Troubleshoot 编辑

This article provides information to help administrators troubleshoot issues with Citrix Workspace app.

Connection

You might come across the following connection issues.

ICA launch Fedora 29/30

ICA launch might fail on Fedora 29/30. As a workaround, follow the steps:

1. Install compat-openssl10 by using the command.

   sudo yum install compat-openssl10.x86_64

2. Set the environment variable in ~/.bashrc to load for every session. This action points to the older libcrypto library.

   export LD_PRELOAD=/lib64/libcrypto.so.1.0.2o

Note:

Citrix Workspace app works fine in the X.Org server as compared to the Wayland compositor. For distributions that have Wayland as the default graphics protocol, uncomment either of the following:

WaylandEnable=false in /etc/gdm/custom.conf or in /etc/gdm3/custom.conf

Sign out and sign in to point to the X.Org server.

Published resource or desktop session

When establishing a connection to a Windows server, if a dialog box appears with the message “Connecting to server…” but no connection window appears later, you might need to configure the server with a Client Access License (CAL). For more information about licensing, see Licensing.

Session reconnection

The connection might fail when reconnecting to a session with a higher color depth than that the Citrix Workspace app requires. This failure occurs when running out of available memory on the server.

If the reconnection fails, Citrix Workspace app tries to use the original color depth. Otherwise, the server tries to start a new session with the requested color depth, leaving the original session in a disconnected state. The second connection might also fail if there’s still a lack of available memory on the server.

Full Internet name

Citrix recommends that you configure DNS (Domain Name Server) on your network. This configuration enables you to resolve the names of servers to which you want to connect. If you do not have DNS configured, it might not be possible to resolve the server name to an IP address. Instead, you can specify the server by its IP address, rather than by its name. TLS connections require a fully qualified domain name, not an IP address.

Proxy detection failure

If your connection is configured to use automatic proxy detection and you see a “Proxy detection failure: Javascript error” error message when trying to connect, copy the wpad.dat file into $ICAROOT/util. Run the following command, where the host name is the host name of the server to which you’re trying to connect:

cat wpad.dat | ./pacexec pac.js FindProxyForURL <http://hostname> hostname 2\>&1 | grep “undeclared variable”

If you get no output, there’s a serious issue with the wpad.dat file on the server that you need to investigate. However, if you see output such as “assignment to undeclared variable …” you can fix the problem. Open pac.js and for each variable listed in the output, add a line at the top of the file in the following format, where “…” is the variable name.

var ...;

Slow sessions

If a session does not start until you move the mouse, there might be a problem with random number generation in the Linux kernel. As a workaround, run an entropy-generating daemon such as rngd (which is hardware-based) or haveged (from Magic Software).

Cipher suites

If your connection fails with the new cryptographic support:

1. You can use various tools to check the cipher suites that your server support, including:
   • Ssllabs.com (requires the server to have Internet access)
   • sslyze (https://github.com/nabla-c0d3/sslyze)
2. In Linux Client WireShark, find the packet (Client Hello, Server Hello) with the filter (ip.addr == VDAIPAddress) to find the SSL section. The result has the cipher suites sent by the client and accepted by the server.

Incorrect Citrix Optimization SDK

The Citrix Optimization SDK package includes an incorrect version of the UIDialogLibWebKit.so. As a workaround, do the following:

1. Download Citrix Optimization SDK package version 18.10 from the Downloads page.

   1. Go to the path CitrixPluginSDK/UIDialogLib/GTK:

      cd CitrixPluginSDK/UIDialogLib/GTK

   2. Delete all the object files:

      rm -rf *.o

   3. Go to WebKit folder:

      cd ../WebKit

   4. Remove the existing UIDialogLibWebKit.so:

      rm -rf UIDialogLibWebKit.so

   5. Use the following command in the WebKit directory:

      make all

      The new UIDialogLibWebKit.so is generated.

   6. Copy the new library into the $ICAROOT/lib directory.

Weak cipher suites for SSL connections

When making a TLS connection, the Citrix Workspace app offers an advanced and restricted set of cipher suites by default.

If you’re connecting to a server that requires an older cipher suite, set the configuration option SSLCiphers=ALL in the [WFClient] section of a configuration file.

The following advanced cipher suites are supported:

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030), ALL, GOV
• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028), ALL, GOV
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013), ALL, COM

Loss of connection

When using the EDT protocol, you might see the error message: Connection to “…” has been lost. This issue might occur when the connection goes through a router with a Maximum Transmission Unit for EDT that is smaller than the default of 1,500 bytes. Do the following:

• Set edtMSS=1000 in a configuration file.

Connection errors

Connection errors might produce various different error dialogs. Examples are:

• Error in connection: A protocol error occurred while communicating with the Authentication Service
• The Authentication Service cannot be contacted
• Your account cannot be added using this server address

Some problems might cause such errors, including:

• When the local computer and the remote computer can’t negotiate a common TLS protocol. For more information, see TLS.
• When the remote computer requires an older cipher suite for a TLS connection. In this case, you can set the configuration option SSLCiphers=ALL in the \[WFClient\] section of a configuration file and run killall AuthManagerDaemon ServiceRecord selfservice storebrowse before restarting the connection.
• When the remote computer requests a client certificate inappropriately. IIS must only accept or require certificates for Citrix, Authentication, and Certificate.
• Other problems.

Low-bandwidth connections

Citrix recommends that you use the latest version of Citrix Virtual Apps and Desktops or Citrix DaaS (formerly Citrix Virtual Apps and Desktops service) on the server. Also, the use the latest Citrix Workspace app on the user device.

If you’re using a low-bandwidth connection, you can change your Citrix Workspace app configuration and the way you use Citrix Workspace app to improve performance.

• Configure your Citrix Workspace app connection - Configuring your Citrix Workspace app connections can reduce the bandwidth that ICA requires and improves performance
• Change how Citrix Workspace app is used - Changing the way Citrix Workspace app is used can also reduce the bandwidth required for a high-performance connection
• Enable UDP audio - This feature can maintain consistent latency on congested networks in Voice-over-IP (VoIP) connections
• Use the latest versions of Citrix Workspace app for Linux and Citrix Virtual Apps and Desktops or Citrix DaaS - Citrix continually enhances and improves performance with each release, and many performance features require the latest Citrix Workspace app and server software

Display

Screen tearing

Screen tearing occurs when parts of two (or more) different frames appear on the screen at the same time, in horizontal blocks. This issue is most visible with large areas of fast changing content on screen.

Tearing is avoided when data is captured at the VDA. Tearing isn’t introduced when data is passed to the client. However, X11 (the Linux/Unix graphics subsystem) does not provide a consistent way to draw to the screen in a way that prevents tearing.

To prevent screen tearing, Citrix recommends the standard approach which synchronizes application drawing with the drawing of the screen. That is, wait for vsvnc, to start the drawing of the next frame. Depending on the graphics hardware on the client and the window manager you’re using, the following two groups of solutions are available to prevent screen tearing:

• X11 GPU settings
• Use a Composition Manager

X11 GPU Configuration

For Intel HD graphics, create a file in the xorg.conf.d called 20-intel.conf with the following contents:

Section "Device"

 Identifier    "Intel Graphics"
 Driver        "intel"
 Option        "AccelMethod" "sna"
 Option        "TearFree" "true"

 EndSection