Citrix Workspace Slow



downloadWhy can't I download this file?

Citrix Workspace For Apple

Applicable Products

  • Citrix Workspace App
  • Citrix Virtual Apps and Desktops

Objective

This article provides an overview of the Browser content redirection (BCR) feature and use cases before providing general troubleshooting guidelines. It is highly recommended that you first read through the Browser content redirection and Browser content redirection policy settings sections of the Citrix Virtual Apps and Desktops 7 Product Documentation before using this troubleshooting article.

Instructions

1. Browser Content Redirection feature description and details
Browser content redirection (BCR) allows the redirection of VDA-side browser viewports to the client-side. The benefits of BCR are achieved when offloading network utilization, page processing, graphics rendering to the endpoint, and improving end-user experience when browsing demanding webpages; especially those incorporating HTML5 or WebRTC video.
For BCR to work, the VDA must have access to the website you are trying to redirect - in other words, a navigation event must occur in the browser for BCR code to kick in. The webpage would then be uninstantiated , and immediately redirected.
Currently there are two browsers supported:
  • Internet Explorer 11: The VDA-side IE11 browser viewport is redirected and rendered on the client-side using the client-side installed IE11 and the Citrix Workspace app for Windows process HdxBrowser.exe. A BHO (Browser Helper Object) called CitrixHDXJsInjector is added by the VDA installer to IE11 on the VDA. This BHO injects HdxVideo.js into whitelisted webpages. This Javascript's main goal is to connect via secure web sockets to a service called WebsocketService.exe running on the VDA.
  • Google Chrome: The VDA-side Chrome browser viewport is redirected and rendered on the client-side using the Citrix Workspace app for Windows embedded Chromium engine and the HdxBrowserCef.exe process. Note that the Browser Content Redirection Extension (which injects HdxVideo.js) must be installed and enabled on the VDA before using BCR with Chrome. The Browser Content Redirection Extension is available from the Chrome Web Store.
  • Please note that Chrome support requires CWA 1809 or higher and VDA 1808 or higher.


For further information, including BCR system requirements, please read the Browser content redirection section of the Citrix Virtual Apps and Desktops 7 Product Documentation.
2. Browser Content Redirection configuration for specific use cases
2.1 Server fetch and server render
Default behavior when BCR is disabled. No VDA-side viewport redirection to the client occurs. This could be due to the desired behavior as configured through BCR policies, or server fallback may have occurred unintentionally due to a client redirection failure. To configure for this use case:
Browser content redirection policy: If set to Prohibited, BCR is disabled.
Alternatively, if “server fetch and server render” is to be applied for some websites, while permitting BCR for others, use the Browser content redirection Access Control List (ACL) policy settings policy to whitelist sites and/or the Browser content redirection blacklist setting policy to blacklist sites.
In this alternative scenario, the Browser content redirection policy needs to be unconfigured [since the default value is Allowed] or set explicitely to Allowed.
Note that in this mode, server-side rendering uses ICA Thinwire to remote the graphics to Workspace app, the same way it is done for any application running in the virtual desktop.
2.2 Server fetch and client render
This mode allows endpoints with no direct access to the website (e.g. Intranet) to be able to proxy the HTTP traffic through the VDA, which then relays to the web server. A service in the VDA called 'Citrix Port Forwarding' is in charge of this.
To configure for this use case:
When the Browser content redirection proxy setting policy has been configured with a proxy server IP:Port address, the client connects to the proxy server on the VDA’s network over the Port Forwarding virtual channel and renders the content locally.
Proxies that require explicit authentication are supported with CWA for Windows 1907 or higher.
TCPView running on the endpoint will show that HdxBrowser attempts to connect to a few localhost TCP ports (the aforementioned client-side Port Forwarding virtual channel):
For Linux endpoints, running netstat will show WebKitNetworkProcess establishing connections to localhost:
On a Linux client, also check if vdbrowser.dll and vdportfoward.dll (used for server fetch client render) have been loaded.
If they are not loaded, the redirection will fail and fallback to server-side rendering.
You can use the following command 'cat /proc/<PID of wfica>/maps' to check:
The TCP Port Forwarding service on the VDA is called CtxSvcHost.exe, and is the one making the final outbound connection to your Proxy Server (in the screenshot below it is 10.108.7.8:8888). This is how it looks on Process Explorer:


