 46

vRealize Operations for Published Applications Adapter Certificate and Trust Store Files

The certificate and trust store files for the vRealize Operations for Published Applications adapter are in the adapter's work directory. These files are in Java key store format.

The work directory is on the node where the vRealize Operations for Published Applications adapter is installed. On Linux, the path to the work directory is /usr/lib/vmwarevcops/user/plugins/inbound/V4PA_adapter3/. On Windows, the path to the work directory is C:\vmware\vcenteroperations\user\plugins\inbound\V4PA_adapter3\.

You can use the Java keytool utility to view and control the certificate store and trust store files.

Table 9‑1. Java Key Stores in the work Directory

Java Key Store Description

v4pa-adapter.jks

v4pa-truststore.jks

The names of the key store files and their credentials are defined in the msgserver.properties file, which is also in the work directory.

Table 9‑2. Adapter Key Store Configuration Properties in the msgserver.properties File

Property Default Value Description

keyfile

keypass Password to the key store file

VMware, Inc. 45

v4pa-adapter.jks

Contains the certificate that the adapter uses to authenticate itself to agents.

Contains the trust store that the adapter uses to authenticate the broker agent certificate.

Name of the key store file that contains the adapter certificate.

that contains the adapter certificate. The password is dynamically generated.

VMware vRealize Operations for Published Applications Installation and Administration

Table 9‑2. Adapter Key Store Configuration Properties in the msgserver.properties File (Continued)

Property Default Value Description

trustfile

trustpass Password to the key store file

v4pa-truststore.jks

Broker Agent Certificate and Trust Store Files

The broker agent certificate and trust store files are in the C:\ProgramData\VMware\vRealize Operations for

Published Apps\Broker Agent\conf directory on the vRealize Operations for Published Applications broker

server host. These files are Java key store files.

You can use the Java keytool utility to view and control the certificate store and trust store files.

Table 9‑3. Java Key Stores in the conf Directory

Java Key Store Description

v4pa-brokeragent.jks

v4pa-truststore.jks

Contains the certificate that the broker agent uses to authenticate itself to the vRealize Operations for Published Applications adapter.

Contains the trust store that the broker agent uses to authenticate the vRealize Operations for Published Applications adapter certificate.

Name of the key store file that contains the adapter trust store.

that contains the adapter trust store. The password is dynamically generated.

The names of the key store files and their credentials are defined in the msgclient.properties file, which is also in the conf directory.

Table 9‑4. Broker Agent Key Store Configuration Properties in the msgclient.properties File

Property Default Value Description

keyfile

keypass The password to the key store file that

trustfile

trustpass The password to the key store file that

v4pa-brokeragent.jks

v4pa-truststore.jks

The name of the key store file that contains the broker agent's certificate.

contains the broker agent's certificate. The password is dynamically generated.

The name of the key store file that contains the broker agent's trust store.

contains the broker agent's trust store. The password is dynamically generated.

46 VMware, Inc.

Replacing the Default Certificates 10

By default, the vRealize Operations for Published Applications adapter and the broker agent use self-signed certificates for authentication and data encryption. For increased security, you can replace the default selfsigned certificates with certificates that are signed by a certificate authority.

This chapter includes the following topics:

“Replace the Default Certificate for the vRealize Operations for Published Applications Adapter,” on

page 47

“Replace the Default Certificate for the Broker Agent,” on page 49

Replace the Default Certificate for the vRealize Operations for Published Applications Adapter

A self-signed certificate is generated when you first install the vRealize Operations for Published Applications adapter. The desktop message server and the broker message server use this certificate by default to authenticate to the agents. You can replace the self-signed certificate with a certificate that is signed by a valid certificate authority.

Prerequisites

VMware, Inc.

Verify that you can connect to the node where the vRealize Operations for Published Applications

adapter is running.

Verify that you have the password for certificate store. You can obtain the password from the

msgserver.properties file. See “vRealize Operations for Published Applications Adapter Certificate

and Trust Store Files,” on page 45.

Become familiar with the Java keytool utility. Documentation is available at http://docs.oracle.com.

Procedure

1 Log in to the node where the vRealize Operations for Published Applications adapter is running.

2 Navigate to the vRealize Operations for Published Applications adapter's work directory.

Platform Directory Location

Linux

Windows

/usr/lib/vmwarevcops/user/plugins/inbound/V4PA_adapter3/work

C:\vmware\vcenteroperations\user\plugins\inbound\V4PA_adapt er3\work

VMware vRealize Operations for Published Applications Installation and Administration

Use the keytool utility with the -selfcert option to generate a new self-signed certificate for the vRealize Operations for Published Applications adapter.

