Troubleshooting

This article provides information to help administrators troubleshoot issues with Citrix Workspace app.

Connection

You might come across the following connection issues.

Published resource or desktop session

When establishing a connection to a Windows server, if a dialog box appears with the message “Connecting to server…” but no connection window appears later, you might need to configure the server with a Client Access License (CAL). For more information about licensing, see Licensing.

Session reconnection

The connection might fail when reconnecting to a session with a higher color depth than that the Citrix Workspace app requires. This failure occurs when running out of available memory on the server.

If the reconnection fails, Citrix Workspace app tries to use the original color depth. Otherwise, the server tries to start a new session with the requested color depth, leaving the original session in a disconnected state. The second connection might also fail if there’s still a lack of available memory on the server.

Full Internet name

Citrix recommends that you configure DNS (Domain Name Server) on your network. This configuration enables you to resolve the names of servers to which you want to connect. If you do not have DNS configured, it might not be possible to resolve the server name to an IP address. Instead, you can specify the server by its IP address, rather than by its name. TLS connections require a fully qualified domain name, not an IP address.

Slow sessions

If a session does not start until you move the mouse, there might be a problem with random number generation in the Linux kernel. As a workaround, run an entropy-generating daemon such as rngd (which is hardware-based) or haveged (from Magic Software).

Send feedback on Citrix Workspace app

The Send Feedback option allows you to inform Cloud Software Group about any issues that you might run into while using Citrix Workspace app. You can also send suggestions to help us improve your Citrix Workspace app experience.

This new feature enhances the feedback experience, ensuring a more efficient and informative communication channel between users and support teams.

The Send Feedback option includes an integrated log manager, empowering users to capture and include relevant logs for a comprehensive feedback report.

Also, the Send Feedback provides seamless communication by enabling users to send feedback emails directly using the default mail client installed on their system.

The supported email clients are the following:

To configure email address for send feedback, do the following:

Add the following key in the Authmanconfig.xml file:

 cwa-linux-feedback@cloud.com SendFeedbackEnabled true 

Note:

By sending your feedback to Cloud Software Group, you agree your participation is in accordance with and subject to the Cloud software Group End User Agreement.

You can send feedback using any one of the following methods:

Add account

  1. Navigate to the Add Account screen.
  2. Click the hamburger menu.
  3. Click Send Feedback.

App Indicator

  1. Click Send Feedback in the App indicator icon.

  1. At the command-line, navigate to the /opt/Citrix/ICAClient/util path.
  2. Run the following command:

./sendfeedback

  • The Send Feedback screen appears. Send feedback
  • Provide the issue Title.
  • Add issue details in the Tell us more field.
  • Click Capture my issue. The Citrix Log Collection Utility screen appears. Log collection utilityClick Start capture and then reproduce the issue to collect the latest logs. Or, Click Choose existing logs if you are not able to reproduce the issue.

    Note: For more information on the Citrix Log Collection Utility, see Log Collection.

  • Ensure that the log files are displayed next to Capture my issue.
  • Click Choose Files and then add attachments that describe your issues such as screenshots or screen recordings. Submit feedback complete
  • Click Send. The Feedback report screen appears. send-feedback-reportThe .tar.gz file contains the log files, the issue description as test files, and the attachments.
  • You can send the feedback report to Citrix using the following options: Click Send the feedback report using the default email app to use the default mail app in your system. Or, Send the report manually to the provided email ID.
  • Note:

    Ensure that the .zip file is attached in the email.

    Cipher suites

    If your connection fails with the new cryptographic support:

    1. You can use various tools to check the cipher suites that your server support, including:
    2. In Linux Client WireShark, find the packet (Client Hello, Server Hello) with the filter (ip.addr == VDAIPAddress ) to find the SSL section. The result has the cipher suites sent by the client and accepted by the server.

    Incorrect Citrix Optimization SDK

    The Citrix Optimization SDK package includes an incorrect version of the UIDialogLibWebKit.so . As a workaround, do the following:

    1. Download Citrix Optimization SDK package version 18.10 from the Downloads page.
      1. Go to the path CitrixPluginSDK/UIDialogLib/GTK : cd CitrixPluginSDK/UIDialogLib/GTK
      2. Delete all the object files: rm -rf *.o
      3. Go to the WebKit folder: cd ../WebKit
      4. Remove the existing UIDialogLibWebKit.so : rm -rf UIDialogLibWebKit.so
      5. Use the following command in the WebKit directory: make all The new UIDialogLibWebKit.so is generated.
      6. Copy the new library into the $ICAROOT/lib directory.

