Jump to content
Welcome to our new Citrix community!
  • 0

WEM excessive logging


Philip Ruziczka1709163701

Question

We recently set up a POC after testing WEM (cloud) for a limited amount of users. We used a new configuration set but the settings are mostly the same (only changes are in UPM exclusions).

The log settings are set to 100MB Logfile size and the share is a different one.

There is no one using the new xenapp desktop but UPM logs are full and rotating every 1-3 hours. You can tell by the modify age of the .bak file it creates when the main log file gets to the 100MB limit.
On the "old" test environment where we have 12 users testing we generate 100MB logs in 7 days.

 

In the logs i can see that he is reading/applying the configuration every 4 seconds.

2023-10-27;09:53:21.527;;;;;4600;Citrix Profilverwaltung version 22.3.3000.3 on VMCTXAP1285: reading policy...

 

Is this normal? Why is there such a difference in logging behaviour?

We have ~500 servers in the main environment so this will probably will create significantly more I/Os on my storage.

Link to comment

10 answers to this question

Recommended Posts

  • 0

Hi Philip, 

"

In the logs i can see that he is reading/applying the configuration every 4 seconds.

2023-10-27;09:53:21.527;;;;;4600;Citrix Profilverwaltung version 22.3.3000.3 on VMCTXAP1285: reading policy...

"

----  This log means UPM is refreshing upm policy settings since UPM has just received policy change event notification.  We need to see who is triggering the policy refreshment frequently.

Could you please 

1) enable "Common information" in Log settings
image.thumb.png.b24f52af0e63e240daa7643907647690.png

2)   get UPM settings refreshed on agent.  You can choose one of following methods

     a) restart Citrix WEM Agent Host Service on agent

     b) refresh agent host settigs on wem web console

          image.thumb.png.440f1c520e2f017896ffebe74379a9c8.png

 

3) Keep Observing the upm log for keywords "RefreshPolicy: Got a" to see who is triggering upm policy refreshment frequently.

E.g. 

2023-09-26;21:51:06.310;INFORMATION;;;;3820;RefreshPolicy: Got a upm configuration changed event.

Link to comment
  • 0

I added common information to be logged, we get the following events which contains the keywords:

 

2023-10-30;14:59:02.524;INFORMATION;;;;4600;RefreshPolicy: Got a computer policy refresh event.

2023-10-30;14:59:08.047;INFORMATION;;;;4600;RefreshPolicy: Got a Full Armour policy update.

2023-10-30;14:59:34.020;INFORMATION;;;;4600;RefreshPolicy: Got a computer policy refresh event.

2023-10-30;14:59:39.885;INFORMATION;;;;4600;RefreshPolicy: Got a Full Armour policy update.

2023-10-30;15:00:06.251;INFORMATION;;;;4600;RefreshPolicy: Got a computer policy refresh event.

2023-10-30;15:00:12.130;INFORMATION;;;;4600;RefreshPolicy: Got a Full Armour policy update.

2023-10-30;15:00:37.963;INFORMATION;;;;4600;RefreshPolicy: Got a computer policy refresh event.

2023-10-30;15:00:43.602;INFORMATION;;;;4600;RefreshPolicy: Got a Full Armour policy update.

As you see from the time stamps, this are 5+ refreshes in a minute.

Tell me if you need the complete logs.

Link to comment
  • 0
On 10/30/2023 at 10:39 PM, Philip Ruziczka1709163701 said:

I added common information to be logged, we get the following events which contains the keywords:

 

2023-10-30;14:59:02.524;INFORMATION;;;;4600;RefreshPolicy: Got a computer policy refresh event.

2023-10-30;14:59:08.047;INFORMATION;;;;4600;RefreshPolicy: Got a Full Armour policy update.

2023-10-30;14:59:34.020;INFORMATION;;;;4600;RefreshPolicy: Got a computer policy refresh event.

2023-10-30;14:59:39.885;INFORMATION;;;;4600;RefreshPolicy: Got a Full Armour policy update.

2023-10-30;15:00:06.251;INFORMATION;;;;4600;RefreshPolicy: Got a computer policy refresh event.

2023-10-30;15:00:12.130;INFORMATION;;;;4600;RefreshPolicy: Got a Full Armour policy update.

2023-10-30;15:00:37.963;INFORMATION;;;;4600;RefreshPolicy: Got a computer policy refresh event.

2023-10-30;15:00:43.602;INFORMATION;;;;4600;RefreshPolicy: Got a Full Armour policy update.

As you see from the time stamps, this are 5+ refreshes in a minute.

Tell me if you need the complete logs.

Hi Philip,

     It means the refreshment is triggered by gpupdate. Do these "RefreshPolicy: Got a " logs always keep flushing after one minute? Could you please share this upm log file  and wem debug log file for analysis? 

WEM debug log files locates in C:\Program Files (x86)\Citrix\Workspace Environment Management Agent 

If WEM debug log is not enabled, please set value of  following registry items to 1

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Norskale\Agent Host\AgentDebugModeLocalOverride
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Norskale\Agent Host\AgentServiceDebugModeLocalOverride

 

and restart  Citrix WEM Agent Host Service.

 

Please let the issue reproduce for a while then retrieve the logs. 

Thanks!

Link to comment
  • 0
On 11/1/2023 at 4:19 AM, Xiao Yi1709162947 said:

Hi Philip,

     It means the refreshment is triggered by gpupdate. Do these "RefreshPolicy: Got a " logs always keep flushing after one minute? Could you please share this upm log file  and wem debug log file for analysis? 

WEM debug log files locates in C:\Program Files (x86)\Citrix\Workspace Environment Management Agent 

If WEM debug log is not enabled, please set value of  following registry items to 1

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Norskale\Agent Host\AgentDebugModeLocalOverride
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Norskale\Agent Host\AgentServiceDebugModeLocalOverride

 

and restart  Citrix WEM Agent Host Service.

 

Please let the issue reproduce for a while then retrieve the logs. 

Thanks!

Hi!

 

Yes they keep flushing the log!upmlog.zip

I attached both files, i can only show you a small part of the UPM log because of file size restrictions.

 

Citrix WEM Agent Host Service Debug.zip

Link to comment
  • 0
4 hours ago, Jeff Riechers1709152667 said:

Actually this looks like normal logging.  Looking at the logs I see this line.

 

2023-11-02;13:12:35.358;INFORMATION;;;;4600;ReadPolicy: Configuration value read from Policy: LogLevelInformation=<1>

 

This means that somewhere either GPO, registry, Wem, or Studio is enabling information logging. 

Yes I changed it to information logging as Xiao Yi requested it before.

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...