Install the Log Server on Windows

Warning:

Docker Desktop on Windows is a user-session-based application. If the user who started Docker Desktop logs out, Docker Desktop stops — and the AOT Log Server container stops with it. For production deployments, use Linux or the Connector Appliance instead. If you must use Windows: keep the session active or in a disconnected state — do not fully log off. Warning:

Running the Log Server on a Windows VM hosted on XenServer® is not supported. XenServer does not support nested virtualization, which prevents Docker from running inside the guest VM.

Prerequisites

• Supported OS: Windows 10, Windows 11, Windows Server 2022, or Windows Server 2025
• CPU: 8 cores minimum
• RAM: 24 GB minimum
• SSD-backed storage strongly recommended
• Docker Desktop installed (Docker Desktop subscription may be required)
• WSL version 2.1.5 or later
• Windows features enabled: Hyper-V, Virtual Machine Platform, Windows Subsystem for Linux
• Docker Desktop memory limit set to ≥ 12 GB
• Chosen port open in firewall rules and not in use
• TLS certificate in .pfx format (for HTTPS mode)

Step 1 — Install and Configure Docker Desktop

On a Windows machine, complete the following prerequisites.

1.1 — Enable Required Windows Features

Open Windows Features (search “Turn Windows features on or off”) and enable: Hyper-V, Virtual Machine Platform, Windows Subsystem for Linux (WSL). Restart if needed.

1.2 — Install Docker Desktop

Download and install Docker Desktop for Windows from Docker’s website.

1.3 — Update WSL and Set Default Version

wsl --update
wsl --set-default-version 2
<!--NeedCopy-->

1.4 — Configure Docker Desktop Memory Limit

Open Docker Desktop → Settings → Resources → set Memory to at least 12 GB → click Apply & Restart.

Step 2 — Download the Installer

Download the Log Server Docker container image and installer (InstallLogServer.exe) from Citrix Downloads. Place all downloaded files in the same directory.

Step 3 — Run the Installer

HTTP mode

InstallLogServer.exe --port 8080
<!--NeedCopy-->

HTTP with custom config and data paths

InstallLogServer.exe --port 8080 --config C:\LogServer\Config --database C:\LogServer\Data
<!--NeedCopy-->

HTTPS mode (recommended)

InstallLogServer.exe --https --cert c:\path\cert.pfx --port 8443
<!--NeedCopy-->

HTTPS with custom config and data paths

InstallLogServer.exe --https --cert c:\path\cert.pfx --port 8443 --config C:\LogServer\Config --database C:\LogServer\Data
<!--NeedCopy-->

Supporting CWA Client Log Uploads (optional)

#To support CWA client uploading AOT logs, some additional parameters need to be added after the install log server command.
--sta-server http://STA_SERVER_FQDN:port --log-server LOG_SERVER_FQDN:PORT
<!--NeedCopy-->

Where,

Note:

These parameters are optional if CWA clients do not need reconnection STA tickets or connect to the Log Server directly without a gateway.

Generated Script Files

After installation, the following scripts are created in the same directory:

• StartLogServer.bat — starts the Log Server container
• GetAuthKey.bat — generates an authentication key
• DownloadLogsByTime.bat — downloads logs by time range
• DownloadLogsByWords.bat — downloads logs by keyword
• ListMachines.bat — lists machines sending logs

Note:

These files can be moved after installation — remember the new location for future configuration use.

Step 4 — Start the Log Server

StartLogServer.bat
<!--NeedCopy-->

Note:

Windows startup can take 1–10 minutes depending on hardware.

Step 5 — Confirm the Log Server Started

Check the web log file at C:\Users\<username>\LogServer\Config\weblogs.txt. Look for:

Now listening on: https://[::]:5000   # HTTPS mode
Now listening on: http://[::]:5000    # HTTP mode
<!--NeedCopy-->

Step 6 — Verify with Ping

https://YourLogServerFQDN:8443/Ping   # HTTPS mode
http://YourLogServerFQDN:8080/Ping    # HTTP mode
<!--NeedCopy-->

Expected: Pong UTC:08/19/2025 01:03:29 Version: 2511.1.6

Note:

• If verification fails, run docker logs logserver or check C:\Users\<username>\LogServer\Config\weblogs.txt for errors.
• Port 8443 and port 8080 are just for reference. Change port to your configured port if not using the default one.