Be aware that there are many Citrix Virtual Channels that can run under CtxSvcHost (Smart Card, Audio, Flash, etc).
The one used by Server Fetch Client Render in Browser Content Redirection uses the 'PortFwdSvcs' flag, as seen above.
You can also use TCPView - but make sure you are tracking the right CtxSvcHost. You can use the PID value from Process Explorer (9196 in the screenshot above) to correctly identify it, or look at the Remote Address and identify your Proxy.
If CtxSvcHost.exe is not seen, please restart the service 'Citrix HDX Port Forwarding Service' on the VDA.
2.3 Client fetch and client render
This use case affords the maximum benefits for bandwidth efficiency and VDA resource usage.
To configure for this use case:
Browser content redirection policy: No need to configure but Allowed can be set. [Default value Allowed]
Browser content redirection Access Control List (ACL) policy settings policy: Acts as whitelist. Add any websites (wildcard * can be used) that you want to be redirected.
[Default value: https://www.youtube.com/*]
When this mode is configured, HdxBrowser.exe (Windows) or WebKitNetworkProcess (Linux) will contact a website directly:
2.4 Other BCR configuration options
To support whitelisted websites that navigate away to a 3rd-party site for authentication before redirecting back to the whitelisted site, configure the Browser content redirection authentication sites policy.
We'll use YouTube as an example:
The Browser content redirection policy will include the value: https://www.youtube.com/* [note that this entry exists by default in the policy]
The Sign In button on the YouTube site navigates to https://accounts.google.com/... (the protocol/domain part will be consistent but the full path will vary).
To support the authentication-related navigation from https://www.youtube.com/ to https://accounts.google.com/ and back to https://www.youtube.com/, configure as follows:
In the Browser content redirection authentication sites policy, add the entry: https://accounts.google.com/* (note the wildcard * to accommodate variations in URL sub-folder values).
More info can be found in CTX238236.
3. Browser Content Redirection feature limitations

  • For websites with media content, only the following list of codecs are supported when the site is redirected:
ContainerAudio CodecsVideo Codecs
MP4 (QuickTime / MOV / MPEG4)
Ogg
WebM
WAV
FLAC
MP3
Opus
PCM
VP8
VP9
Theora
H264
  • In CWA 1905 for Windows or older versions, or with CWA for Linux, Websites that use Integrated Windows Authentication (IWA) might break BCR. Currently BCR is not able to handle and display the pop-up 'Windows Security' dialog box (or any dialog box), and the user might end up in a blank page. Keep in mind that since now the endpoint is loading the website, the endpoint and website (running on IIS for example) might not be in the same domain (while VDA and IIS might). Hence IWA fails, a pop-up window should be displayed prompting the user for credentials but it is not, because of the aforementioned limitation in BCR. This issue has been fixed in CWA for Windows 1907 or higher.
  • When using Server Fetch Client Render (this policy in Studio), only a single Proxy FQDN / IP is supported. PAC files (for automatic proxy configuration) are now supported with Server Fetch Client Render when the VDAs are 2003 or higher (see here), or 1912 CU1 (see here).
  • When freshly installing CVAD 1811 (only), there is a known issue with BCR_x64.msi where it is not installed on the VM if the Admin selected 'Enable brokered connections to a server' or 'Enable Remote PC Access'. The workaround is to mount the .iso of CVAD, find the BCR_x64.msi in Image-Fullx64Virtual Desktop Components and run it. See CTX240182.
  • The Desktop OS Core Services Virtual Delivery Agent stand alone .exe (VDAWorkstationCoreSetup) does not include BCR_x64.msi. Same workaround CTX240182 fixes this.
  • Due to the limitation of CEF(Chromium Embedded Framework), client endpoint GPU needs to be disabled if DPI scaling factor is set to a number other than 100% in order for BCR feature to work. Otherwise BCR displays the website in a corrupted fashion (like zoomed in and cropped). To disable, configure on the Client:
    • HKLMSOFTWARECitrixHdxMediastream
      For 64-bit:
      HKLMSOFTWAREWow6432NodeCitrixHdxMediastream
      Key: GPU (DWORD)
      Value: 0
  • Currently, with Windows CWA, copying text from redirected webpages is only possible with Chrome browser content redirection. Use Ctrl-C / Crtl-V to copy and paste. Linux CWA support copy/paste for both IE11 and Chrome.
  • Currently printing from redirected webpages is not possible from Internet Explorer 11 and Chrome.
  • Currently, screensharing functionality will not work if the BCR user tries to initiate screensharing. Incoming sreensharing does work (HDX-16273).
  • Upgrades to Receiver 4.11 or 4.10 from any version might break BCR virtual channels. See CTX235183.
  • If Local App Access is Allowed then BCR will not work. You must set LAA to Prohibited (Default) for BCR to work.
  • Currently downloads aren't enabled on redirected websites when using Chrome on the VDA (therefore files cannot be saved to the endpoint).
  • In IE11, after starting a YouTube video using the YouTube HTML5 video player, full-screen mode might not work. You click the icon in the lower-right corner of the video, and the video doesn’t resize leaving the black background in the full area of the page. As a workaround, click the full screen button, and then select theater mode.
    This issue is not seen on Chrome.
-----------------------------------------------------------------------------------------------------------------------------------------------------------