Because the default self-signed certificate is issued to VMware, you must generate a new self-signed certificate before you can request a signed certificate. The signed certificate must be issued to your organization.

For example:

keytool –selfcert –alias v4pa-adapter –dname dn-of-org –keystore v4pa-adapter.jks

dn-of-org is the distinguished name of the organization to which the certificate is issued, for example, "OU=Management Platform, O=VMware, Inc., C=US".

By default, the certificate signature uses the SHA1withRSA algorithm. You can override this default by specifying the name of the algorithm with the -sigalg option.

Use the keytool utility with the -certreq option from the adapter work directory to generate a certificate signing request.

A certificate signing request is required to request a certificate from a certificate signing authority.

For example:

keytool –certreq –alias v4pa-adapter –file certificate-request-file -keystore v4paadapter.jks

certificate-request-file is the name of the file that will contain the certificate signing request.

5 Upload the certificate signing request to a certificate authority and request a signed certificate.

If the certificate authority requests a password for the certificate private key, use the password configured for the certificate store.

The certificate authority returns a signed certificate.

6 To import the certificate, copy the certificate file to the vRealize Operations for Published Applications

adapter work directory and run the keytool utility with the –import option.

For example:

keytool –import –alias v4pa-adapter –file certificate-filename -keystore v4pa-adapter.jks

certificate-filename is the name of the certificate file from the certificate authority.

When the keytool utility is finished, the signed certificate is imported to the adapter certificate store.

7 To start using the new certificate, restart the vRealize Operations for Published Applications adapter on

the node where the adapter is running.

Platform Action

Linux

Windows

Run the service vmware-vcops restart command.

Use the Windows Services tool (services.msc) to restart the vRealize Operations for Published Applications Adapter service.

What to do next

After you restart the vRealize Operations for Published Applications adapter, you must pair any broker agents that are attached to the vRealize Operations for Published Applications adapter. See Chapter 11,

“Certificate Pairing,” on page 51.

48 VMware, Inc.

Chapter 10 Replacing the Default Certificates

Replace the Default Certificate for the Broker Agent

A self-signed certificate is generated when you first install the broker agent. The broker agent uses this certificate by default to authenticate to the vRealize Operations for Published Applications adapter. You can replace the self-signed certificate with a certificate that is signed by a valid certificate authority.

Prerequisites

Verify that you can connect to the XD-XA Session host where the broker agent is installed.

Verify that the keytool utility is added to the system path on the data collector host where the broker

agent is installed.

Verify that you have the password for the certificate store. You can obtain this password from the

msgserver.properties file. See “Broker Agent Certificate and Trust Store Files,” on page 46.

Become familiar with the Java keytool utility. Documentation is available at http://docs.oracle.com

Procedure

1 Log in to the vRealize Operations for Published Applications Server host where the broker agent is

installed.

Use the keytool utility with the -selfcert to generate a new self-signed certificate.

Because the default self-signed certificate is issued to VMware, you must generate a new self-signed certificate before you request a signed certificate. The signed certificate must be issued to your organization.

For example:

keytool –selfcert –alias v4pa-brokeragent –dname dn-of-org –keystore v4pa-brokeragent.jks

dn-of-org is the distinguished name of the organization to which the certificate is issued, for example, "OU=Management Platform, O=VMware, Inc. , C=US".

By default, the certificate signature uses the SHA1withRSA algorithm. You can override this default by specifying the name of the algorithm in the keytool utility.

Use the keytool utility with the -certreq option to generate the certificate signing request.

A certificate signing request is required to request a certificate from a certificate signing authority.

For example:

keytool –certreq –alias v4pa-brokeragent –file certificate-request-file -keystore v4pabrokeragent.jks

certificate-request-file is the name of the file that will contain the certificate signing request.

4 Upload the certificate signing request to a certificate authority and request a signed certificate.

If the certificate authority requests a password for the certificate private key, use the password configured for the certificate store.

The certificate authority returns a signed certificate.

VMware, Inc. 49

VMware vRealize Operations for Published Applications Installation and Administration

Copy the certificate file to the conf directory and run the keytool utility with the -import option to import the signed certificate into the certificate store for the broker agent.

