If you go to “Netscaler Gateway” and “Monitoring connections” you will see, “Active user sessions” and “ICA Connections”. The former shows users who have authenticated against the gateway, and the latter is those who have an ICA connection open through the gateway. The lists could be different as a user might have timed out on the gateway but still have an ICA connection open.

Active user connection is the user logged on to Netscaler gateway portal and it is still not logged off. After sometime, it shows popup that “your session will logoff in x minutes etc”.  If user’s netscaler gateway session is logged off, you wont see an entry for user’s id in active user connection. ICA connection is the application that user opened and it is still active. If user has closed the app or logged off or disconnected, you wont see user’s id in ICA connection.

To view users on netscaler gateway:

Through GUI:

For active users, goto NetScaler Gateway > Monitoring Connections > Active User Session. This shows the list of active user sessions on the NetScaler Gateway.

For ICA Users, goto  NetScaler Gateway > Monitoring Connections > ICA Session. This shows a list of users who have an ICA connection open through NetScaler Gateway.

Through Netscaler CLI:

Run the following command to view list of active user sessions on the NetScaler Gateway: show aaa session Run the following command to view list of users who have an ICA connection open through NetScaler Gateway: show vpn icaConnection

Current users and total connected users on the virtual server

Current users: Number of users logged on to a specific virtual server. It is recommended that you monitor the current users for tracking CCUs.

Total connected users: Number of users who have one or more active connections through the specific virtual server. The total number of connected users is mostly used in ICA Proxy.

You can use the number of total connected users counter in the following scenarios:

• Consider that an ICA connection is established but no corresponding authentication, authorization, and auditing session are established. In this scenario, a user launches an application or a desktop and closes the browser, continues to work on the launched app or desktop. The authentication, authorization, and auditing session times out but the connection is still active. Total number of connected users can be used to identify the users that are still connected.
• In HDX optimal routing, authentication gateway and ICA gateway can be on different appliances. The total connected users in this case can be used to identify the number of connected users on the ICA gateway.

Points to note:

• Current users exceed total connected users when there are active sessions (not yet timed out) but there are no active connections on these sessions. For example, a user launched an application or a desktop and closed it immediately but did not log out from the authentication, authorization, and auditing session.
• Total connected users exceed current users if authentication, authorization, and auditing sessions timeout but ICA connections are still active.
• In a pure VPN setup (no ICA is involved), the number of current users and total connected users are equal.