      Weak cipher suites for SSL connections

      When making a TLS connection, the Citrix Workspace app offers an advanced and restricted set of cipher suites by default.

      If you’re connecting to a server that requires an older cipher suite, set the configuration option SSLCiphers=ALL in the [WFClient] section of a configuration file.

      The following advanced cipher suites are supported:

      Loss of connection

      When using the EDT protocol, you might see the error message: Connection to “…” has been lost. This issue might occur when the connection goes through a router with a Maximum Transmission Unit for EDT that is smaller than the default of 1,500 bytes. Do the following:

      Connection errors

      Connection errors might produce various different error dialogs. Examples are:

      Some problems might cause such errors, including:

      Low-bandwidth connections

      Citrix recommends you use the latest version of Citrix Virtual Apps and Desktops or Citrix DaaS (formerly Citrix Virtual Apps and Desktops service) on the server. Also, the use the latest Citrix Workspace app on the user device.

      If you’re using a low-bandwidth connection, you can change your Citrix Workspace app configuration and the way you use Citrix Workspace app to improve performance.

      Display

      Screen tearing

      Screen tearing occurs when parts of two (or more) different frames appear on the screen at the same time, in horizontal blocks. This issue is most visible with large areas of fast changing content on screen.

      Tearing is avoided when data is captured at the VDA. Tearing isn’t introduced when data is passed to the client. However, X11 (the Linux/Unix graphics subsystem) does not provide a consistent way to draw to the screen in a way that prevents tearing.

      To prevent screen tearing, Citrix recommends the standard approach which synchronizes application drawing with the drawing of the screen. That is, wait for vsvnc , to start the drawing of the next frame. Depending on the graphics hardware on the client and the window manager you’re using, the following two groups of solutions are available to prevent screen tearing:

      X11 GPU Configuration

      For Intel HD graphics, create a file in the xorg.conf.d called 20-intel.conf with the following contents:

      Section "Device" Identifier "Intel Graphics" Driver "intel" Option "AccelMethod" "sna" Option "TearFree" "true" EndSection 

      For NVIDIA graphics, locate the file in the xorg.conf.d folder that includes the “MetaModes” Option for your configuration. For each comma-separated MetaMode used add the following:

      Note:

      Different Linux distributions use different paths to xorg.conf.d, for example, /etc/X11/xorg.conf.d, or, /user/share/X11/xorg.conf.d.

      Composition managers

      Use the following:

      Note:

      Use “CompizConfig Settings Manager” with caution because incorrectly changing values can prevent the system from launching.

      Incorrect keystrokes

      If you’re using a non-English language keyboard, the screen display might not match the keyboard input. In this case, you must specify the keyboard type and layout that you’re using. For more information about specifying keyboards, see Control keyboard behavior.

      Excessive redrawing

      Some window managers continuously report the new window position when moving seamless windows, which can result in excessive redrawing. To fix this problem, switch the window manager to a mode that draws only window outlines when moving a window.

      Icon compatibility

      The Citrix Workspace app creates window icons that are compatible with most window managers. However, these icons aren’t fully compatible with the X Inter-Client Communication Convention.

      Full icon compatibility

      To provide full icon compatibility:

      1. Open the wfclient.ini configuration file.
      2. Edit the following line in the [WFClient] section: UseIconWindow=True
      3. Save and close the file.

      Cursor color

      The cursor can be difficult to see if it’s the same or similar in color to the background. You can fix this issue by forcing areas of the cursor to be black or white.

      To change the color of the cursor

      1. Open the wfclient.ini configuration file.
      2. Add one of the following lines to the [WFClient] section: CursorStipple=ffff,ffff (to make the cursor black) CursorStipple=0,0 (to make the cursor white)
      3. Save and close the file.

      Color flash

      When you move the mouse into or out of a connection window, the colors in the non-focused window start to flash. This issue is a known limitation when using the X Windows System with PseudoColor displays. If possible, use a higher color depth for the affected connection.

