29.10.2015 Troubleshooting Methodology for NetScaler, StoreFront with XenApp and/or XenDesktop

http://support.citrix.com/article/CTX140153 1/6

Article | Connectivity | Created:26 Mar 2014 | Modified:05 Feb 2015 Languages English

Information

Troubleshooting Methodology for NetScaler, StoreFront with XenApp and/or XenDesktop

In this example, the environment consists of a NetScaler setup that uses NetScaler Gateway in ICA proxy mode (Basic Mode), Load

Balancing and Global Server Load Balancing, StoreFront servers, Active Directory servers, XenApp Data Collectors and Worker

servers, XenDesktop Delivery Controllers and machines with a Virtual Desktop Agent installed.

Also in this setup, the NetScaler Gateway session policy is bound at the group level.

The flowchart shows the different components (on a relatively high level) that are involved when a user logs on either using the

Receiver application or the NetScaler Gateway logon web page and starts a published application or desktop.

If a user reports a problem and there is no error message given or it isunclear what the problem is you must be able to follow this

flowchart to find the problem.

Overview of things to check following the flowchart

Is everything as expected on the client side in terms of software and network?

Can you do DNS lookups to the GSLBvirtual server domain name from the client?

CTX140153

Troubleshooting Methodology for NetScaler, StoreFront withXenApp and/or XenDesktop

http://www.citrix.com/http://www.citrix.com/

29.10.2015 Troubleshooting Methodology for NetScaler, StoreFront with XenApp and/or XenDesktop

http://support.citrix.com/article/CTX140153 2/6

Is the GSLB virtual server, services and settings on the NetScaler correct?

Is the NetScaler Gateway virtual server and settings correct?

Is the right LDAP policy being applied?

Is everything correct on the Load Balancing virtual server and Service group for LDAP on the NetScaler?

Is connection to LDAP backend server?

Does the user get authenticated?

Is the user in the right AD group?

Is there a group on the NetScaler that matches the AD group (case sensitive)?

Is the Session policy bound to the NetScaler Gateway group?

Is the Session policy being applied?

Is the user being redirected to the StoreFront Load Balancer on the NetScaler?

Does everything look ok on the Load Balancing virtual server and Service group for StoreFront on the NetScaler?

Are error messages in the event logs on the StoreFront servers?

Are error messages in the event logs on the XenDesktop or XenApp Delivery Controller?

Are error messages on the Zone Data Collector (XenApp only)?

Is the farm heavily loaded (XenApp only)?

Are error messages in the event log or in the STA log on the server used for the STA service?

Are error messages in the event log of the XenDesktop VDA or XenApp Worker server?

Is the published application or desktop displaying correctly?

Client

The client is the endpoint device used. This focuses on the Receiver for Windows but could also be any other platform that can run

Citrix Receiver.

Actions

29.10.2015 Troubleshooting Methodology for NetScaler, StoreFront with XenApp and/or XenDesktop

http://support.citrix.com/article/CTX140153 3/6

Does Citrix Receiver appear to be working as it must?

Does the client have network connectivity?

Are there any related error messages in the event log?

Links to other CTX articles that might help to troubleshoot client problems:

Receiver Clean-Up Utility

How to Enable Logging for Receiver for Windows 3.0 and later Using Registry Entries

DNS/GSLB

Global Server Load Balancing can be used to send the user to the NetScaler Gateway virtual server that is closest to the user. Global

Server Load Balancing is dependent on DNS functionality.

Actions

To verify that the user is reaching the correct NetScaler Gateway virtual server using GSLB feature do the following:

Ask the user to do a DNS lookup (such asnslookup command) to the GSLB virtual server domain name and check that the IP is

that of the desired NetScaler Gateway virtual server.

If it is not the desired virtual server, check that the GSLB virtual server and service is up on the NetScaler the user should connect

to.

If they are down, check what the GSLB monitor is monitoring (for instance the NetScaler Gateway virtual server) and the state of

the monitored resource.

If everything looks good on the NetScaler,it is possible that there is a DNS problem somewhere along the line before reaching

the NetScaler.

There are several different options in regards to GSLB and DNS so you would need to know how your setup is configured.

