Wilco van Bragt - LinkeIn Wilco van Bragt - Twitter rssa 

Selecting a Monitor Solution for SBC/VDI environments Part 3: uberAgent





uberAgent is built on top of Splunk. Splunk is a kind of data mining product and uberAgent is an App within the Splunk infrastructure. So to use uberAgent you need to deploy Splunk as well. Splunk is available both on Windows as Unix. I used the Windows free edition (500 MB data per day maximum). You should take that into account, as Splunk is a commercial product where you pay based on the amount of data that is stored within the product. The installation of Splunk is pretty straight forwarded. The installation of uberAgent is based on two components. The first part is the actually Splunk app. The installation is actually uploading the corresponding files into Splunk.

Secondly the machines that should be monitored should be equipped it with the Splunk Agent. The Agent is based on a MSI and also unattended script options are provided within the installation source. There is no auto deployment option out of the management part as other monitoring are offering, but in most organizations that kind of deployment techniques are not used mostly.

uberAgent is fully functional without adding a license file. Actually there is no trial period as you can use it for as long as you want. Without a license the product will show a splash screen when a user logons.


Actually there is no configuration. During the agent installation you provide the name of the Splunk server and the agent sends the data to this machine. As uberAgent only focusses on Citrix Session Hosts / VDAs and Fat Clients there is no need to identify the role of machines. Oher components are not monitored within this product, it’s totally focusing on end user experience and front-end machines. So without any additional configuration we can start see what uberAgent offers in action.

uberAgent in action

Using uberAgent is actually starting the webbased console of Splunk. Within this console after uberAgent is installed an uberAgent icon is available in the left pane. Clicking that icon brings us to the user interface of uberAgent. The GUI is neat, easy to use and the views are really good. uberAgent both show graphs based on Top 10 mostly, followed by a textual view with more details Those textual views are clickable again showing even more detailed information about that specific part. uberAgent is totally focused on SBC/VDI infrastructures and it’s clear that the information shown is based on practical experiences. The views are divided in several categories like machine, users, applications, processes and so on.

As all information is valuable actually I will pick the most important items (in my opinion) and some specific features for this article. I start with the information shown as sessions.

Within session there are several views available, mostly I start with the User Sessions. As most views it will start with a total overview, followed by top 10. In the last table the textual details are available.

uberAgent provides lots of information. Besides the default CPU, Memory, Network usage and ICA latency it also shows IOPS and IO usage. I also tested it with RDS, where similar information was shown except the RDS latency did not show up. uberAgent can also be used for monitoring VMware View, but I did not test that (yet). uberAgent also provides detailed information about the duration of the logon process within the Session component. uberAgent delivers a specific component for companies working with RES Workspace Manager for delivering correct logon performance information.

Also on application level uberAgent provides some cool features. uberAgent combines several process into one application for example the Microsoft Office Suite. Detailed information per process is available in the process component. Within the application part also the Browser Performance is available. Within this you can see per website the resource usage and this makes it possible to find out which website is causing lots of resource usage. uberAgent was one of the first product that has this feature available, currently Internet Explorer and Chrome are support.

Unique is the possibility to show the performance of Outlook Plugins. Also within the application component it is possible to make an inventory of available applications and to show the actual usage of those applications.

Both in the applications as process views it’s possible to show the resource usage, but also the start-up times. This is a good indicator if applications are performing well. I did not find many product that offer that functionality in their monitoring product.

Also pretty unique is the feature offering insights in the communication between the monitored machines and the back-end systems including the amount of data but even more important the latency. This kind of information is available from an application, process or machine view. Dependent of the view the starting point will be an application, process or machine. SBC/VDI admins will love this information as it provides a good indicator where the bottleneck can be found of performance issues, where nowadays the SBC/VDI infrastructure is guilty by default.

The last really cool feature I would like to mention is the so called SBC Sizing and Capacity Planning option. This option shows the peak average usage of the whole infrastructure, providing good insights if and how many overhead your current infrastructure has (or in a bad case that you are using all available resources).

Last thing the timeframe of the views within uberAgent can be configured completely to your needs. There are already a lot of presets available, but you can make your own desired time frame on several ways. I think this option is also pretty unique.

Resource Usage by uberAgent

The uberAgent agent uses 4 MB of diskspace, sends around 65 MB of data per day per agent to the Splunk server. The amount of data is configurable, a time-frame can be configured for each metric. The specific time-frame determines the amount of data captured/send. The agent uses around 0.3 %CPU and 20 MB of RAM according to the supplier. Remember that Splunk licensing is based on the amount of data stored.


uberAgent is really focusing on the front-end infrastructure, especially on SBC/VDI infrastructures. So it’s definitely not a product that can be used to monitor your complete infrastructure. In my opinion uberAgent is not a real monitoring product, but more a product providing detailed information in the usage and resource usage of a SBC/VDI infrastructures. For example alerting is not configured by default and is dependent on the alerting options of Splunk. So uberAgent will be add-on for more insight, besides another full infrastructure monitoring solution.

However uberAgent is a product that really provided added-value information about the SBC/VDI infrastructure that every SBC/VDI admin would love to have. Also the well way of presenting the information including the option to set a time frame fully to your needs makes this product really useful. UberAgent also delivers lots of (almost) unique features like the Outlook plugin performance, application start-up times, network communication insights and the sizing and capacity planning information.

As uberAgent is based on Splunk you should also need to have Splunk into your infrastructure. Splunk offers a free edition with a limitation of 500 MB data per day, for more data Splunk licensing (based on MBs) is required.