All Apps and Add-ons

UberAgent: getting strange application name

pedrolito
Explorer

Hello splunkers!

I recently discovered a problem with guys monitoring citrix activities on how published app names are written.

The problem concerns application names which can have different format, like upper case and lower case.
Within dashboards this is not a problem as the value "SessionPublishedAppsCtx" is changed in "SessionPublishedAppsCtxSplitLower".

However, for a lot of applications, for ex. google chrome, I get results with the SessionPublishedAppsCtx=google_chrome_1-1.
It seems that somewhere, the application name is feeded with numbers at its end, or even sometimes truncated (off for 'office')

When I checked the brut logs from splunk SHD, I can see that logs are received in this format from uber Agent, which drive me to think that such name modification are done on the uberagent itself.

Any idea or feedback from this little issue ?

Thanks in advance

Cheers!

1 Solution

helge
Builder

uberAgent reads Citrix XenApp published application names from the registry of the VDA. The format of the names is internal to the VDA - uberAgent does not change it. It should, however, be easy enough to figure out which published application a name refers to.

View solution in original post

0 Karma

helge
Builder

uberAgent reads Citrix XenApp published application names from the registry of the VDA. The format of the names is internal to the VDA - uberAgent does not change it. It should, however, be easy enough to figure out which published application a name refers to.

0 Karma

pedrolito
Explorer

Hi helge,

Thank you for this quick answer.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...