Step 7 — Generate an Authentication Key

Run the generated script to create an authentication key:

GetAuthKey.bat
<!--NeedCopy-->

Store the key securely — you will need it when configuring Web Studio or DaaS in the Configure Components step.

Mutual TLS (Optional — Advanced Security)

mTLS adds certificate-based mutual authentication between the Log Server and each client. Enable it only if your environment requires it.

Mutual TLS (mTLS) provides an additional layer of security between the Log Server and clients (VDA, DDC, StoreFront, CWA). When mTLS is enabled, both the client and the server authenticate each other using certificates issued by your enterprise PKI.

mTLS is useful in environments where:

• Network segments are untrusted or shared
• There is a requirement to authenticate not only the Log Server but also each AOT log client
• Customers want to prevent unauthorized systems from sending log data
• Regulatory or compliance policies require certificate-based authentication

Although mTLS is optional, it enhances security by ensuring that only trusted Citrix components can communicate with the Log Server, and that the Log Server can verify every incoming connection before accepting telemetry data.

Certificate Requirements

Note:

• Skip this Mutual TLS section if you use Citrix Connector Appliance, as it isn’t supported.
• The enterprise-ca.cer file must be imported into the Trusted Root Certification Authorities store on both the Log Server and telemetry clients.
• The aotclient.pfx and logserver.pfx certificates should not be protected by password.
• The subject of aotclient.pfx must be CitrixAOTClient, allowing the telemetry client to automatically locate the certificate during runtime.

Install with mTLS Enabled

InstallLogServer.exe --https --cert logserver.pfx --ca enterprise-ca.cer --port 8443
<!--NeedCopy-->

Configure mTLS on Each Client (DDC, StoreFront, VDA)

If mutual TLS authentication is required, run the following PowerShell command in DDC, Storefront, VDA and other CVAD components with administrator privileges.

# import client cert at the machine aot client
Import-PfxCertificate -CertStoreLocation Cert:\LocalMachine\My\ -FilePath c:\aotclient.pfx

# Verify successful import
Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -like "*AOTclient*" }

# delete temp certificate aotclient.pfx
Remove-Item -Path "C:\aotclient.pfx" -Force
# Ensure LogServer's certificate is trusted on all machines uploading AOT logs.
<!--NeedCopy-->

Grant NETWORK SERVICE Access to the Client Certificate

The telemetry service is running in “network service” account, so it is required to manually grant NETWORK SERVICE full control over the private key of the CitrixAOTClient certificate, using the certlm.msc graphical interface.

1. Press Win + R, type certlm.msc, press Enter.
2. Expand Certificates (Local Computer) → Personal → Certificates.
3. In the right pane, locate the certificate issued to CitrixAOTClient.
4. Right-click → All Tasks → Manage Private Keys.
5. Click Add, type NETWORK SERVICE, click Check Names.
6. Click OK to apply.

If customer supplies self-signed certificates, do as follows:

• On the logserver side, logserver.pfx and aotclient.cer are installed as previously described. The aotclient.cer serves the role of enterprise-ca.cer.
• On the client side, aotclient.pfx and logserver.cer are imported as previously described. The logserver.cer serves the role of enterprise-ca.cer.
• For more information, see Create a new certificate.

Upgrade

Before upgrading, remove the existing container by running:

docker rm -f logserver
<!--NeedCopy-->

1. Download the new installation images and updated executable log server file.
2. Run InstallLogServer.exe with the same arguments as the original installation.
3. When prompted, you may safely delete the current container and images — log data and configurations are saved separately.

Warning:

• To keep the old container, rename and stop it (docker stop logserver) before upgrading.
• Never run both old and new containers simultaneously with the same --data path — doing so will corrupt log data.
• After upgrading, use the newly generated scripts to start the Log Server.

Note:

This step is not required for Connector Appliance, as updates are managed automatically by Citrix.

Uninstall

docker rm -f logserver
docker rmi logserver

# List containers and images to make sure

docker ps -a
docker images

# Delete Log Server config and data files if not needed any more, change ~/LogServer to real installed path if not installed with the default one

Remove-Item -Recurse -Force ~/LogServer
<!--NeedCopy-->