eG Monitoring
 
Measures reported by VmgUserEnvTest

The process of a user logging into a virtual server is fairly complex. First, the domain controller is discovered and the login credentials are authenticated. Then, the corresponding user profile is identified and loaded. Next, group policies are applied and logon scripts are processed to setup the user environment. In the meantime, additional processing may take place for a user - say, applying system profiles, creating new printers for the user, and so on. A slowdown in any of these steps can significantly delay the logon process for a user. Since logons on Windows happen sequentially, this may adversely impact the logins for other users who may be trying to access the virtual server at the same time. Hence, if a user complains that he/she is unable to access an application/desktop published on the virtual server, administrators must be able to rapidly isolate exactly where the logon process is stalling and for which user. The typical process for monitoring and troubleshooting the login process on Windows is to use the user environment debugging mechanism. To enable this on Windows and to set the logging level associated with the userenv.log file, perform the following steps:

  1. Start a registry editor (e.g., regedit.exe).

  2. Navigate to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon registry subkey.

  3. From the Edit menu, select New, DWORD Value.

  4. Enter the name UserEnvDebugLevel, then press Enter.

  5. Double-click the new value, set it to 65538 - which corresponds to the debugger output.

  6. Finally, click OK to save.

Once these changes are enabled, details about the Windows login process are logged into the file %systemroot%\debug\usermode\userenv.log. The log file is written to the %Systemroot%\Debug\UserMode\Userenv.log file. If the Userenv.log file is larger than 300 KB, the file is renamed Userenv.bak, and a new Userenv.log file is created. This action occurs when a user logs on locally or by using Terminal Services, and the Winlogon process starts. However, because the size check only occurs when a user logs on, the Userenv.log file may grow beyond the 300 KB limit. The 300 KB limit cannot be modified.

This test periodically checks the userenv log file on Windows to monitor the user login and profile loading process and accurately identify where the process is bottlenecked. On Windows 2008 (or above), this test takes the help of the Windows event logs to capture anomalies in the user login and profile loading process and report where the process is bottlenecked - in the authentication process? during profile loading? during GPO processing and if so, which GPO?

The measures made by this test are as follows:

Measurement Description Measurement Unit Interpretation
Profile_load_starts The number of profile loads in the last measurement period. Number This metric gives an idea of the rate at which users are logging in to the server.

The detailed diagnosis will not be available for the ‘Total’ descriptor.
Profile_load_successes The number of successful profile loads in the last measurement period. Number  
Profile_load_failures The number of profile load failures in the last measurement period. Number An unusual increase in number of profile loading failures is a cause for concern. The userenv.log file will have details of what profile loads failed and why.
Profile_load_failure_pct The percentage of profile loads that failed in the last measurement period. Percent  
Avg_profile_load_time The average time it took to load a profile successfully in the last measurement period. Seconds The detailed diagnosis of this measure, if enabled, lists the profile load times for different Citrix users.
Max_profile_load_time The maximum time it took to load a profile during the last measurement period. Seconds  
System_policy_starts The number of system policy applications started in the last measurement period. Number  
System_policy_completes The number of system policy completions in the last measurement period. Number Compare the total number of starts to completions. if there is a significant discrepancy, this denotes a bottleneck in system policy application. Check the userenv.log file for more details.
Avg_system_policy_time The average time taken for applying system policies in the last measurement period. Seconds If the system policy times are long, check the detailed diagnosis to view if the policy handling is taking time for all users. Analyze the userenv.log to determine the reason for any slowdown.
Max_system_policy_time The maximum time for applying system policies in the last measurement period. Seconds  
Group_policy_starts The number of group policy applications started in the last measurement period. Number  
Group_policy_completes The number of group policy applications completed in the last measurement period. Number  
Avg_group_policy_time The average time taken for applying group policies. Secs  
Max_group_policy_time The average time taken for applying group policies. Seconds  
Profile_unload_starts The number of profile unloads started during the last measurement period. Number The detailed diagnosis will not be available for the ‘Total’ descriptor.
Profile_unload_successes The number of successful profile unloads during the last measurement period. Number  
Profile_unload_failures The number of unsuccessful profile unloads during the last measurement period. Number  
Profile_unload_fail_pct The profile unload failures as a percentage of the total profile unloads. Percent  
Avg_profile_unload_time The average time for unloading a profile during the last measurement period. Seconds  
Max_profile_unload_time The maximum time for unloading a profile during the last measurement period. Seconds  
Avg_logon_duration Indicates the average time taken by this user for logging in during the last measurement period. Seconds If this value is abnormally high for any user, then, you can compare the User_account_discovery, Ldap_to_ADcalls, Total_time_CSE, Domain_ctrl_discovery, Grp_policy_access_time, Avg_system_policy_time and User_profile_time measures to know exactly where that user's login process experienced a bottleneck - is it when loading the profile? is it when processing system policies? is it when processing group policies? is it when interacting with AD for authenticating the user login?

User_account_discovery Indicates the amount of time taken by the system call to get account information for this user during the last measurement period. Seconds Compare the value of this measure across users to know which user’s logon process spent maximum time in retrieving account information.

The detailed diagnosis will not be available for the ‘Total’ descriptor.
Ldap_to_ADcalls Indicates the amount of time taken by the LDAP call for this user to connect and bind to Active Directory during the last measurement period. Seconds Compare the value of this measure across users to know which user’s logon process spent maximum time in connecting to Active Directory. Besides impacting authentication time, high LDAP bind time may also affect group policy processing.
Total_number_CSE Indicates the number of client side extensions used for processing group policies for this user during the last measurement period. Number  
Total_time_CSE Indicates the amount of time that client side extensions took for processing group policies for this user during the last measurement period. Seconds Compare the value of this measure across users to know which user's logon process spent maximum time in group policy processing.

If this measure reports an unusually high value for any user, then, you may want to check the value of the Ldap_to_ADcalls measure for that user to figure out if a delay in connecting to AD is affecting group policy processing. This is because, group policies are built on top of AD, and hence rely on the directory service's infrastructure for their operation. As a consequence, DNS and AD issues may affect Group Policies severely. One could say that if an AD issue does not interfere with authentication, at the very least it will hamper group policy processing.

You can also use the detailed diagnosis of this measure to know which client side extension was used to process which group policy for a particular user.

The detailed diagnosis will not be available for the ‘Total’ descriptor.
Domain_ctrl_discovery Indicates the time taken to discover the domain controller to be used for processing group policies for this user during the last measurement period. Seconds Compare the value of this measure across users to know which user's logon process spent maximum time in domain controller discovery.

The detailed diagnosis will not be available for the ‘Total’ descriptor.
Grp_policy_access_time Indicates the amount of time the logon process took to access group policy object files for this user during the last measurement period. Seconds Compare the value of this measure across users to know which user's logon process spent maximum time in accessing the group policy object file.
User_profile_time Indicates the amount of time it took to load this user’s profile successfully in the last measurement period. Seconds Compare the value of this measure across users to know which user's profile took the longest time to load. One of the common reasons for long profile load times is large profile size. In such circumstances, you can use the User Profile test to determine the current size of this user's profile. If the profile size is found to be large, you can conclude that it is indeed the size of the profile which is affecting the profile load time.

Another reason would be the absence of a profile. If the user does not already have a profile a new one is created. This slows down the initial logon quite a bit compared to subsequent logons. The main reason is that Active Setup runs the IE/Mail/Theme initialization routines.

Moreover, this measure reports the average time taken for loading a user's profile across all the sessions of that user. To know the profile load time per user session, use the detailed diagnosis of this measure. This will accurately pinpoint the session in which the profile took the longest to load.