2014-02-26 2014-02-26 5951 Netscaler Developers Values 0-127: NFv9-compatible netscalerICASessionGuid octetArray identifier 200 current This is a 16-byte ID that identifies an ICA session. This value is present in the ICA protocol header. With Excalibur actual session GUID will be present, which indicates a unique session established by a user. Pre-Excalibur, this is a random Value generated by Netscaler. netscalerMsiClientCookie octetArray identifier 248 current An identifier that helps to tie up multiple connections of the same session when Multi stream ICA is used. Should be same across all MSI connections netscalerConnectionChainID octetArray identifier 192 current This is a 16-byte ID that ties together all the TCP connections of ICA protocol, from client to the server that are terminated and established on layer-4 devices in the path. Since all these TCP connections belong to one logical connection from client to server, they will have the same connection chain ID. netscalerFlowFlags unsigned64 flags 132 current application layer flags, for use between the exporter and collector to indicate various Layer-7 events and types like the direction of the flow (client-in, svc-out, etc.), http version, NetScaler cache served responses, SSL, compression, TCP buffering, and many more. netscalerHttpRspLen unsigned64 quantity 145 current The total size of HTTP response netscalerServerTTFB unsigned64 quantity 146 current Time elapsed in microseconds between receiving of request from the client and receiving the first byte of response from server netscalerServerTTLB unsigned64 quantity 147 current Time elapsed in microseconds between receiving of request from the client and receiving the last byte of response from server netscalerHttpReqRcvFB dateTimeMicroseconds default 153 current Timestamp when the first byte of request was received from client at the NetScaler netscalerHttpReqForwFB dateTimeMicroseconds default 156 current Timestamp when the first byte of request was forwarded to server from the NetScaler netscalerHttpResRcvFB dateTimeMicroseconds default 157 current Timestamp when the first byte of response was received from server at the NetScaler netscalerHttpResForwFB dateTimeMicroseconds default 158 current Timestamp when the first byte of response was forwarded to client from the NetScaler netscalerHttpReqRcvLB dateTimeMicroseconds default 159 current Timestamp when the last byte of request was received from client at the NetScaler netscalerHttpReqForwLB dateTimeMicroseconds default 160 current Timestamp when the last byte of request was forwarded to server from the NetScaler netscalerHttpResRcvLB dateTimeMicroseconds default 169 current Timestamp when the last byte of response was received from server at the NetScaler netscalerHttpResForwLB dateTimeMicroseconds default 170 current Timestamp when the last byte of response was forwarded to client from the NetScaler netscalerDbRespStatus unsigned64 identifier 180 current SQL response status netscalerDbRespLength unsigned64 quantity 181 current SQL response length netscalerIcaFlags unsigned64 flags 249 current ICA specific flags: 0x0004 - MSI Enabled on Session 0x0008 - Secondary Connection 0x0010 - Seamless session 0x0020 - Compression disabled explicitly 0x0040 - Global ICA GUID enabled 0x0080 - EUEM channel supported netscalerMaxLicenseCount unsigned64 quantity 252 current netscalerCurrentLicenseConsumed unsigned64 quantity 253 current netscalerRoundTripTime unsigned32 quantity 128 current The TCP RTT of the flow in milliseconds since the time last record was sent netscalerTransactionId unsigned32 identifier 129 current At Layer-7, the four flows of a transaction between client and server (client-to-NS, NS-to-Server, Server-to-NS, NS-to-Client) are tied together using the transaction ID. netscalerConnectionId unsigned32 identifier 133 current The two flows of a TCP connection are tied together with a connection ID netscalerSyslogTimestamp dateTimeMilliseconds default 136 current Timestamp when the syslog (contained in the syslog record) was generated netscalerAppNameIncarnationNumber unsigned32 identifier 150 current Each named entity in the NetScaler is associated with an id. The name to id mapping is sent in the appname mapping template to the collector. Other records only contain the id of the entity and the corresponding name is stored by the collector and used when required. If a new entity gets added or an entity gets removed or modified, the incarnation number changes which indicates the collector to use the appname mapping record to update its database netscalerAppNameAppId unsigned32 identifier 151 current The id of a named entity netscalerDbLoginFlags unsigned32 flags 172 current SQL login flags netscalerMainPageId unsigned32 identifier 161 current In a html page, the main page transaction is associated with all its embedded object transactions. Each such embedded object transaction record contains the transaction Id of the main page so that a parent link to the main transaction can be created. This is used in generating a waterfall chart model depicting the various timing information of the entire page loading. netscalerMainPageCoreId unsigned32 identifier 162 current The above transaction ID is unique within the process. Hence the exporting process ID of the main page is also required. netscalerAppUnitNameAppId unsigned32 identifier 171 current Netscaler uses application templates that groups a set of entities which