uberAgent

Disable ESA While Keeping Director Integration

February 10, 2026

Contributed by:

Symptom

uberAgent is still evaluating ESA-related metrics on your VDAs although you’ve set EnableESA to false in your uberAgent.conf, and you are running Citrix Virtual Apps and Desktops 2503 or later.

Cause

Starting with Citrix Virtual Apps and Desktops 2503, uberAgent integrates with Citrix Director to enable enhanced monitoring capabilities. The Director integration requires a subset of ESA metrics. Therefore, ESA is enabled by Director even when you’ve set EnableESA to false in your uberAgent.conf.

Resolution

To keep Director functionality while preventing ESA data from being sent to your backend (for example, Splunk), do the following:

Remove the @ConfigInclude uberAgent-ESA.conf line from your uberAgent.conf.
Add the following Event Data Filter to your uberAgent.conf to block remaining ESA data:

# Exclude all ESA metrics
[EventDataFilter]
Action = deny
Sourcetype = ActivityMonitoring:ProcessTagging
Sourcetype = Process:DnsQuery
Sourcetype = System:ScheduledTaskActions
Sourcetype = System:ScheduledTaskTriggers
Sourcetype = System:ScheduledTasks
Sourcetype = Process:ProcessStop
Sourcetype = System:WinEvtLogForwarding
Sourcetype = System:SecurityInventory
Query = true
<!--NeedCopy-->

After applying the filter, save your uberAgent.conf and restart the uberAgent service. ESA data should no longer appear in your backend while Director functionality remains available.

For more details, see Event Data Filtering.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Disable ESA While Keeping Director Integration

February 10, 2026

Contributed by:

February 10, 2026

Contributed by:

Disable ESA While Keeping Director Integration

Symptom

Cause

Resolution

In this article