Install the Log Server on Linux

Prerequisites

• Supported OS: Ubuntu 24.04 or RHEL 8.10 / 9.4
• CPU: 4 cores minimum
• RAM: 16 GB minimum
• SSD-backed storage strongly recommended
• Docker Engine for Linux installed
• User can run Docker commands without sudo
• Chosen port is open in firewall rules and not in use
• TLS certificate in .pfx format (for HTTPS mode)

Step 1 — Download the Installer

Download the Log Server Docker container image and installer from Citrix Downloads. Place all downloaded files in the same directory.

Step 2 — Make the Installer Executable

chmod +x ./InstallLogServer
<!--NeedCopy-->

Step 3 — Run the Installer

HTTPS mode (recommended)

./InstallLogServer --https --cert </path/to/your_cert.pfx> --port 8443
<!--NeedCopy-->

HTTP mode

./InstallLogServer --port 8080
<!--NeedCopy-->

HTTP with custom config and data paths

./InstallLogServer --port 8080 --config /Path/LogServer/Config --database /Path/LogServer/Data
<!--NeedCopy-->

HTTPS with custom config and data paths

./InstallLogServer --https --cert </path/to/your_cert.pfx> --port 8443 --config /path/to/LogServer/Config --database /path/to/LogServer/Data
<!--NeedCopy-->

Supporting CWA Client Log Uploads (optional)

#To support CWA client uploading AOT logs, some additional parameters need to be added after the install log server command.
--sta-server http://STA_SERVER_FQDN:port --log-server LOG_SERVER_FQDN:PORT
<!--NeedCopy-->

Where,

Note:

These parameters are optional if CWA clients do not need reconnection STA tickets or connect to the Log Server directly without a gateway.

Generated Script Files

After installation, the following scripts are created in the same directory:

• StartLogServer.sh — starts the Log Server container
• GetAuthKey.sh — generates an authentication key
• DownloadLogsByTime.sh — downloads logs by time range
• DownloadLogsByWords.sh — downloads logs by keyword
• ListMachines.sh — lists machines sending logs

Step 4 — Start the Log Server

./StartLogServer.sh
<!--NeedCopy-->

Note:

Linux startup typically takes 30–60 seconds.

Step 5 — Confirm the Log Server Started

cat $HOME/LogServer/Config/weblogs.txt
<!--NeedCopy-->

Look for:

Now listening on https://[::]:5000   # HTTPS mode
Now listening on http://[::]:5000    # HTTP mode
<!--NeedCopy-->

Warning:

If the Log Server runs in HTTPS mode, its certificate must be trusted on all machines uploading AOT logs. Install the certificate on each component’s Trusted Root Certification Authorities store.

Step 6 — Verify with Ping

https://YourLogServerFQDN:8443/Ping   # HTTPS mode
http://YourLogServerFQDN:8080/Ping    # HTTP mode
<!--NeedCopy-->

Expected: Pong UTC:08/19/2025 01:03:29 Version: 2511.1.6

Note:

• If verification fails, run docker logs logserver or check $HOME/LogServer/Config/weblogs.txt for errors.
• Port 8443 and port 8080 are just for reference. Change port to your configured port if not using the default one.

Step 7 — Generate an Authentication Key

Run the generated script to create an authentication key:

./GetAuthKey.sh
<!--NeedCopy-->

Store the key securely — you will need it when configuring Web Studio or DaaS in the Configure Components step.

Mutual TLS (Optional — Advanced Security)

mTLS adds certificate-based mutual authentication between the Log Server and each client. Enable it only if your environment requires it.

Mutual TLS (mTLS) provides an additional layer of security between the Log Server and clients (VDA, DDC, StoreFront, CWA). When mTLS is enabled, both the client and the server authenticate each other using certificates issued by your enterprise PKI.

mTLS is useful in environments where:

• Network segments are untrusted or shared
• There is a requirement to authenticate not only the Log Server but also each AOT log client
• Customers want to prevent unauthorized systems from sending log data
• Regulatory or compliance policies require certificate-based authentication

Although mTLS is optional, it enhances security by ensuring that only trusted Citrix components can communicate with the Log Server, and that the Log Server can verify every incoming connection before accepting telemetry data.