can be exported and imported when needed. This Information Element exportes the ID of the application template to which the entity belongs. netscalerClientRTT unsigned32 quantity 182 current The RTT of the client is exported in the server side records netscalerIcaClientIP ipv4Address default 203 current The ICA client IP as sent by the Citrix Receiver netscalerIcaSessionUpdateBeginSec dateTimeSeconds default 223 current Absolute timestamp of end of ICA session update netscalerIcaSessionUpdateEndSec dateTimeSeconds default 224 current Absolute timestamp of beginning of ICA session update netscalerIcaChannelId1 unsigned32 identifier 225 current The IDs of the ICA channels opened netscalerIcaChannelId1Bytes unsigned32 identifier 226 current The IDs of the ICA channels opened netscalerIcaChannelId2 unsigned32 identifier 227 current The IDs of the ICA channels opened netscalerIcaChannelId2Bytes unsigned32 identifier 228 current The IDs of the ICA channels opened netscalerIcaChannelId3 unsigned32 identifier 229 current The IDs of the ICA channels opened netscalerIcaChannelId3Bytes unsigned32 identifier 230 current The IDs of the ICA channels opened netscalerIcaChannelId4 unsigned32 identifier 231 current The IDs of the ICA channels opened netscalerIcaChannelId4Bytes unsigned32 identifier 232 current The IDs of the ICA channels opened netscalerIcaChannelId5 unsigned32 identifier 233 current The IDs of the ICA channels opened netscalerIcaChannelId5Bytes unsigned32 identifier 234 current The IDs of the ICA channels opened netscalerApplicationStartupDuration unsigned32 quantity 236 current The time elapsed between the launch of an application and when it started running netscalerApplicationStartupTime dateTimeSeconds default 239 current The time when an application started on the server netscalerIcaSessionEndTime dateTimeSeconds default 242 current The time when the ICA session ended netscalerIcaRTT unsigned32 quantity 215 current The ICA client sends a probe packet to the server, which sends back a response. Using this, the ICA process calculates the round trip time between the client and server which is exported to the appflow collector as ICA RTT. netscalerIcaClientsideRXBytes unsigned32 deltaCounter 216 current Number of bytes received on client ICA connection netscalerIcaClientsideTXBytes unsigned32 deltaCounter 217 current Number of bytes transmitted on client ICA connection netscalerIcaClientsideRTT unsigned32 quantity 221 current The TCP rtt on the client ICA connection netscalerIcaServersideRTT unsigned32 quantity 222 current The TCP rtt on the server ICA connection netscalerIcaApplicationTerminationTime dateTimeSeconds default 241 current The time when the application was terminated netscalerIcaClientsideJitter unsigned32 quantity 243 current The variance of client side RTT w.r.t the calculated RTT netscalerIcaServersideJitter unsigned32 quantity 244 current The variance of server side RTT w.r.t the calculated RTT netscalerIcaSessionSetupTime dateTimeSeconds default 209 current The time when the session was setup netscalerIcaAppProcessID unsigned32 identifier 245 current The process ID of the application launched on the server netscalerIcaDeviceSerialNo unsigned32 identifier 247 current Used in conjunction with clientcookie to identify primary connection and tie up streams of a MSI connection netscalerIcaNetworkUpdateStartTime dateTimeSeconds default 254 current A network update record is sent at a defined interval that contains the ICA connection statistics for that interval. This Information Element contains the timestamp when the collection stats in this record began netscalerIcaNetworkUpdateEndTime dateTimeSeconds default 255 current A network update record is sent at a defined interval that contains the ICA connection statistics for that interval. This Information Element contains the timestamp when the collection stats in this record ended netscalerIcaClientsideSRTT unsigned32 quantity 256 current RTT smoothed over the client side connection by considering one eighth of current RTT and seven eighth of the smoothed RTT since the beginning of the connection netscalerIcaServersideSRTT unsigned32 quantity 257 current RTT smoothed over the server side connection by considering one eighth of current RTT and seven eighth of the smoothed RTT since the beginning of the connection netscalerIcaClientsideDelay unsigned32 quantity 258 current Indicates time taken by Netscaler to process this client side packet (NS introduced processing delay) netscalerIcaServersideDelay unsigned32 quantity 259 current Indicates time taken by Netscaler to process this server side packet (NS introduced processing delay) netscalerIcaHostDelay unsigned32 quantity 260 current Indicates a portion of the ICA RTT measurement - time delay introduced at the Host while processing the packet netscalerIcaL7ClientLatency unsigned32 quantity 265 current L7 layer latency measured using ICA probes and responses sent between Receiver and the Host, on client side pcb. netscalerIcaL7ServerLatency unsigned32 quantity 266 current L7 layer latency measured using ICA probes and responses sent between Receiver and the Host, on server side pcb. netscalerCacheRedirClientConnectionCoreID unsigned32 identifier 268 current The client connection id is unique within a process. Hence the process id of the client connection is also passed to make the complete set unique. netscalerCacheRedirClientConnectionTransactionID unsigned32 identifier 