      Color changes with TrueColor display

      You have the option of using 256 colors when connecting to a server. This option assumes that the video hardware has palette support to enable applications to change the palate colors to produce animated displays.

      TrueColor displays have no facility to emulate the ability to produce animations by rapidly changing the palette. Software emulation of this facility is expensive for time and network traffic. To reduce this cost, Citrix Workspace app buffers rapid palette changes, and updates the real palette only every few seconds.

      Incorrect display

      Citrix Workspace app uses EUC-JP or UTF-8 character encoding for Japanese characters, while the server uses SJIS character encoding. Citrix Workspace app does not translate between these character sets. This issue can cause problems displaying:

      This issue also affects Japanese characters in parameters used in extended parameter passing.

      Session span

      Full-screen sessions span all monitors by default, but a command-line multi-monitor display control option, -span, is also available. It allows full-screen sessions to span extra monitors.

      Desktop Viewer toolbar functionality allows you to switch a session between windowed and full-screen session window, including multi-monitor support for the intersected monitors.

      Important:

      Span has no effect on Seamless or normal windowed sessions (including those sessions in maximized windows).

      The - span option has the following format: -span [h][o][a|mon1[,mon2[,mon3, mon4]]]

      If h is specified, a list of monitors is printed on stdout . If h is the whole option value, wfica exits.

      If o is specified, the session window has the override-redirect attribute.

      Caution:

      If a is specified, Citrix Workspace app tries to create a session that covers all monitors.

      Citrix Workspace app assumes that the rest of the -span option value is a list of monitor numbers:

      Assuming o wasn’t specified, wfica uses the _NET_WM_FULLSCREEN_MONITORS message to request an appropriate window layout from the window manager, if it’s supported. Otherwise, it uses size and position hints to request the desired layout.

      The following command can be used to test for window manager support: xprop -root | grep \_NET\_WM\_FULLSCREEN\_MONITORS

      If there’s no output, there’s no support. If there’s no support, you might need an override-redirect window. You can set up an override-redirect window using -span o .

      To make a session that spans extra monitors from the command line:

      1. At a command prompt, type: /opt/Citrix/ICAClient/wfica -span h A list of the numbers of the monitors currently connected to the user device is printed to stdout and wfica exits.
      2. Make a note of these monitor numbers.
      3. At a command prompt, type: /opt/Citrix/ICAClient/wfica -span \[w\[,x\[,y,z\]\]\] The w, x, y, and z values are monitor numbers from step 1 of the preceding steps. The single value w, specifies a specific monitor. Two values w and x specify monitors at the top-left and bottom-right corners of the required area.Four values w, x, y, and z specify monitors at the top, bottom, left, and right edges of the area.

      Local applications

      You might not escape from a full-screen session to use local applications or another session. This issue occurs because the client-side system UI is hidden and the Keyboard Transparency feature disables the usual keyboard command, for example Alt+Tab, sending the command to the server instead.

      As a workaround, use CTRL+F2 to clear the Keyboard Transparency feature temporarily until the focus next returns to the session window. An alternative workaround is to set TransparentKeyPassthrough to No in $ICAROOT/config/module.ini. This workaround disables the Keyboard Transparency feature. However, you might have to override the ICA file by adding this setting in the All_regions.ini file.

      Improved error messages

      Previously all error messages were having a default error code and a description that isn’t specific to the error. Starting with Citrix Workspace app version 2309, the error messages are improved to include the Error code, Transaction ID, and Description fields specific to the error. These error messages appear when a session starts using ICA launch or when a session starts with the Service Continuity feature enabled.

      For example, if there’s a session launch failure, the following error message is displayed:

      Session launch failure

      Webcam

      Updating the default webcam

      Currently, webcam redirection in Citrix Workspace app for Linux supports only one webcam at a time. The default webcam selected is mapped to the device path /dev/video0 which is, generally, the built-in webcam in laptops.