4. Browser Content Redirection Troubleshooting

Before proceeding, please review the “Browser Content Redirection feature limitations” section.

4.1 General troubleshooting steps

StepMay clear problem in
Close the browser, re-open, and navigate to a whitelisted site.Browser Add-On and HdxVideo.js file
Disconnect and reconnect the session.Citrix Workspace app, HdxBrowser.exe, HdxBrowserCef.exe, WebSocketAgent.exe, and services
Logoff and logon to a new session.Citrix Workspace app, HdxBrowser.exe, HdxBrowserCef.exe, WebsocketAgent.exe, and services
Stop the services: 1. Browser redirection service, 2. HTML5 redirection service, and 3. Port forwarding service. Restart them in reverse order listed. Logoff and logon the session.All components


4.2 Data to collect for troubleshooting

CDF modules to trace:

VDA SideCitrix Workspace app (client) Side
HDX_Multimedia_BrowserService
HDX_Multimedia_HdxjsInjector
HDX_Multimedia_PortForwardLibrary
HDX_Multimedia_PortForwardService
HDX_Multimedia_WebSocketAgent
HDX_Multimedia_WebSocketPipe
HDX_Multimedia_WebSocketService
PE_Library_GvchBase
IcaClient_Multimedia_HdxBrowser_CtlGuid
IcaClient_DriversVd_BrowserRedir_CtlGuid
IcaClient_DriversVd_PortForward_CtlGuid

4.3 HdxBrowser and Webcontainer (a.k.a Overlay Browser)
When using BCR with Internet Explorer 11, ensure HdxBrowser.exe is running with Citrix Workspace app for Windows (use Task Manager) while you are on a whitelisted site.
When using Google Chrome, the process is called HdxBrowserCef.exe.
Note: Chrome support requires CWA 1809 or higher, and VDA 1808 or higher.
This is how it looks on Process Explorer on the endpoint:
For Linux endpoints (Fat Clients, or Thin Client minimum versions: Unicon eLux RP 6.2.3 CR, HP ThinPro 7.1 or higher only, iGEL OS 10.05 or higher) the process used is webcontainer (placed in ICAROOT /util folder. ICAROOT generally is /opt/Citrix/ICAClient for root user).
Dell Wyse ThinOS Version 9.0 supports BCR.
i. Please check if webcontainer process is starting in your Linux client by running:
<ICAROOT>/util/webcontainer --version.
Sample output:

ii. If it fails then you have to install WebKitGTK+ version greater than 2.16.6 for Browser Content redirection to work.
WebKitGTK+ is a full-featured port of the WebKit rendering engine (WebKit2 API with GTK3).
(This is not part of Citrix Receiver / Workspace app, so you will need to download the proper package for your Linux distribution and processor architecture, or contact your Thin Client vendor).
Therefore, libwebkit2gtk-4.0.so.37 system library will be required for webcontainer to link against:
Note that glibcxx 3.4.20 or later is also required for BCR (#locate libstdc++.so.6 and then run #strings /<add the found location>/libstdc++.so.6 | grep GLIBCXX):

iii. You can then check if webcontainer process can render the video content locally by running:
./webcontainer --url https://www.youtube.com/html5
./webcontainer --url https://www.youtube.com
This test verifies if the endpoint has the proper codecs available (specially the 'ugly' ones like H264). The test does not invoke any Citrix VDA components, it is a purely local test. Webcontainer (WebKitWebProcess) will in turn make calls to GStreamer 1.x - if H264 is not loaded, VP8 will be used instead (if the website supports WebM).
In order to check your GStreamer version, run 'dpkg -l | grep gstreamer'.
More info on GStreamer requirements in CTX224988.
Note: Currently, if WebKitGTK+ version is below 2.22.3, then Media Source Extensions (MSE) are not supported so YouTube videos will only play up to 720p (with H264).
If H264 is not available or licensed, YouTube will attempt to use WebM container format (VP8/VP9 video codecs from gst-plugins-good and Opus audio codec from gst-plugins-base).
YouTube now requires MSE to play videos in WebM format, so a proper WebKitGTK+ version has to be present.
WebKitGTK+ version 2.22.5 or higher and GStreamer 1.14.4 or higher are recommended for YouTube.
​​​
iv. Running the top command while BCR is active will show:
While webcontainer is in use, there are 2 associated WebKit processes that run: WebKitNetworkProcess and WebKitWebProcess. The actual network outbound connections are made by WebKitNetworkProcess).
4.4 Browser JavaScript log live debugging in IE11 and Chrome:

  1. If you want to debug in IE11, Open %programfiles%CitrixHdxVideo.js
    (or depending on your VDA version, the Javascript can also be located inside a folder called %programfiles%CitrixICASERVICE)
    You might need to do this running Notepad as an Admin and opening the .js file from the Open menu
    Change the line var DEBUG_ONLY = false; to var DEBUG_ONLY = true;
    Save the file and close your Editor.

  2. If you want to debug on Chrome, skip step #1. Make sure your Extension is at version 2.0. Right click on the icon, select Options and tick 'Activate debug logging'.

  3. Close Internet Explorer / Chrome and reopen it, hit F12 or Ctrl+Shift+I, and go to the Console tab in Developer tools. Browse to a whitelisted site, e.g. https://www.youtube.com

  4. You should see traces from [HdxVideo.js] (example below). Collect the entire log.
    Key messages to look for are highlighted in bold, with additional comments inside brackets [ ]:

    [HdxVideo.js] OnUnload (window): [object Window]
    [HdxVideo.js] DocumentBodySuppressor.start()
    [HdxVideo.js Events] interceptEventListeners()
    [HdxVideo.js] DocumentBodySuppressor.trySetBodyStyle(): stopping observer
    [HdxVideo.js] OnLoad (window): [object HTMLDocument]
    [HdxVideo.js] Unredirected video count: 0
    [HdxVideo.js] HDX_DO_PAGE_REDIRECTION: true [if false, redirection is not even attempted. Problem with policies or browser Extension?]
    [HdxVideo.js] infallback: undefined
    [HdxVideo.js] Installing event listeners.
    [HdxVideo.js] msexitFullscreen - Found!
    [HdxVideo.js] onWSOpen: [Websocket opening to WebsocketAgent.exe 127.0.0.1:9001 succeeded. If failed, check your IE Security Settings]
    [HdxVideo.js] >>> {'v':'pageurl','url':'https://www.google.de/'}
    [HdxVideo.js] onVisibilityChange:
    [HdxVideo.js] >>> {'v':'vis','vis':true}
    [HdxVideo.js] onResize:
    [HdxVideo.js] >>> {'v':'pageredir'}
    [HdxVideo.js] sendClientSize: w: 1316 h: 755
    [HdxVideo.js] >>> {'v':'clisz','w':1316,'h':755}
    CSI/tbsd_: 15.599,072ms
    CSI/_tbnd: 15.658,128ms
    [HdxVideo.js] <<< {'v':'winid','title':'CitrixVideo:{1b83a2dc-39ae-4455-ad7d-d56e71fbb45d}'}
    [HdxVideo.js] onWSMessage: winid: CitrixVideo:{1b83a2dc-39ae-4455-ad7d-d56e71fbb45d}
    [HdxVideo.js] setWindowTitle: CitrixVideo:{1b83a2dc-39ae-4455-ad7d-d56e71fbb45d}
    [HdxVideo.js] documentTitleMutator.start()
    [HdxVideo.js] >>> {'v':'winid'}
    [HdxVideo.js] <<< {'v':'pageredir'} [VDA is instructing Receiver to start the redirection process]
    [HdxVideo.js] onWSMessage: pageredir
    [HdxVideo.js] Redirecting page -- 화이팅! https://www.google.de/ [Korean characters means the redirection was successful]


    A common error is:

Workspace
[HdxVideo.js] OnUnload (window): [object Window]
Navigation Event Separator HTML1300: Navigation occurred.
www.youtube.com
[HdxVideo.js] DocumentBodySuppressor.start()
[HdxVideo.js Events] interceptEventListeners()
[HdxVideo.js] DocumentBodySuppressor.trySetBodyStyle(): stopping observer
[HdxVideo.js] OnLoad (window): [object HTMLDocument]
[HdxVideo.js] Installing event listeners.
[HdxVideo.js] msexitFullscreen - Found!

[HdxVideo.js] doRedirection(): exception connecting to WebSocket: SecurityError
[HdxVideo.js] onWSError:
[HdxVideo.js] Showing content -- suspendRedirection.

CitrixIn the Developer Tools console this can be seen as:

This is caused by security configurations in IE11’s Security Zones, and the root of the issue is 127.0.0.1 being classified under the intranet zonewhile the redirected whitelisted site is in the internet zone.
Redirection might work as intended on Chrome (since it has no concept of Zones).
Internet Explorer automatically assigns all websites to a security zone: Internet, Local intranet, Trusted sites, or Restricted sites.
Important: 127.0.0.1 will be classified as either Intranet or Internet zone, depending on your IE11 Proxy configuration in Tools > Internet Options > Connections > LAN Settings (either PAC files - WPAD Proxy Script-, or Explicit Proxy -manual-). More info here.


If 127.0.0.1 ends up being classified as Intranet, then Zone elevation restrictions prevent connections from Internet zone to Local intranet zone, and BCR will fail.

The Local intranet option 'Include all sites that bypass the proxy server' should be unchecked (disabled).

Rationale : If 'Include all sites that bypass the proxy server' is enabled, 127.0.0.1 connections are considered to be in the Intranet zone. Zone elevation restrictions prevent connections from Internet zone to Local intranet zone.

Citrix Workspace Slow On Mac

Most of the external redirected sites like Youtube will be in the Internet zone and the injected script HdxVideo.js will attempt a connection to 127.0.0.1:9001 in the Intranet zone which will be blocked. So, 'Include all sites that bypass the proxy server' should be unchecked.

Internet Properties --> Security --> Local Intranet --> Sites, and uncheck 'Include all sites that bypass the proxy server'
The equivalent configuration can be made by setting these regkeys via GPOs (ADM Computer template):
HKLMSoftwarePoliciesMicrosoftWindowsCurrentVersionInternet SettingsZoneMapAutoDetect [REG_DWORD value 0]
HKLMSoftwarePoliciesMicrosoftWindowsCurrentVersionInternet SettingsZoneMap IntranetName [
REG_DWORD value 1]
HKLMSoftwarePoliciesMicrosoftWindowsCurrentVersionInternet SettingsZoneMapProxyByPass [
REG_DWORD value 0]
HKLMSoftwarePoliciesMicrosoftWindowsCurrentVersionInternet SettingsZoneMap UNCAsIntranet [
REG_DWORD value 1]


Each zone has a different default security level that determines what kind of content might be blocked for that site.

ZoneDescriptionDefault Setting
InternetContains all websites that are not assigned to any other zoneMedium-high
Local intranet Contains all websites and content that is stored on a corporate intranet and don't require a Proxy ServerMedium-low
Trusted SitesContains all Internet sites that you have specifically indicated to be ones that you trust not to damage your computer or informationMedium
Restricted SitesContains all the sites that might potentially damage your computer or your informationHigh

(Depending on the security level of a site, some content might be blocked until you choose to allow it).
You can check the Zone a website is assigned to by navigating to it and then right clicking --> Properties

If the website you are trying to redirect is in your Internet Zone (see example above), then please try to add the following entry to the Trusted Zone Sites in IE11

(Internet Options -> Security)

  • https://127.0.0.1:9001


You can verify if websockets are opened by going to Developer Tools -> Console and type:

var exampleSocket = new WebSocket('wss://127.0.0.1:9001'); exampleSocket.onmessage = function(messageEvent) { console.log(JSON.stringify(messageEvent)); };

wait a few seconds and then type:

exampleSocket.readyState

The expected output from the 2nd line, is '1', which indicates that the WebSocket connection was successfully formed.
0 (CONNECTING) The connection is not yet open | 1 (OPEN) The connection is open and ready to communicate.
2 (CLOSING) The connection is in the process of closing | 3 (CLOSED) The connection is closed or couldn't be opened

4.5 Pac files
The PAC file does not need to return DIRECT for 127.0.0.1:9001 (WebSocketService.exe on the VDA), IE11 makes direct connections for localhost/127.0.0.1 by default.
Zone elevations restrictions might, again, prevent HdxVideo.js to connect to 127.0.0.1:9001, so make sure it is classified as Internet Zone (see 4.4).
4.6 Content Security Policy
Another possible error is that some websites use a technology called CSP (Content Security Policy) which prevents any outside resource (like the Javascript used in BCR) from being executed in the trusted webpage context. Therefore Browsers prevent the injection of HdxVideo.js and BCR fails, falling back to server-side rendering.
This can be overcome if you have a Proxy server in your network (like Bluecoat) and you are able to apply HTTP Rewrites.
wss://127.0.0.1:9001 needs to be added to connect-src
4.7 Browser Helper Object (BHO for IE11)
The BHO is not currently compatible with Enhanced Protected Mode in IE11.
BHO is explicitly enabled upon install time of Citrix Virtual Apps and Desktops. If you want to disable it, please check the registry key created for the CLSID of the extension in the following path:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesExtCLSID
There should be a key created with the CLSID of the extension ie {CA076BDE-8E41-44EE-B775-E791F26D0483}
The value of the key is set to 1. This means the extension is enabled and users cannot change it.
If changed to 0 , the extension will be disabled and users cannot change it.
If changed to 2 , the extension will be enabled and users can enable or disable it in the browser's 'Manage add-ons'.

4.8 How to verify the webpage is redirected
Method #1: Drag the IE11 or Chrome window quickly. You will notice a ‘delay’ or ‘out of frame’ between the viewport and the User Interface.

Also you will notice a quick change in the title on the Tab (CitrixVideoId) before the original title is placed back
Method #2: When the right mouse button is clicked on window area, a customized context menu is displayed. Back/Forward menu items are currently disabled for the initial releases. The remaining menu items perform the following tasks:

  • Refresh: refreshes current client side web page.
  • Open: if the mouse point is focused on a hyper link, the link will be opened; otherwise, nothing will happen.
  • Open in New Tab: if the mouse point is focused on a hyper link, the link will be opened in a new Tab; otherwise, nothing will happen. (Note: for the initial release, this works only when pop-up is enabled on VDA side IE instance.)
  • Open in New Window: if the mouse point is focused on a hyper link, the link will be opened in a new Tab; otherwise, nothing will happen. (Note: for the initial release, this works only when pop-up is enabled on VDA side IE instance and the link is opened in a new Tab rather than in a new Window)
  • About HDX Browser Redirection: Browse to Citrix support site in a new Tab

Additional Resources

Browser Content Redirection: whitelisting websites​
Browser Content Redirection Not Working
Citrix Blogs: HTML5 Multimedia Redirection: State of the Union
Citrix Blogs: Citrix and Microsoft are teaming up for Teams
Dell Wyse ThinOS Version 9.0

Disclaimer

Caution! Using Registry Editor incorrectly can cause serious problems that might require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. Be sure to back up the registry before you edit it.

Organizations now have staff working from home all over the country, and staff depending on remote technology could be using either their personal devices, or corporate laptops. To support this shift, Citrix Gateway could be configured within the organization’s private or public cloud to allow for secure remote access to virtual applications and desktops. WithCitrix Gateway acting as an ICA proxy, staff may be allowed by the organization to use their personal computers, laptops, or tablets such as an iPad.

Other organizations may use the Citrix Gateway for VPN access, and have staff again use their corporate devices, or personal devices subject to posture checking.

Citrix Workspace App Slow

IT loses visibility and control

These technologies such as VPN and ICA proxy are great at allowing efficient remote working, however, there are more external factors introduced with remote working that can impact the end-user experience. We now have staff connecting into our datacenters from a range of different internet connections, from 3G, 4G, Wi-Fi hotspots and broadband. This is something corporate IT can’t control.

Further to this, if staff are likely using their personal devices to connect in, those devices in some instances could be the latest and greatest Windows 10 or Apple devices that are fully patched running the latest versions of web browsers and Citrix Workspace app. This is often only a very small percentage of the userbase though, as most devices will run a mixture of operating systems from Windows 10 to Windows 7, and older macOS versions that have not been updated in 3-4 years. I often find these devices also running unsupported versions of Citrix Receiver that simply haven’t been updated since they were initially installed.

Citrix workspace slow download

Staff still expect that if they can connect to their virtual apps and desktops, that the performance they receive is similar to what they were used to when working from the office. That is, minimal lag, a responsive application that also launches quickly, and is available whenever they need it.

The rise of multimedia

Audio and video technologies such as Zoom and Teams have become much more popular due to the pandemic and staff working remotely. People need to stay in touch daily, from having meetings regarding ongoing projects or simply keeping in touch to prevent feeling isolated.

Usage of Teams has more than doubled in recent months, with now over 70 million active users using it around the world. Bandwidth consumption can range from 30kbps to over 1Mbps depending on if you are audio calling or in a group video call.

It is important to keep in mind that thesemultimedia platforms do have the ability to consume more of your available bandwidth, and for those staff members who have lower quality broadband in the home, there could be bandwidth contention with your virtual apps and desktop sessions. I should also mention the fact that if you have other members in your household streaming or playing online games from a range of devices, those activities will further add to the bandwidth contention of your home broadband.

The remote worker, returning to the office

Since the initial months of the pandemic, some restrictions are being lifted across different countries and people are allowed to return back to the office, though often in limited numbers.

Citrix Workspace Slowly

Some staff are also returning to the office on a part-time basis, but the change of toolsets has created a potential new problem. All these multimedia applications such as Zoom and Microsoft Teams that were adopted for keeping connected will continue to be used even as staff return to the office. Because of this, what starts to happen is that gradually a much higher demand is placed on the office network. The more people that return, the higher the bandwidth utilization is likely to be, higher than ever before.