269 current When a request hits CR vserver and is redirected to the cache server and a cache miss happens, the cache sends a the request to the origin server. This request mostly comes back to the NS. This ID is used to link the cache request with the actual client request on the collector. netscalerHttpRspStatus unsigned16 identifier 144 current Status of HTTP response netscalerIcaClientType unsigned16 identifier 202 current Identifies the type of ICA client netscalerIcaClientsidePacketsRetransmit unsigned16 deltaCounter 219 current Number of packets retransmitted on clientside connection netscalerIcaServersidePacketsRetransmit unsigned16 deltaCounter 220 current Number of packets retransmitted on serverside connection netscalerIcaClientLauncher unsigned16 identifier 208 current Identifies the ICA launcher netscalerIcaLaunchMechanism unsigned16 identifier 237 current The mechanism used to launch ICA applicaiton netscalerIcaClientSideWindowSize unsigned16 quantity 261 current TCP window size on the client connection netscalerIcaServerSideWindowSize unsigned16 quantity 262 current TCP window size on the server connection netscalerIcaClientSideRTOCount unsigned16 deltaCounter 263 current Number of times retransmission timeout occurred on client connection netscalerIcaServerSideRTOCount unsigned16 deltaCounter 264 current Number of times retransmission timeout occurred on server connection netscalerSyslogPriority unsigned8 identifier 134 current Priority of the syslog message being logged netscalerDbReqType unsigned8 identifier 173 current The type of database request netscalerDbProtocolName unsigned8 identifier 174 current The database protocol being used netscalerIcaSessionReconnects unsigned8 deltaCounter 214 current Number of times session reconnects happened netscalerLicenseType unsigned8 identifier 251 current netscalerConnectionChainHopCount unsigned8 quantity 193 current The hop count of the current device in the connection chain from client to server (see connection chain id for more details) netscalerHttpReqUrl string default 130 current HTTP request URL netscalerHttpReqCookie string default 131 current Value of Cookie header present in HTTP request netscalerHttpReqReferer string default 140 current Value of Referer header present in HTTP request netscalerHttpReqMethod string default 141 current The request method in HTTP request netscalerHttpReqHost string default 142 current Value of Host header in HTTP request netscalerHttpReqUserAgent string default 143 current The User Agent string as seen in HTTP request header netscalerSyslogMessage string default 135 current The syslog message generated on Netscaler netscalerAppName string default 152 current Name of the entity configured on Netscaler for which the name-to-id mapping is being sent in the current record netscalerDbUserName string default 175 current Database username netscalerDbDatabaseName string default 176 current DB database name netscalerDbCltHostName string default 177 current DB client host name netscalerDbReqString string default 178 current DB request string netscalerDbRespStatusString string default 179 current Status of the response as indicated in the Database response netscalerAppTemplateName string default 167 current Name of the template to which the current entity belongs (see netscalerAppTemplateID) netscalerHttpContentType string default 183 current The Content Type string as seen in the HTTP header netscalerHttpReqAuthorization string default 185 current Value of the Authorization HTTP header netscalerHttpReqVia string default 186 current Value of the Via HTTP header netscalerHttpReqXForwardedFor string default 190 current value of the X-Forwarded-For HTTP header netscalerHttpResLocation string default 187 current Value of the Location HTTP response header netscalerHttpResSetCookie string default 188 current value of the Set-Cookie HTTP response header netscalerHttpResSetCookie2 string default 189 current value of the Set-Cookie2 HTTP response header netscalerAaaUsername string default 205 current If the connection is over VPN, the AAA username for the session netscaleIcaClientVersion string default 201 current Version of the ICA client netscalerIcaClientHostName string default 204 current name of the ICA client host netscalerIcaUsername string default 250 current Username for the ICA session netscalerIcaDomainName string default 207 current Domain of the ICA client netscalerIcaServerName string default 210 current name of the ICA server netscalerIcaApplicationName string default 238 current ICA application name netscalerIcaAppModulePath string default 246 current path of the ICA application being launched netscalerHttpDomainName string default 267 current HTTP domain name netscalerHttpClientInteractionEndTime string default 168 current The NTP timestamp when the HTML page becomes interactive to the user netscalerHttpClientInteractionStartTime string default 163 current The timestamp when the page starts loading netscalerHttpClientRenderEndTime string default 164 current The timestamp when the page completely renders netscalerHttpClientRenderStartTime string default 165 current The timestamp when page rendering begins netscalerIcaConnectionPriority unsigned16 identifier 235 current Identifies the priority of ICA connection netscalerIcaApplicationTerminationType unsigned16 identifier 240 current Indicates how the application termination happened, eg: User closed the app, session termination, abort etc