Plan Your Deployment
Complete this page before touching the Log Server installer. The decisions you make here — platform, sizing, storage — affect everything downstream.
Step 1 — Choose a Deployment Platform
| Platform | Recommended For | Key Constraint |
|---|---|---|
| Citrix Connector Appliance | Most environments | Port 443 only; no Docker management needed |
| Linux VM | Production deployments | Best reliability; runs without user session |
| Windows VM | When Linux is not available | Requires active user session; Docker Desktop license needed |
Tip:
Use the Connector Appliance if you have one in your environment. Log Server updates are delivered automatically with Connector Appliance upgrades — no manual Docker pull required. Tip:
If you are on-premises and do not already use a Connector Appliance, you can still deploy one solely as a dedicated Log Server — no Windows or Linux OS license required. The Connector Appliance can run alongside your existing Cloud Connector and serve the AOT Log Server function for your on-premises environment. Warning:
Do not deploy on a Windows VM hosted on XenServer®. XenServer does not support nested virtualization, which prevents Docker from running.
Step 2 — Check Minimum Version Requirements
Citrix Workspace App
| Platform | Minimum Version (Direct Access) | Minimum Version (via Gateway) |
|---|---|---|
| Windows | 2511.10 and 2507 CU1 or later | 2603 and 2507 CU2 or later |
| Mac | 2603 or later | 2603 or later |
| Linux | Coming soon | Coming soon |
| HTML5 | 2511 or later | 2603 or later |
| ChromeOS | 2511 or later | 2603 or later |
| Android | 2603 or later | 2603 or later |
| iOS | 2603 or later | 2603 or later |
Direct Access: The Citrix Workspace App connects directly to StoreFront™ without traversing a Citrix Gateway. This is typically used within a corporate network where the Citrix environment is reachable without a VPN or proxy.
Via Gateway: The Citrix Workspace App connects through a Citrix Gateway (NetScaler®). Typically used for external or remote access where traffic is routed through a secure gateway before reaching the Citrix environment.
Platform and Infrastructure Components
| Component | Minimum Version |
|---|---|
| CVAD (VDA, DDC, PVS, FAS, Session Recording, StoreFront, WEM, UPM) | 2402 CU4, 2507 CU1, 2511 or later |
| Citrix DaaS™ | Post February 2026 |
| Citrix NetScaler | 14.1.60.57 |
| Citrix License Server | 540000 or later |
| Citrix Connector Appliance | 11.4.1.444 or later |
| Cloud Connector (for Monitor log retrieval) | 6.141.0.13739 or later |
| Cloud Connector (for log forwarding) | 6.169.0.22492 or later |
Step 3 — Size Your Log Server
Hardware Requirements
| Resource | Linux VM | Windows VM | Connector Appliance |
|---|---|---|---|
| CPU | 4 cores min | 8 cores min | 4 vCPUs (increase from default 2) |
| RAM | 16 GB | 24 GB | 16 GB (increase from default 4 GB) |
| Disk | 500 GB SSD* | 500 GB SSD* | Attach a separate virtual disk* |
| Docker | Docker Engine (free) | Docker Desktop (subscription may apply) | Built-in — no Docker management |
* See Step 4 — Storage Calculator for the accurate storage required for your setup.
OpenSearch Memory Scaling
| Connected Machines | Recommended Heap |
|---|---|
| 0–999 | 2 GB (-Xms2G -Xmx2G) |
| 1,000–1,999 | 4 GB (-Xms4G -Xmx4G) |
| 2,000–9,999 | 6 GB (-Xms6G -Xmx6G) |
Step 4 — Calculate Storage
Formula
Total Storage (GB) = Daily Log Volume (GB) × Retention Days
<!--NeedCopy-->
Daily Log Volume by Component Type
The table below shows a reference breakdown for a medium deployment of approximately 10,000 managed components. Use these per-component figures to estimate daily log volume for your environment.
| Component | Count | Sessions / Day / Machine | Avg Log Size / Session | Total Logs / Day |
|---|---|---|---|---|
| Persistent VDAs | 1,000 | 2 | 2 MB | 4,000 MB (~4 GB) |
| Pooled VDAs | 1,000 | 50 | 2 MB | 100,000 MB (~100 GB) |
| CWA Endpoints | 8,000 | 4 | 1–1.5 MB | 48,000 MB (~48 GB) |
| Delivery Controllers | 4 | — | 300 MB / DDC / day | 1,200 MB (~1.2 GB) |
| StoreFront Servers | 4 | — | 300 MB / server / day | 1,200 MB (~1.2 GB) |
| NetScaler / PVS / Session Recording / FAS / Other | 4 | — | 300 MB / server / day | 1,200 MB (~1.2 GB) |
| Daily Total | ~156 GB/day pre-compression / ~80–125 GB/day post-compression |
Note
- These values are approximate and can differ widely between deployments depending on architecture, user activity, enabled components, and session patterns.
- Infrastructure components (DDC, StoreFront, Gateway, PVS, FAS, Session Recording) are estimated at 300 MB per server per day. This is a conservative planning figure.
- The Log Server uses the LZ4 compression algorithm by default. The compression reduction is typically between 20% and 50%.
- Deploy the AOT Log Server on SSD-backed storage for best performance.
Daily Log Volume by Deployment Size
| Deployment Size | Before Compression | After LZ4 Compression |
|---|---|---|
| 5,000 machines | ~78 GB/day | ~40–63 GB/day |
| 10,000 machines | ~156 GB/day | ~80–125 GB/day |
| 50,000 machines | ~780 GB/day | ~400–625 GB/day |
| 100,000 machines | ~1.56 TB/day | ~800 GB–1.25 TB/day |
Retention-Based Storage Estimate
| Deployment Size | 7-Day Retention | 10-Day Retention |
|---|---|---|
| 5,000 machines | ~300–450 GB | ~400–630 GB |
| 10,000 machines | ~600 GB–1 TB | ~800 GB–1.25 TB |
| 50,000 machines | ~3–5 TB | ~4–6.3 TB |
| 100,000 machines | ~6–10 TB | ~8–12.5 TB |
Step 5 — Plan Your Network
- The Log Server must be reachable from all components that will forward logs.
- Deploy the Log Server in the same network segment as your VDAs to minimize latency.
- Choose a port that is not in use, not in the privileged range (0–1023), and allowed through your firewall.
- HTTPS is strongly recommended. Reference ports: 8443 (HTTPS), 8080 (HTTP).
- If using the Connector Appliance, configure port 443 only.
Checklist Before You Proceed
- Platform selected (Connector Appliance / Linux / Windows)
- Hardware provisioned (CPU, RAM, SSD disk)
- CVAD component versions verified
- Daily log volume estimated
- Retention period decided
- Total storage allocated
- Port selected and firewall rules updated
- Certificate ready (for HTTPS mode)
- OpenSearch heap memory planned