Time to upgrade! NAM is scheduled for end of support. It's time to move to Dynatrace our all-in-one software intelligence platform.

Citrix monitoring

The Thin Client Analysis Module (TCAM) is designed to work with Citrix XenApp. TCAM augments Citrix user activity monitoring by enabling front-end user name recognition where the ICA decode cannot be used, adding back-end application traffic to Citrix user name correlation and providing basic system performance measurements of Citrix servers on which it is installed. TCAM installation in XenApp is optional but we highly recommend it.

Compatibility notes

Citrix 7.x
In general, the NAM ICA decode and TCAM work with all Citrix 7.x releases, but you should be aware of the following limitations concerning NAM and Citrix 7.x:

  • TCAM reports a loopback address as the client IP address if the client comes through NetScaler.
  • The ICA decode does not report on Citrix Framehawk channels or on traffic that uses Citrix EDT transport (a Citrix protocol that enhances UDP) instead of TCP.

XenApp servers and XenDesktop instances
TCAM can be installed on XenApp servers and XenDesktop instances, but we do not recommend installation on XenDesktop instances because of the configuration complexity such an installation would cause.

Windows Remote Desktop
TCAM also works with Windows Remote Desktop services similar to the way it works with XenApp.

Creating associations between users and sessions

TCAM creates an association between a user and their sessions. This information is then passed to the NAM Probe as shown in Figure 1.

Figure 1. Basic Citrix monitoring.

NAM: Citrix monitoring

At the front end, there is a terminal session between a user and the presentation server. The user runs an application that causes a back-end session to open a session between the presentation server and an application server. The back-end session carries the actual user transactions, but it is impossible to determine which users the back sessions belong to because no user identification is carried in the sessions at the back end.

The monitoring system determines which back-end sessions belong to which user. Only this association allows for actual user experience monitoring.


To create associations between users and sessions, TCAM relies on applications being executed under specific user names. However, when a user runs an application that has been started as a system service, the association is not possible. Also, the session is not associated with the user if the user, using a Citrix server communicating with a monitored application, logs in and then disconnects.

Basic network setup

Figure 2 shows monitoring a Citrix Presentation Server without an intermediate device between users and the presentation server. Multiple intermediate devices can be present, although some limitations apply. Ensure that you attach the NAM Probe to the correct points in the network.

Figure 2. Citrix XenApp without an intermediate device.

NAM: Citrix XenApp without intermediate device

NetScaler network configuration

Correct monitoring and mapping of users and sessions depends on the NAT resolution setting in TCAM and the point where the NAM Probe is connected.

Figure 3 shows a NAM Probe monitoring between the client and a NetScaler device. NAT resolution must be turned off.

Figure 3. Citrix XenApp with a NetScaler device with NAT resolution off.

NAM: Citrix XenApp with a NetScaler device with NAT resolution off

Figure 4 shows a NAM Probe monitoring between the NetScaler device and the Citrix server. NAT resolution must be turned on.

Figure 4. Citrix XenApp with a NetScaler device with NAT resolution on.

NAM: Citrix XenApp with a NetScaler device with NAT resolution on

For traffic between the presentation server and user application servers, user name associations are always supported. User IP address associations may not be performed correctly if the NAM Probe point of monitoring and the TCAM NAT resolution setting are not matched as described above.

Monitoring hardware performance

TCAM also monitors the performance of the hardware to which it is applied and sends the results to the NAM Probe. The performance information includes:

  • CPU utilization
  • Physical disk utilization
  • Memory utilization
  • Number of Terminal Services sessions
  • Number of active Terminal Services sessions

Citrix XenApp or XenDesktop Server software services

After you install TCAM on a Citrix XenApp or XenDesktop Server, you can monitor software services served via such servers.

You can define a software service to be monitored by multiple NAM Probes or specify it on a single NAM Probe.

To monitor a software service that is served via a Citrix XenApp or XenDesktop Server:

  1. Configure global settings used by the NAM Probe when monitoring traffic with TCAM.
    Assuming that the NAM Probe Configuration window is open, set the following properties:
    • Open Advanced > User-IP mapping > General and set Session client name mappings lease time (default value 60 seconds).
    • Open Advanced > User-IP mapping > Listening and enable Session client name mappings timeout (default value: 1 second).
    • Open Advanced > User-IP mapping > Listening and, in the UDP section, select the Enable UDP server listening for packets of syslog with mappings check box to enable retrieving user-to-IP address mappings from the UDP syslog packets.
    • Open the Advanced > User-IP mapping > Listening and, in the Parser section, select citrixParser. For more information, see User-IP mapping in Global - Advanced.
  2. Create a new user-defined software service.
    Enter your service name and select the ICA (Citrix) analyzer.
  3. Add a monitoring rule for the service.
    The default port number for Citrix-based software services is 1494 or 2598.
  4. Click Save and Publish to apply new settings to your NAM Probes.