Users will still also obviously continue to launch their virtual apps and desktops whilst in the office, but with the much higher bandwidth contention with peers, the ICA channels could be impacted, causing slow application launches, slow in-session performance and so on.
Ultimately, the risk of tickets reaching the desk for “Citrix is slow” problems may be more common.

Pinpointing the slowness

From an IT perspective, Citrix admins need to be able to pinpoint where the slowness is coming from when anend-user reports that “Citrix is slow” from the office or remote. Is it the home network the user is connected from, the user’s personal device, the entire corporate office, or something in the datacenter with the Citrix VDAs?

For example, it could be the end-users home network due to household members using Wi-Fi for streaming and playing video games, leading to bandwidth contention which is impacting the end-users ICA session to their virtual apps and desktops.

On the other hand, it could be that the end-user’s personal device is running poorly. Maybe it is running on quite old hardware, or there has been a lot of third-party software installed on the device which is causing high RAM or CPU utilisation. Such problems can impact the launching and in-session ICA performance, however the end-user may report to the helpdesk that Citrix is slow, not knowing that it is caused by their own device. This leads IT down the wrong path from the beginning.

Also, staff may now be reporting slowness after a return to the office, with the usage of Zoom and Teams still high, because the network infrastructure was not designed for the larger amount of traffic end-users are now pushing through it.

IT needs purpose-built monitoring tools to help pinpoint where the issue lies and to quickly rule out if the issue is not with Citrix at all.

How ICA channel, network, and latency monitoring can help

Citrix Workspace Slow

A purpose-built monitoring tool that can monitor each of the individual ICA channels, the end-user’s network, and latency is a powerful solution to have at your disposal.Goliath Performance Monitor, for example, has such ability to monitor each channel and you can be selective about what channel to investigate when troubleshooting.

In the below example, an end user reported that their session became slow suddenly and wanted to know what happened. Upon review, we can see that the end user experienced a sudden spike in network latency, which caused the ICA latency to jump up.

At the same time, we were able to see that the user’s connection speed dropped simultaneously, which we can correlate to the sudden spike in network latency. Obviously, something happened on the end-users network at that time to cause a drop, which could have been a burst in demand for available bandwidth or just temporary slowness from any of the hops coming into the organization’s datacenter.

Finally, in this example, an end user similar to the scenario before encountered a sudden spike in ICA RTT latency, but this time it was not actually anything user-side which caused the problem.

Upon comparing the VDA CPU utilization the end user was connected to at the time, we can see the CPU usage increase for a period of time that matches when the ICA RTT latency jumped. This eliminates any doubt over the end-user connection, which can also be tracked under Network Latency and appears to be very stable throughout.

Summary

Citrix Workspace Linux Slow

Remote working, and higher usage of multimedia solutions are here to stay. What that also means is troubleshooting slow session and end-user experience issues is not going away any time soon.

Luckily, there are solutions out there that can help assist and guide Citrix admins to typical “Citrix is slow” resolutions so that you don’t spend any extra time troubleshooting, especially when you cannot see the full picture for those users remotely connecting from various internet links and from personal devices.

As you can see from these examples, with actual data-driven proof you can quickly isolate root cause, have your users back up and running quicker and spend less time troubleshooting end-user problems.

To learn more about how to troubleshoot “Citrix is Slow” by understanding data from ICA/HDX protocol, check out thisTechnical Guide to Citrix ICA/HDXsponsored by Goliath Technologies.

This post was originally published onJGSpiers.com.

Citrix Workspace Slow Cookers

George Spiers

George has been a Citrix Technology Professional (CTP) since 2018 and is also a Citrix Certified Expert in Virtualization (CCE-V), a Citrix Certified Professional in Networking (CCP-N), a Microsoft Certified Solutions Expert and an Epic Certified Administrator. He has experience working with Citrix NetScaler, PVS, XenApp, XenDesktop and XenServer leveraging NVIDIA GRID technology for high-end graphical computing. Click here to check out his website.

Citrix Workspace Slowing

Continue Your Research on How to Troubleshoot Citrix is Slow Complaints