      To list all devices with video capabilities in the system, you must install v4l tools using the following command:

      sudo apt-get install v4l-utils

      List the video devices using the following command:

      v4l2-ctl --list-devices

      You might receive an output as follows:

      user@user-pc:~ $ v4l2-ctl --list-devices UVC Camera (046d:09a6) (usb-0000:00:14.0-1): /dev/video2 /dev/video3 /dev/media1 Integrated Camera: Integrated C (usb-0000:00:14.0-8): /dev/video0 /dev/video1 /dev/media0

      As per the preceding example, there are two webcams. You can use any of them. Citrix recommends using the first index. There’s a known issue with Ubuntu, so that you might see multiple indexes for one webcam. In this example, you can use /dev/video0 and /dev/video2.

      To set another capture video as default, do the following:

      1. Navigate to the ~/.ICAClient/wfclient.ini configuration file and edit it.
      2. In the [WFClient] section, add the following setting. HDXWebCamDevice=

      For example, add HDXWebCamDevice=/dev/video2 to set the webcam mapped to /dev/video2 in a system.

      Testing capabilities

      On the client, the webcam redirection module can be used in different modes to test isolated components under customer environment conditions.

      Production and debug mode

      This mode compares the video displaying on the VDA side and the actual buffers that the encoder produces on the client side. It allows to test the entire pipeline.

      To enable this mode:

      1. Navigate to the ~/.ICAClient/wfclient.ini configuration file and edit it.
      2. Set the HDXWebcamDebug value to True. HDXWebcamDebug=True

      After this mode is enabled, the encoder generates the following files with the buffers, depending on the encoder used:

      The following diagram describes the production and debug modes:

      Image of production and debug mode

      Webcam tester mode

      This mode allows you to test the webcam isolated from the rest of the pipeline elements.

      ./gst_read --buffers | -b BUFFERS_AMOUNT [ --input_device | -i WEBCAM_DEVICE; default=/dev/video0]

      To enable to webcam tester mode, run the following commands from the command lines:

       cd /opt/Citrix/ICAClient/util
       `$./gst_read -b 100 /dev/video0

      After this mode is enabled, a video preview appears and creates the following file with the raw buffers from the webcam:

      The only switch required for webcam tester mode is the --buffers (-b) options. You can also specify the webcam device to test. For example, see the following:

      The following diagram describes the webcam tester mode:

      Image of webcam tester mode

      Encoder tester mode

      This mode allows you to test the encoder isolated from the pipeline.

      ./gst_read --output_file | -o FILE_NAME [ --buffers | -b BUFFER_AMOUNT; default=10 0 ] [ --enableH264 | -e ]

      To enable the encoder tester mode, run the following commands from the command lines:

      cd /opt/Citrix/ICAClient/util
      ./gst_read -o ~/file_buffers.h264 -e

      The only switch required for this mode is the --output_file (-o) options. You can also test Theora or H264 encoders and the amount of buffer to generate. For example, see the following:

      The following diagram describes the encoder tester mode:

      Image of encoder tester mode

      H264 software encoder

      If the software-based H264 encoder does not work correctly, you must verify its dependencies using the following steps:

        Verify if the x264 GStreamer plug-in is in the system as part of gstreamer-plugins-ugly . If it’s available in the libgstx264.so library, run the following command to verify it:

      gst-inspect-1.0 x264

      Image of x264 `GStreamer` verification

      Run the following command to verify the dependencies of the libgstx264.so library:

      ldd /usr/lib/x86_64-linux-gnu/gstreamer-1.0/libgstx264.so

      Image of libgstx264.so library verification

    If the libgstx264.so file isn’t present, you must install GStreamer plugins ugly using the following command:

    sudo apt-get install gstreamer1 0-plugins-ugly

    H264 hardware encoder

    1. Verify vaapi GStreamer plug-in is in the system as part of gstreamer1.0-vaapi . If it’s available in the libgstvaapi.so library, run the following command to verify it:
    gst-inspect-1.0 vaapi

    Image of `vaapi GStreamer` verification

    Run the following command to verify the dependencies of the libgstvaapi.so library:

     ldd /usr/lib/x86_64-linux-gnu/gstreamer-1.0/libgstvaapi.so

    Image of libgstvaapi.so library verification

  • Resolve any missing dependencies.
  • To install and configure vaapi , follow the GStreamer vappi installation guide.

    Collect internal GStreamer frameworks and gst_read logs

    Alternative to regular ICAClient logs, you must collect the logs from the gst_read module.