Links to other CTX articles that might help to troubleshoot GSLB problems:

NetScaler Global Server Load Balancing DNS Request Flow differences between ADNS and DNS proxy solutions

Citrix NetScaler Global Server Load Balancing Primer: Theory and Implementation

NetScaler Gateway/LDAP & Session Policies

These are the policies that must be applied when the user logs on and is part of the correct Active Directory group. The group is

also added as a NetScaler Gateway group with the same name as in Active Directory.

Actions

You have checked that the NetScaler Gateway virtual server is UPin the previous section, you can use CTX137739 - How to

Identify the Session Policy Applied to the User After Authenticationto check the correct LDAP policy and the Session Policy

http://support.citrix.com/article/CTX137494http://support.citrix.com/article/CTX132883http://support.citrix.com/article/CTX123792http://support.citrix.com/article/CTX123976http://support.citrix.com/article/CTX137739

29.10.2015 Troubleshooting Methodology for NetScaler, StoreFront with XenApp and/or XenDesktop

http://support.citrix.com/article/CTX140153 4/6

applied when the user logs on.

When you have verified that the policies are applied for the user, see CTX114999 -How to Troubleshoot Authentication with

Aaad.debugto verify that the user is able to logon.

Load Balancer

These are your Load Balancing virtual servers on your NetScaler for LDAP and StoreFront backend servers.

Actions

Check that the LB virtual server is UP and check that the Service Group or Service is also in the state UP.

If they are not up, check the Monitor Details on the Service Group in the GUI for reasons the service is marked as DOWN or the

reason one of the backend servers are considered DOWN.

Check backend server for problems.

Is the port open to the backend server? Try changing the monitor to a tcp monitor to verify port opening to backend server.

StoreFront

These are the StoreFront servers that are used in the NetScaler Gateway Session profile.

Actions

Check event logs for error messages (StoreFront has its own log under Applications and Services Logs).

Links to other CTX articles that might help to troubleshoot StoreFront problems:

How to Enable StoreFront Verbose Logging

Usage of Service SIDs and IIS Application Pools in StoreFront

XenDesktop/XenApp Delivery Controller

These are the servers that you have listed in your StoreFront Store as Delivery Controllers and they are the servers that are running

the XML (XenApp) and Broker Service (XenDesktop).

Actions

Check Event logs for error messages.

Check that XenDesktop/XenApp services are running.

XenApp Zone Data Collector

In some environments the ZDC might be another server than the one listed as the XenApp Delivery Controller in StoreFront.

Actions

Check Event logs for error messages.

http://support.citrix.com/article/CTX114999http://support.citrix.com/article/CTX139592http://support.citrix.com/article/CTX138905

29.10.2015 Troubleshooting Methodology for NetScaler, StoreFront with XenApp and/or XenDesktop

http://support.citrix.com/article/CTX140153 5/6

Check that XenApp services are running.

Check Qfarm /load.

STA Server

This is the server or servers used for the Secure Ticket Authority (STA) and are used by both NetScaler Gateway and StoreFront. The

STA service is a service that is running in the XML (XenApp) and Broker (XenDesktop) service but is not the same as the XML and

Broker service.

The STA service is used when logging on through a NetScaler Gateway virtual server.

Actions

Check Event logs for error messages.

Check that the XML or Broker service is running.

Is the same STA server listed on the NetScaler Gateway virtual server as on the StoreFront servers?

Is the STA server listed as UP on the NetScaler Gateway virtual server?

Enable logging for the STA service:How to Enable STA Logging on the STA Servers only in XenApp Environments

XenApp Worker/XenDesktop VDA

This is the server OS or client OS machine that the user is connecting to and where the published application or desktop is

running.

Actions

Check Event logs.

Check that XenApp or XenDesktop services are running.

Links to other CTX articles that might help to troubleshoot XenDesktop or XenApp problems:

Logon Optimization Guide - XenApp/XenDesktop

XenDesktop 5 Logon Process and Communication Flow

Application Enumeration Process and the Application Launch Process in XenApp 6

Applicable Products

NetScaler 10.1

StoreFront 2.1

http://support.citrix.com/article/CTX120589http://support.citrix.com/article/CTX128277http://suppo