Root cause analysis conducted directly at the workplace after the central monitoring system had reported no anomalies for months.
Symptom
A customer in the banking sector reported significant performance issues with its Citrix infrastructure. More than 200 workstations were affected.
The effect was most noticeable when scrolling through lengthy documents. In PDF files as well as in Excel spreadsheets, once a scrolling motion began, it continued even though the input had long since ended, and it was nearly impossible to stop it in a controlled manner.
The IT department’s key performance indicators consistently showed normal readings. They were monitoring the resource utilization of the Citrix servers and network components, but not what was actually reaching the workstations. As a result, there was no way to pinpoint the issue, and the problem persisted for months.
Analysis
Ceterion did not begin the investigation at the data center, but rather directly at the workstations of the affected users. There, the behavior was reproducible.
The key factor was the chain of events: it wasn’t that the application was responding slowly, but rather that the ICA packets were arriving at the session with a delay and were subsequently processed in batches. This pointed to a delay in the transmission path, not a resource issue. Scrolling makes this effect visible first because it generates a high screen refresh rate and is therefore more sensitive to delayed transmission than other interactions. The fact that PDF and Excel were equally affected confirmed that the cause did not lie with any specific application.
The investigation led to two traffic-shaping appliances designed to optimize data traffic between the locations. They dated back to a time when bandwidths were significantly lower. After the lines were upgraded, the optimization was not only unnecessary but also counterproductive: the rules set caused Citrix traffic to be throttled against a bandwidth limit that, in fact, no longer existed.
The analysis took three days.
Implementation
To verify this, the shaping was temporarily deactivated as part of a controlled change. The effect disappeared immediately, thus confirming the cause.
The long-term solution deliberately does not involve shutting down the systems. The policy has been adjusted, and ICA traffic has been exempted from shaping. Prioritization and optimization for all other types of traffic thus remain in place. Both steps were implemented as a regular change with a defined rollback.
Outcome
- more than 200 jobs made redundant
- 3 days from the time the request was made to identifying the root cause
- Months of fruitless troubleshooting have come to an end
Citrix applications could be used reliably again immediately after the migration.
This case illustrates a pattern we encounter regularly: Good metrics in central monitoring do not mean that users can actually work. The measurements reflect what the servers and network components report, not what appears on the screen.