    Do the following to collect the logs:

      Open a terminal and run the following commands:

    export GST_DEBUG=2, gst_read_debug:6
    export GST_DEBUG_FILE=~/gst_read.log

    Note: This variable sets the level of log collection and the file to store them. In this case, we’re setting level 2 for the GStreamer framework and level 7 for the gst_read module. For more information, see the document. It’s recommended only to set error and warning levels for the internal GStreamer framework and log level for gst_read .

    cd /opt/Citrix/ICAClient
    ./wfica /vda.ica

    The gst_read.log file is generated with the internal GStreamer framework and the gst_read logs.

    GStreamer pipeline inspections

    To see the actual pipelines that the GStreamer framework is creating, do the following:

    1. Create a folder to store the dot files, for example: gstIntPipes .
    2. Open a terminal and export GST_DEBUG_DUMP_DOT_DIR=/gstIntPipes . This variable indicates to the GStreamer where to store the dot files.
    3. Download an ICA file of a valid VDA.
    4. On the same terminal, run the following commands to start a VDA session:

    cd /opt/Citrix/ICAClient/
    ./wfica /vda.ica

    Image of dot file

  • The directory gstIntPipes includes the dot files. GStreamer generates a dot file for every state change in the pipeline. As a result, you can inspect all the processes of the pipeline creation. The following is an example of the set of dot files:
  • Install a dot file utility to see a visual representation of the pipelines. For example, Graphviz. The following images are examples of good and bad creation of the pipeline:
  • Pipeline successfully created:

    Image of pipeline successfully linked

    Pipeline unable to link:

    Image of pipeline unable to link

    Note:

    To enlarge the preceding images or any other images, right-click the image, select Open image in new tab, and zoom the browser as required.

    As shown in the preceding image, the second pipeline is unable to link the GstCapsFilter element and the GstVaapiEncodeH264 element. The capabilities are never fully negotiated. For more information, see the document.

    System diagnostic script for RAVE

    We provide a script, rave_troubleshooting.sh to verify whether the system configuration and dependencies are suitable to support Remote Audio Video Extensions (RAVE).

    Note:

    RAVE is an HDX feature to support optimized webcam redirection and Windows Media Player redirection for Citrix VDAs.

    Do the following to run the script:

    1. Click rave_troubleshooting.sh to download the script.
    2. Open the terminal in your Linux machine.
    3. Type rave_troubleshooting.sh --help or rave_troubleshooting.sh -h to see the supporting command line arguments.
    4. Type one of the following:

    The system configuration and dependencies are displayed.

    Generic USB redirection

    How to redirect Android phones as generic USB

    You can redirect Android phones as generic USB as follows:

    1. Connect your Android phone to the system where Citrix Workspace app for Linux is installed using a USB cable.
    2. Select USB connection mode (MTP or PTP) on your phone. For most Android phones, the supported mode is PTP.
    3. Type the following in the terminal to get your Android phone’s vendor ID from the device descriptor (VID) and product ID from the device descriptor (PID):

    lsusb
    CONNECT vid=18d1 pid=4ee2 split=01 intf=00

    Browser

    Local browser

    When you click a link in a Windows session, the content appears in a local browser. Server-client content redirection is enabled in wfclient.ini. This redirection causes a local application to run. To disable server-client content redirection, see server-client content redirection.

    Access published resources

    When you access published resources, your browser prompts to save a file. Browsers other than Firefox and Chrome might require configuration before you can connect to a published resource. However, when trying to access a resource by clicking an icon on the page, your browser prompts you to save the ICA file.

    Specific browser

    If you have problems using a specific web browser, set the environment variable BROWSER to specify the local path and name of the required browser before running setupwfc .

    Firefox browser

    When you launch desktops or applications in Firefox, if a page is unresponsive, try enabling the ICA plug-in.

    ICA plug-in in Firefox

    When the ICA plug-in is enabled in Firefox, desktop and application sessions might not start. In this case, try disabling the ICA plug-in.

    Configuration errors

    These errors might occur if you configured a connection entry incorrectly.

    E_MISSING_INI_SECTION - Verify the configuration file: “…”. The section “…” is missing in the configuration file.

    The configuration file was incorrectly edited or is corrupt.

