frequent WFSHELL.exe crashes every day since upgrading VDA from 1912 LTSR to 2112 CR

[Andy Vanderbeken]

dear fellow Citrix admins,

 

 

Our monitoring system which gathers all errors happening in any session clearly shows a change in behaviour: A relatively small armount (compared to total user logons) of WFSHELL.exe crashes has started happening every day since upgrading VDA from 1912 LTSR to 2112 CR in our master image. It was the only change done (on purpose) when gradually releasing into production and equally the WFSHELL.exe crashes started coming in along with it.

 

Did any of you happen to experience this so far or have experience with it ? It looks alot like this particular issue from a few years ago with an older version of CVAD: https://support.citrix.com/article/CTX238678

 

[Björn Schläfli]

Hi Andy,

do these users use webcams?

 

I've had wfshell.exe crashes because of logitech webcams.

look at this: Citrix Virtual Apps 2103 VDA 2103 wfshell.exe crashes - XenApp 7.x - Discussions

 

The issue was resolved by configuring this (thanks a lot to mmora302):

Path :HKLM\Software\Citrix\SvcHost\IcaCtlsSvcs\
Value: GvchEnable
Type: DWORD Data: 0

 

Restart the VDA, and verify if the issue still occurs.

[Andy Vanderbeken]

Hi Bjoern,

 

thanks for chiming in. Except for maybe a handful that might have a logitech cam at home that we administrators are not aware of, everyone is generally using their HP laptop's build-in cam which is not a Logitech. Still I'll keep this mind in case your particular issue might pop-up on our side.

 

In my particular case I found the solution by accident. It was the Citrix graphical status indicator that crashed alot on a same server during the day. After disabling it through Citrix policies we saw no more wfshell.exe nor winlogon.exe crashes.

 

On a more general level it all makes sense to me now. We knew already that wfshell is just the general winframe virtual channels that link any sort of device or functionality through the ica protocol, whether it's a webcamp, printer, audio or in my case Nvidia grid vGPU functionality.

 

The lesson Iearned when troubleshooting this is that whenever you see wfshell.exe crashes, it means that one of many client redirected functionalities is crashing and the best way to trace it down is use a good monitoring system such as e.g GFI events manager that picks up targeted application crashes from the windows application event viewer of all Citrix VDA servers and concentrates them into one overview. Only then does a pattern such as e.g GfxStatusIndicator.exe crashing multiple times a day on a same server suddenly become crystal clear.