Sessionwright

Citrix® Health Check Checklist: 45 Checks for CVAD and DaaS

By Sessionwright EngineeringPublished Updated 8 min read

A useful Citrix health check is a list of specific questions, each with a command that answers it and a known-good result. This checklist covers Citrix Virtual Apps and Desktops (CVAD), Citrix DaaS and NetScaler Gateway. Every row says what to check, how to check it, and what "good" looks like. All checks are read-only.

Before you start: the built-in tools

  • Citrix Scout (CVAD) runs health checks against Delivery Controllers, VDAs, StoreFront and License Servers. The site checks use the Environment Test Service and can take up to an hour on large sites (Citrix docs).
  • Cloud Health Check (DaaS) checks VDAs, StoreFront and Profile Management. Run it from a domain-joined machine, never a Cloud Connector (Citrix docs).
  • Web Studio > Home > Test site checks database health, connectivity, delegated administration, registration state and more (Citrix docs).
  • Citrix Health Assistant troubleshoots unregistered VDAs (Citrix docs).

For a quick Citrix health check PowerShell script on CVAD, this read-only loop prints any FMA service on any Controller that isn't OK. It uses -AdminAddress, a common Citrix SDK parameter (Citrix SDK):

$cmds = 'Get-BrokerServiceStatus','Get-ConfigServiceStatus','Get-LogServiceStatus',
        'Get-MonitorServiceStatus','Get-HypServiceStatus','Get-ProvServiceStatus',
        'Get-AcctServiceStatus','Get-AdminServiceStatus'
foreach ($ddc in (Get-BrokerController).DNSName) {
  foreach ($c in $cmds) {
    $s = & $c -AdminAddress $ddc
    if ($s.ServiceStatus -ne 'OK') { '{0}  {1}: {2}' -f $ddc, $c, $s.ServiceStatus }
  }
}

Site, Delivery Controllers and SQL (CVAD)

# Check How Good looks like
1 Controller state and version Get-BrokerController | Select DNSName, State, ControllerVersion, LastActivityTime (SDK) All Active, at least two Controllers, one ControllerVersion. Scout flags failed or mixed-version Controllers
2 FMA services The loop above No output. PendingFailure means the database connection was lost (SDK)
3 Site DB connection Test-BrokerDBConnection (Get-BrokerDBConnection) (SDK) OK
4 Site test Web Studio > Home > Test site, or Start-EnvTestTask -TestSuiteId Infrastructure (SDK) No failed tests
5 Delivery group capacity Get-BrokerDesktopGroup | Select Name, Enabled, InMaintenanceMode, DesktopsAvailable, DesktopsUnregistered, DesktopsFaulted, Sessions (SDK) No group in maintenance by accident; unregistered/faulted = 0; headroom in DesktopsAvailable
6 Hypervisor connections Get-BrokerHypervisorConnection | Select Name, State, IsReady, FaultState (SDK) On, True, None
7 Local Host Cache (Get-BrokerSite).LocalHostCacheEnabled (Citrix docs) True. Each Controller has RAM for LocalDB (about 1.2 GB) plus the secondary broker (up to 1 GB); no more than 10,000 VDAs per zone

Cloud Connectors (DaaS)

# Check How Good looks like
8 Redundancy Citrix Cloud > Resource Locations At least two Connectors per resource location; Citrix recommends N+1 (Citrix docs)
9 Health and alerts Monitor > Infrastructure Monitoring Every Connector reachable, no rows with errors (Citrix docs)
10 Hourly connectivity check Application log, events 10005/10006 None recent (Citrix docs)
11 Clock Events 10004/10103 ClockOutOfSyncError None
12 Version and update schedule Resource Locations: current vs target version Current = target; update schedule set outside business hours (Citrix docs)
13 Outbound connectivity Start > Citrix > Citrix Cloud Services Connectivity Test Tool All tests pass (Citrix docs)

VDAs and images

# Check How Good looks like
14 Unregistered VDAs Get-BrokerMachine -RegistrationState Unregistered, grouped by LastDeregistrationReason Zero powered-on, or each one explained (our guide)
15 Fault states Get-BrokerMachine -FaultState StuckOnBoot (also FailedToStart) (SDK) None
16 Forgotten maintenance mode Get-BrokerMachine -InMaintenanceMode $true Each one has an owner and a reason
17 Version drift Get-BrokerMachine -MaxRecordCount 10000 | Group-Object AgentVersion (the default is 250 records) Few versions, none below the catalog functional level (Citrix docs)
18 VDA health checks DaaS: Studio > Search > Run Health Check (VDA 2109+) (Citrix docs); CVAD: Scout No issues in the report

StoreFront

# Check How Good looks like
19 Base URL Get-STFDeployment (HostbaseUrl) (SDK) HTTPS, and the FQDN is in the certificate's CN or SAN (Citrix docs)
20 Certificate IIS binding, or Scout/Cloud Health Check Chain complete, not expiring within 30 days
21 Server group sync StoreFront console > Server Group, or Get-STFServerGroupConfiguration (SDK) Every member synchronized (Citrix docs)
22 Controllers per store Get-STFStoreService | % { Get-STFStoreFarm -StoreService $_ } (SDK) Servers lists current Controllers/Connectors only; TransportType isn't HTTP (see #41)
23 Services and AD Scout/Cloud Health Check Default Domain and Credential Wallet services running; AD reachable on 88, 389, 464

Licensing

# Check How Good looks like
24 LAS activation Web Studio > Licensing License Server 11.17.2 build 53100 or later, activated through LAS (Citrix docs; EOL notice)
25 Caching mode Get-BrokerSite | Select LicenseServerName, LicensingGracePeriodActive, LicensingOutOfBoxGracePeriodActive, LicensingGraceHoursLeft; Get-BrokerController | Select DNSName, LicensingServerState, LicensingGraceState (SDK) Grace flags False; server state OK; grace state NotActive. In LAS, the License Server has 30 days to reconnect (Citrix docs)
26 Expiry and CSS Web Studio Overview alerts; (Get-BrokerSite).LicensesWithExpiredSwm; Scout License Server checks No alerts, empty list, CSS date in the future, CITRIX vendor daemon running, clocks in sync

NetScaler Gateway

# Check How Good looks like
27 Build show ns version (CLI ref) At or above the fixed build in every current bulletin (checker, CVE hub), and not past end of life
28 HA pair show ha node (CLI ref) Both nodes UP, one Primary, Sync ENABLED/SUCCESS, Propagation ENABLED (docs). AUTO DISABLED is expected during a mixed-version upgrade, not after it
29 Certificates show ssl certKey; set ssl certKey <name> -expiryMonitor ENABLED -notificationPeriod 30 (CLI ref) Days to expiration above your renewal lead time; expiry monitor on
30 vServers show vpn vserver, show lb vserver, show serviceGroup <name> (CLI ref) UP; service groups UP, not PARTIAL-UP
31 STA show vpn vserver <name> Every STA UP, and the same list as StoreFront, to avoid launch failures (docs)
32 Time show ntp status on both nodes Synced peers. NTP config doesn't propagate to the secondary (docs)

Profiles: FSLogix and WEM

# Check How Good looks like
33 FSLogix version Compare with the release notes Latest release (26.08, 3.26.826.17182 at time of writing). The release notes say customers must run the latest version
34 FSLogix config and service reg query HKLM\SOFTWARE\FSLogix\Profiles; FSLogix Apps Services (frxsvc) (Microsoft) Enabled=1, VHDLocations reachable, service running, no errors under Event Viewer > FSLogix or in C:\ProgramData\FSLogix\Logs (Microsoft)
35 FSLogix storage and AV Share ACLs; AV exclusions CREATOR OWNER Modify, subfolders and files only (Microsoft); exclusions per the prerequisites. See FSLogix troubleshooting
36 WEM Administration > Agents; Citrix.WEM.Health.Check.Tool.exe (Citrix docs) Synchronization state Successful, agents online, health check clean (Citrix docs)

Monitoring and Director

# Check How Good looks like
37 Alerts Director > Alerts (Premium sites), with email or webhook targets (Citrix docs) Alerts defined and delivered to a monitored mailbox
38 Probes Director application and desktop probing via StoreFront (Citrix docs) Key apps probed on a schedule; recent runs pass

Security and patching

# Check How Good looks like
39 Lifecycle Compare versions with the product matrix No CR past EOL (CRs reach EOM 6 months and EOL 18 months after GA); LTSRs on a current CU
40 NetScaler bulletins Bulletin fixed builds and CISA KEV against #27 Every KEV-listed NetScaler CVE fixed
41 XML service TLS netsh http show sslcert; HKLM\Software\Citrix\DesktopServer\XmlServicesEnableNonSsl (Citrix docs) A trusted cert bound on 443; value 0 (HTTP ignored)
42 Admins and changes Get-AdminAdministrator; Get-LogHighLevelOperation -OperationType ConfigurationChange (SDK) Every admin is a current person or group; every change is explained

Backup and DR

# Check How Good looks like
43 SQL Backup jobs for the Site, Monitoring and Logging databases Regular backups, restores tested; HA via AlwaysOn, mirroring or clustering (not SQL Express) (Citrix docs)
44 Site configuration Web Studio Backup and Restore, or Backup-CvadAcToFile (Citrix docs) Recent backup, pinned before changes. MCS catalogs aren't covered (Citrix docs)
45 NetScaler create system backup <name> -level full (CLI ref) A recent full backup copied off-box, not just in /var/ns_sys_backup

FAQ

Is there an official Citrix health check tool?

Yes, several. Citrix Scout and Web Studio's Test site cover CVAD. Cloud Health Check and Studio's Run Health Check cover DaaS. Citrix Health Assistant handles unregistered VDAs, and WEM has its own health check tool. None of them covers NetScaler, FSLogix or your backups, which is why the list above exists.

Is there a Citrix health check PowerShell script?

Citrix ships cmdlets, not a single script. The loop above plus rows 1–7 and 14–17 make a read-only script. Start-EnvTestTask runs Citrix's own infrastructure tests from PowerShell.

How do you health check Citrix DaaS?

Citrix runs the control plane, so focus on what you own: Cloud Connectors (rows 8–13), VDAs, StoreFront, profiles and NetScaler Gateway. For DaaS PowerShell, use the Remote PowerShell SDK after Get-XdAuthentication (Citrix docs).

How often should you run a Citrix health check?

Run the PowerShell rows weekly, and the full list before and after every upgrade. Also run it whenever a new NetScaler bulletin lands.

Want a second pair of eyes?

The Sessionwright assessment runs this kind of check across your Citrix site and NetScaler Gateway. It is read-only, and an expert reviews the report before it reaches you. Sessionwright for Citrix is read-only by default too: every change it proposes waits for your approval and is logged (security model).

Sources

Want the whole estate checked, read-only?

The Drop-in Assessment runs checks like these across your Citrix site and NetScaler Gateway with read-only access, then ends with an expert-reviewed report and a 60-minute readout. $4,500 fixed price, one site, up to 1,000 users, up to 2 ha pairs.

Related guides

Citrix, NetScaler and Citrix Virtual Apps and Desktops are trademarks of Citrix Systems, Inc. and/or its affiliates. Microsoft and FSLogix are trademarks of the Microsoft group of companies. Sessionwright is not affiliated with or endorsed by Cloud Software Group, Citrix or Microsoft.