    E_MISSING_INI_ENTRY - Verify the configuration file: “…”. The section “…” must contain an entry “…”.

    The configuration file was incorrectly edited or is corrupt.

    E_INI_VENDOR_RANGE - Verify the configuration file: “…”. The X server vendor range “…” in the configuration file is invalid.

    The X Server vendor information in the configuration file is corrupt. Contact Citrix.

    wfclient.ini configuration errors

    These errors might occur if you edited wfclient.ini incorrectly.

    E\_CANNOT\_WRITE\_FILE - Cannot write file: ". "

    There was a problem saving the connection database; for example, no disk space.

    E\_CANNOT\_CREATE\_FILE - Cannot create file: ". "

    There was a problem creating a connection database.

    E_PNAGENT_FILE_UNREADABLE - Cannot read Citrix Virtual Apps file “…”: No such file or directory.

    Cannot read Citrix Virtual Apps file “…”: Permission denied.

    You’re trying to access a resource through a desktop item or menu, but the Citrix Virtual Apps and Desktops or Citrix DaaS file for the resource isn’t available. Refresh the list of published resources by selecting Application Refresh on the View menu, and try to access the resource again. If the error persists:

    Browser Content Redirection

    For information on how to troubleshoot Browser Content Redirection, see the Knowledge Center article CTX230052.

    How to import self-signed certificate into nssdb

    Run the following command in the terminal to import the self-signed certificate into nssdb :

    certutil -A -n "badssl.cer" -t "C,," -d ~/.pki/nssdb -i ~/Downloads/badssl.cer

    The arguments in the commands are:

    For information about BCR, see the Browser content redirection page in the Citrix Virtual Apps and Desktops documentation.

    Others

    Connection issues

    You might also find the following issues.

    Close a session

    To know whether the server has instructed Citrix Workspace app to close a session, use the wfica program. This program logs when it has received a command to terminate the session from the server.

    To record this information through the syslog system, add SyslogThreshold with the value 6 to the [WFClient] section of the configuration file. This setting enables the logging of messages that have a priority of LOG_INFO or higher. The default value for SyslogThreshold is 4 (=LOG_WARNING).

    Similarly, to have wfica , send the information to standard error and add PrintLogThreshold with the value 6 to the [WFClient] section. The default value for PrintLogThreshold is 0 (=LOG_EMERG).

    For more information on log collection, see Log collection and for more information on syslog configuration, see syslog configuration.

    Configuration file settings

    For each entry in wfclient.ini, there must be a corresponding entry in All_Regions.ini for the setting to take effect. Also, for each entry in the [Thinwire3.0], [ClientDrive], and [TCP/IP] sections of wfclient.ini, there must be a corresponding entry in canonicalization.ini for the setting to take effect. See the All_Regions.ini and canonicalization.ini files in the $ICAROOT/config directory for more information.

    Published applications

    If you have issues running published applications that access a serial port, the application might fail (with or without an error message, depending on the application itself) if the port has been locked by another application. In such circumstances, check that there are no applications that have either temporarily locked the serial port or have locked the serial port and exited without releasing it.

    To overcome this problem, stop the application that is blocking the serial port. Regarding UUCP-style locks, there might be a lock file left behind after the application exits. The location of these lock files depends on the operating system used.

    Starting Citrix Workspace app

    If Citrix Workspace app does not start, the error message “Application default file could not be found or is out of date” appears. The reason might be that the environment variable ICAROOT isn’t defined correctly. This variable is a requirement if you installed Citrix Workspace app to a non-default location. To overcome this problem, Citrix recommends that you do one of the following:

    Citrix CryptoKit (formerly SSLSDK)

    To find the Citrix CryptoKit (formerly SSLSDK) or OpenSSL version number that you’re running, you can use the following command: strings libctxssl.so | grep "Citrix SSLSDK"

    You can also run this command on AuthManagerDaemon or PrimaryAuthManager

    Keyboard shortcuts

    If your window manager uses the same key combinations to provide native functionality, your key combinations might not function correctly. For example, the KDE window manager uses the combinations from CTRL+SHIFT+F1 to CTRL+SHIFT+F4 to switch between desktops 13 to 16. If you experience this problem, try the following solutions: