Performance Hits and Slow Login on Citrix Devices

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Slower than average login times on Citrix terminal servers
• Longer than average load time on opening application on initial login

Environment

• App Control Agent: All Supported Versions
• Citrix Enterprise Products

Resolution

1. Upgrade to Agent 8.9.4+ to take advantage of the latest performance improvements.

   EP-19006: Fixed a small memory leak that occurred any time a Yara file analysis was started on the agent. 
   EP-18263: Fixed a small leak of OS synchronization objects that can result in high memory utilization issues on long-running systems.
   EP-17440: Significantly improved the performance of rule expansion, by reducing the amount of file IO done during name normalization. 
             Since rule expansion is performed when a new user logs in, significant performance gains should be seen in multi-user environments.
   

2. Implement the following Agent Configs for all Windows Hosts in any related Citrix Policy:
   • Disable reevaluate_on_logon
   • Disable startup Cache Consistency Check
3. Implement the following Kernel Process Exclusion for all Windows Agents in any related Citrix Policy:
   1. Log in to the Console and navigate to https://ServerAddress/agent_config.php
   2. Click Add Agent Config and use the following details:
      • Name: Citrix - Ignore All Operations
      • Host ID: 0
      • Platform: Windows
      • Value:

        kernelProcessExclusions=*\Program Files*\Citrix\*:8388607

      • Policy: Select only the relevant Citrix Policies
      • Status: Enabled
   3. Save the Agent Config and verify the changes are applied to the Golden Image (and Clones) accordingly.
4. Follow the correct procedure for creating a Template Computer to use for Citrix Clones.
   • It is critical that the Golden Image shows Initialization as Complete and File Synchronization at 100% before shutting down & saving.
   • Any remaining Initialization, Synchronization, or other activity will happen on EVERY Clone that is started, EVERY time, which will cause performance issues.