Performance Hits and Slow Login on Citrix Devices

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Slower than average login times on Citrix terminal servers
• Longer than average load time on opening application on initial login

Environment

• App Control Agent: All Supported Versions
• Citrix Enterprise Products

Resolution

1. Upgrade to Agent 8.9.4+ to take advantage of the latest performance improvements.

   EP-19006: Fixed a small memory leak that occurred any time a Yara file analysis was started on the agent. 
   EP-18263: Fixed a small leak of OS synchronization objects that can result in high memory utilization issues on long-running systems.
   EP-17440: Significantly improved the performance of rule expansion, by reducing the amount of file IO done during name normalization. 
             Since rule expansion is performed when a new user logs in, significant performance gains should be seen in multi-user environments.
   

2. Implement the following Agent Configs for all Windows Hosts in any related Citrix Policy:
   • Disable reevaluate_on_logon
   • Disable startup Cache Consistency Check
3. Implement the following Kernel Process Exclusion for all Windows Agents in any related Citrix Policy:
   1. Log in to the Console and navigate to https://ServerAddress/agent_config.php
   2. Click Add Agent Config and use the following details:
      • Name: Citrix - Ignore All Operations
      • Host ID: 0
      • Platform: Windows
      • Value:

        kernelProcessExclusions=*\Program Files*\Citrix\*:8388607

      • Policy: Select only the relevant Citrix Policies
      • Status: Enabled
   3. Save the Agent Config and verify the changes are applied to the Golden Image (and Clones) accordingly.
4. Follow the guidance for Citrix Best Practices as outlined in the attached PDF.
5. Follow the correct procedure for creating a Template Computer to use for Citrix Clones.
   • It is critical that the Golden Image shows Initialization as Complete and File Synchronization at 100% before shutting down & saving.
   • Any remaining Initialization, Synchronization, or other activity will happen on EVERY Clone that is started, EVERY time, which will cause performance issues.