Cortex XDR 8.9 Non-Persistent Citrix Servers and Cache Write Issue

[M.Rivera653095]

Hello everyone,

We have encountered and issue where the target servers do not get content updates.  The citrix Windows servers reboot nightly with the golden image configurations but do not receive the latest content updates.  At the same time, around noon we have to reboot the target servers due to write cache filling up to 100%.  Have you encountered similar issues and what did you do to remediate?  Thank you!

[tlmarques]

Do you use brokers?
Are you able to run cytool connectivity_test?

[M.Rivera653095]

Hi Tiago,

We do not use brokers.

Thanks,

Marco

[tlmarques]

When you create the Golden image you did this steps:

• Ensure the agent was installed with the VDI flag: msiexec /i cortexxdr.msi VDI_ENABLED=1.

• Force a content update: Run cytool content update (or check-in via the console).

• Crucial: Run the "Image Prep" scan. This pre-verifies files so the targets don't have to do it live:

  cytool imageprep scan timeout 4 upload 95 path C:\temp\

• Wait for it to finish, then shut down and promote the image.

on agent VDI profile check this:

[M.Rivera653095]

"VDI installation is intended for single-user scenarios, such as full desktop VDI. Temporary Session (TS) installation is best used for multi-user scenarios, such as terminal services."  We use TS not VDI

[R.Swanepoel]

@M.Rivera653095 Did you ever find a solution to this? we are facing a similar issue with our Citrix MCS VDA's where the write cache is filling up very fast. Using procmon we can see that cyserver.exe is constantly writing to C:\ProgramData\Cyvera\*.

We run cytool imageprep scan timeout 4 upload 15 path C:\temp\ as part of our sealing process but it does not help.

[M.Rivera653095]

Hi,

That same issue we were having.  We only had 25gb of free space on the golden image servers.  I was able to resolve by using the vdi option and increasing the space to 50BG then following the scan option....here is the command I used.

XDR installation:

msiexec.exe /i "C:\admin\PACortexXDR-Citrix\Windows-Agent\CHS-Windows-Agent_x64.msi" /l*v "C:\admin\PACortexXDR-Citrix\Windows-Agent\cortexxdrinstall.log" VDI_ENABLED=1 /qn

Scan:

• cd "c:\Program Files\Palo Alto Networks\Traps"
• cytool imageprep scan timeout 4 upload 60 path "C:\admin\PACortexXDR-Citrix\Windows-Agent"

I hope this helps!

[R.Swanepoel]

Ahh okay thanks for the response, I have a support ticket open regarding it as well so let's see what support can suggest.

We are using the same command just a shorted upload time, however I did notice in the output that there are a lot of files that are "in use" so they don't get scanned, is yours the same?
Our disk is currently 30GB so will try increasing to see if it helps.

Ideally Palo would offer a way to redirect the C:\ProgramData\Cyvera to the persistent cache drive so that it does not cause the huge amounts of writes in the first place.