You must import the certificate file to the certificate store for the broker agent so that the broker agent can start using the signed certificate.

For example:

keytool –import –alias v4pa-brokeragent –file certificate-filename -keystore v4pabrokeragent.jks

certificate-filename is the name of the certificate file from the certificate authority.

Run the keytool utility with the -import option to import the certificate authority root certificate into the trust store file for the broker agent.

For example:

keytool -import -alias aliasname -file root_certificate -keystore v4pa-truststore.jks trustcacerts

root_certificate is the name of the certificate authority root certificate.

7 Restart the broker agent to start using the new certificate.

You can restart the broker agent by using the vRealize Operations for Published Applications Broker Agent Settings wizard, or by restarting the vRealize Operations for Published Applications Broker Agent Service.

What to do next

After you restart the broker agent, you must pair it with the vRealize Operations for Published Applications adapter. See Chapter 11, “Certificate Pairing,” on page 51.

50 VMware, Inc.

Certificate Pairing 11

Before broker agents can communicate with the vRealize Operations for Published Applications adapter, the adapter certificate must be shared with the agents, and the broker agent certificate must be shared with the adapter. The process of sharing these certificates if referred to as certificate pairing.

The following actions occur during the certificate pairing process:

1 The broker agent's certificate is encrypted with the adapter's server key.

2 A connection is opened to the certificate management server and the encrypted certificate is passed to

the adapter instance. The adapter decrypts the broker agent's certificate by using the server key. If decryption fails, an error is returned to the broker agent.

3 The broker agent's certificate is placed in the adapter's trust store.

4 The adapter's certificate is encrypted with the adapter's server key.

5 The encrypted certificate is returned to the broker agent. The broker agent decrypts the adapter's

certificate by using the server key. If decryption fails, an error is returned to the user.

6 The adapter's certificate is placed in the broker agent's trust store.

7 The adapter's certificate is sent to all XD-XA Session hosts with Group Policy.

After the certificates are successfully paired, they are cached in the trust stores for each individual component. If a provision a new XD-XA server, the adapter's certificate is sent to the server by using the Group Policy, and you do not need to pair the certificates again. However, if either the adapter or broker agent certificate changes, you must pair the certificates again.

VMware, Inc.

You use the vRealize Operations for Published Applications Broker Agent Settings wizard to pair certificates.

VMware vRealize Operations for Published Applications Installation and Administration

52 VMware, Inc.

SSL/TLS and Authentication-Related

Log Messages 12

The vRealize Operations for Published Applications adapter logs SSL/TLS configuration and authenticationrelated messages.

Table 12‑1. vRealize Operations for Published Applications Adapter Log Message Types

Log Message Type Description

CONFIGURATION The SSL/TLS configuration that is being used.

AUTHENTICATION SUCCESS A remote desktop has been successfully authenticated.

AUTHENTICATION FAILED A remote desktop has failed authentication.

Only CONFIGURATION and AUTHENTICATION FAILED events are written to the log by default. To troubleshoot problems, you can raise the logging level to log other types of events.

You can view log messages and modify logging levels in the vRealize Operations Manager user interface.

VMware, Inc.

VMware vRealize Operations for Published Applications Installation and Administration

54 VMware, Inc.

Create a vRealize Operations Manager

Support Bundle 13

If the vRealize Operations for Published Applications adapter does not operate as expected, you can collect log and configuration files in a support bundle and send the support bundle to VMware for analysis.

Procedure

1 Log in to the vRealize Operations Manager user interface with admin privileges.

2 Click the Administration tab and select Support > Support Bundles.

3 Click the Create Support Bundle (plus sign) icon.

4 Select the type of support bundle to generate and the nodes to include in the support bundle.

5 Click OK to create the support bundle.

The progress of the support bundle appears in the Status column on the Support Bundles pane. Support bundle creation might take several minutes, depending on the size of the logs and the number nodes. You can click the Reload Support Bundle icon to refresh the status.

6 Select the support bundle and click the Download Support Bundle icon to download the support

bundle to the server.

You cannot download a support bundle until its status is Succeed. For security, vRealize Operations Manager prompts you for credentials when you download a support bundle.

7 (Optional) Send the support bundle to VMware for support.

VMware, Inc.

VMware vRealize Operations for Published Applications Installation and Administration

56 VMware, Inc.

Download vRealize Operations for Published

Applications Broker Agent Log Files 14

If the vRealize Operations for Published Applications broker agent does not operate as expected, you can download the broker agent log files.

Prerequisites

Verify that you have administrator privileges.

Procedure

1 Log in to the machine where the broker agent is installed.

2 Navigate to C:\programdata\VMware\vRealize Operations for Published Apps\Broker Agent\logs on

broker agent machine.

The logs directory contains the broker agent log files.

3 Use an archive program to create a ZIP file that contains the log files in the logs directory.

4 Send the ZIP file to VMware for support.

VMware, Inc.

VMware vRealize Operations for Published Applications Installation and Administration

58 VMware, Inc.

Download vRealize Operations for Published Applications Desktop Agent Log

Files 15

If the vRealize Operations for Published Applications desktop agent is not operating as expected, you can download the desktop agent log files from the remote desktop and send the log files to VMware for support.

vRealize Operations for Published Applications retains desktop agent log files of the previous seven days by default. You can specify the number of days that vRealize Operations for Published Applications retains desktop agent log files by updating the registry entry LogPruneThreshold under

HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\vRealize Operations for Published Apps\Desktop Agent.

Procedure

1 Log in to the controller server or session host server where the desktop agent is installed.

2 Navigate to C:\ProgramData\VMware\vRealize Operations for Published Apps\Desktop Agent\logs

and locate the desktop agent log files.

Desktop agent log file names begin with v4pa-.

3 Use an archive program to create a ZIP file that contains the desktop agent log files.

4 Send the ZIP file to VMware for support.

VMware, Inc.

VMware vRealize Operations for Published Applications Installation and Administration

60 VMware, Inc.

View Collector and vRealize Operations for Published

Applications Adapter Log Files 16

You can view collector and vRealize Operations for Published Applications adapter log files in the vRealize Operations Manager user interface. Log files are organized in log type folders.

Prerequisites

Verify that you have administrator privileges.

Procedure

1 Log in to the vRealize Operations Manager user interface with admin privileges.

2 Click the Administration tab, click Support, and click Logs.

3 Select Log Type from the Group by drop-down menu.

4 Double-click the Collector folder and double-click the folder for the node on which the adapter instance

is running.

5 View the log files.

a Double-click a log file to view the contents of the log file.

b Type line numbers in the Starting line and # of lines text boxes and click the Load log content icon

(>) to view a specific part of the log file.

6 Click the Reload Tree icon to reload the log tree information and collapse all open folders.

VMware, Inc.

VMware vRealize Operations for Published Applications Installation and Administration

62 VMware, Inc.

Modify the Logging Level for vRealize Operations for Published

Applications Adapter Log Files 17

You can modify the logging level for the collector node that contains the log files for a vRealize Operations for Published Applications adapter instance.

Prerequisites

Verify that you have administrator privileges.

Procedure

1 Log in to the vRealize Operations Manager user interface.

2 Click the Administration tab, click Support, and click Logs.

3 Select Log Type from the Group by drop-down menu.

4 Expand the Collector folder.

5 Select the node on which the vRealize Operations for Published Applications adapter instance is

running and click the Edit Properties icon.

6 In the Logging Level column, click the logging level for the

vRealize Operations for Published Applications adapter log class.

7 Select a logging level from the drop-down menu.

To troubleshoot problems, set the logging level to Info. To view detailed messages, including micro steps, queries, and returned results, set the logging level to Debug.

NOTE If you set the logging level to Debug, log files can become large very quickly. Set the logging level to Debug only for short periods of time.

VMware, Inc.

VMware vRealize Operations for Published Applications Installation and Administration

64 VMware, Inc.

Index

about 5 accessing dashboards 27 adapter

certificates 45 configuring 18 installation 15 instance 18

trust store files 45 adapter authentication 43 architecture 8 authentication, broker agent 44

broker agent

authentication 44

certificates 46, 49

configuring 21

installing 20

certificate pairing 51 certificates

adapter 47

broker agent 49

changing default 47

managing 43

pairing 51

self-signed 47 changing default ports, RMI services 36

ciphers 39 components

adapter 9

broker agent 9

desktop agent 8 configuration

broker agent 21

desktop agents 24 configuring 13

dashboards

health badge 29

Published Applications servers 31

XD-XA Overview 30

XD-XA Session Details Dashboard 31 desktop agent, authentication 43 desktop agents

configuring 24

installing 23

firewall, rules 19 firewalls, updating 37

generating reports 32 GPO 24 group policies 24

health badge 29

installation

broker agent 20

desktop agents 23 installation files 15 installation overview 13 installing

adapter 15

components 13

installation files 15

overview 13 introduction 7

License server, firewall rules 19 license groups 17 licensing, vRealize Operations for Published

Applications 16

log messages, authentication 53

managing certificates 43 monitoring a Citrix XenDesktop environment 27 msgclient.properties file 40 msgserver.properties file 36, 40

overview 7

VMware, Inc.

VMware vRealize Operations for Published Applications Installation and Administration

ports

default 16 RMI services 36

product compatibility 11

replacing the default certificate, broker agent 49 reports, subjects 33

RMI communication 35 RMI services

changing default ports 36 ports 36

security, RMI communication 35 software requirements 11 SSL/TLS

ciphers 39 configuration 39

Store Front server, firewall rules 19 system requirements 11 system components 8

TLS configuration properties 40 troubleshooting

adapter 61, 63 broker agent 57 configuration files 55 desktop agent 59 log files 55, 57, 59, 61, 63 support bundle 55

trust store files, broker agent 46 TSL configuration 39

using reports 32

VDI Desktops Dashboard 32

XD-XA Overview dashboard 30 XD-XA Servers dashboard 31 XD-XA Session Details Dashboard 31 XD-XA dashboard overview 28 XenDesktop server, firewall rules 19

66 VMware, Inc.

VMware vRealize Operations for Published Applications - 6.2 Installation Manual

Specifications and Main Features

Frequently Asked Questions

User Manual

Contents

VMware vRealize Operations for Published Applications Installation and Administration provides information about how to monitor the performance of your Citrix XenDesktop/Citrix XenApp 7.6 environments in VMware vRealize™ Operations Manager™.

vRealize Operations for Published Applications Architecture

vRealize Operations for Published Applications Desktop Agent

vRealize Operations for Published Applications Broker Agent

vRealize Operations for Published Applications Adapter

Product Compatibility for vRealize Operations for Published Applications

Software Requirements for vRealize Operations for Published Applications

Install and Configure vRealize Operations for Published Applications

Downloading the vRealize Operations for Published Applications Installation Files

Install the vRealize Operations for Published Applications Solution

Open the Ports Used by vRealize Operations for Published Applications

Adding a vRealize Operations for Published Applications License Key

Associate XD-XA Objects with Your vRealize Operations for Published Applications License Key

Create an Instance of the vRealize Operations for Published Applications 6.2 Adapter

Enabling Firewall Rules for XenDesktop Delivery Controllers and PVS Server

Install the vRealize Operations for Published Applications Broker Agent

Configure the vRealize Operations for Published Applications Broker Agent

Configure Broker Agent to use Non-Admin User for Citrix Desktop Delivery Controller

Install a vRealize Operations for Published Applications Desktop Agent

Push the vRealize Operations for Published Applications Desktop Agent Pair Token Using a Group Policy

Using the XD-XA Dashboards

Introducing the XD-XA Dashboards

Understanding the Health Badge

XD-XA Overview

XD-XA Server Desktops

XD-XA Session Details

XD-XA Server Applications

XD-XA VDI Desktops

XD-XA User Experience

Using the XD-XA Reports

Introducing the XD-XA Reports

Subjects for Reports

Subjects for Report Views

RMI Services

Default Ports for RMI Services

Changing the Default RMI Service Ports

RMI Service Port Properties

Change the Default RMI Service Ports

Update the vRealize Operations Manager Firewall

Default TLS Protocols and Ciphers for vRealize Operations for Published Applications

TLS Configuration Properties

Change the Default TLS Configuration for Servers

Change the Default TLS for Agents

Understanding Authentication for Each Component

vRealize Operations for Published Applications Adapter Authentication

Desktop Agent Authentication

Broker Agent Authentication

Certificate and Trust Store Files 9

vRealize Operations for Published Applications Adapter Certificate and Trust Store Files

Broker Agent Certificate and Trust Store Files

Replacing the Default Certificates 10

Replace the Default Certificate for the vRealize Operations for Published Applications Adapter

Replace the Default Certificate for the Broker Agent

Certificate Pairing 11

Index