Certificate Requirements

Note:

• Skip this Mutual TLS section if you use Citrix Connector Appliance, as it isn’t supported.
• The enterprise-ca.cer file must be imported into the Trusted Root Certification Authorities store on both the Log Server and telemetry clients.
• The aotclient.pfx and logserver.pfx certificates should not be protected by password.
• The subject of aotclient.pfx must be CitrixAOTClient, allowing the telemetry client to automatically locate the certificate during runtime.

Install with mTLS Enabled

./InstallLogServer --https --cert logserver.pfx --ca enterprise-ca.cer --port 8443

# with customized path
./InstallLogServer --config /YourPath/LogServer/Config --database /YourPath/LogServer/Data --cert /YourPath/logserver.pfx --ca /YourPath/enterprise-ca.cer --port 8443
<!--NeedCopy-->

Secure the Certificate Files

# delete temp certificate logserver.pfx in current install directory
sudo rm -rf /YourPath/logserver.pfx

# keep logserver.pfx accessed only by the container process user 'ubuntu'.
sudo chmod 400 LogServer/Config/logserver.pfx
sudo chown ubuntu:ubuntu LogServer/Config/logserver.pfx
<!--NeedCopy-->

Configure mTLS on Each Client (DDC, StoreFront, VDA)

If mutual TLS authentication is required, run the following PowerShell command in DDC, Storefront, VDA and other CVAD components with administrator privileges.

# import client cert at the machine aot client
Import-PfxCertificate -CertStoreLocation Cert:\LocalMachine\My\ -FilePath c:\aotclient.pfx

# Verify successful import
Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -like "*AOTclient*" }

# delete temp certificate aotclient.pfx
Remove-Item -Path "C:\aotclient.pfx" -Force
# Ensure LogServer's certificate is trusted on all machines uploading AOT logs.
<!--NeedCopy-->

Grant NETWORK SERVICE Access to the Client Certificate

The telemetry service is running in “network service” account, so it is required to manually grant NETWORK SERVICE full control over the private key of the CitrixAOTClient certificate, using the certlm.msc graphical interface.

1. Press Win + R, type certlm.msc, press Enter.
2. Expand Certificates (Local Computer) → Personal → Certificates.
3. In the right pane, locate the certificate issued to CitrixAOTClient.
4. Right-click → All Tasks → Manage Private Keys.
5. Click Add, type NETWORK SERVICE, click Check Names.
6. Click OK to apply.

If customer supplies self-signed certificates, do as follows:

• On the logserver side, logserver.pfx and aotclient.cer are installed as previously described. The aotclient.cer serves the role of enterprise-ca.cer.
• On the client side, aotclient.pfx and logserver.cer are imported as previously described. The logserver.cer serves the role of enterprise-ca.cer.
• For more information, see Create a new certificate.

Upgrade

Before upgrading, remove the existing container by running:

docker rm -f logserver
<!--NeedCopy-->

1. Download the new installation images and updated executable log server file.
2. Run InstallLogServer with the same arguments as the original installation.
3. When prompted, you may safely delete the current container and images — log data and configurations are saved separately.

Warning:

• To keep the old container, rename and stop it (docker stop logserver) before upgrading.
• Never run both old and new containers simultaneously with the same --data path — doing so will corrupt log data.
• After upgrading, use the newly generated scripts to start the Log Server.

Note:

This step is not required for Connector Appliance, as updates are managed automatically by Citrix.

Uninstall

docker rm -f logserver
docker rmi logserver

# List containers and images to make sure

docker ps -a
docker images

# Delete Log Server config and data files if not needed any more, change $HOME/LogServer to real installed path if not installed with the default one

rm -r $HOME/LogServer
<!--NeedCopy-->