Launching soon: The world's first vendor agnostic bug scrubLearn more & join waitlist
OPERATIONAL DEFECT DATABASE
...
...
Important: We recommend you migrate from Horizon 7 to Horizon 8 as soon as possible. Horizon 8 offers numerous improvements in performance, scale, and experience for both Administrators and end users. Please see Ensuring a successful migration from Horizon 7 to Horizon 8 (89840) for additional advice.Horizon 7.13 is our last minor release on the Horizon 7.x line. There are 3 maintenance updates for 7.13: 7.13.1, 7.13.2, and 7.13.3. Horizon 7.13.x has reached its End of General Support (Apr 30, 2023) and has entered into its Technical Guidance Support phase (ends Apr 30, 2025).
This article provides information about Horizon 7.13 Legacy settings, supported health monitoring string and suitable Load balancer persistence values.The intent of this article is to provide a reference point for both Horizon System Administrators and Network Administrators when deciding on appropriate configuration values for Horizon and equivalent persistence values for load balancers.
Note: VMware recommends Source IP persistence. Summary: Horizon has a default heartbeat interval of 30 minutes if you do not configure optional settings within Horizon such as "Forcibly Disconnect Users" or "User Idle Timeout"You can configure lower timeout values which are respected but the heartbeat interval cannot be extended beyond 30 minutes.If a Horizon Client heartbeat is missed 3 times in a row, the session is terminated.Loadbalancer persistence settings need to account for this with a persistence value of 90 minutes for a default configuration, or less if you have configured a lower timeout period.Please find a legend and Sample Scenarios below along with guidance and caveats in terms of Health Monitoring. Legend: ValueExplanationForcibly Disconnect UsersThis is a Global Setting in your Horizon Admin Console. In Horizon Console, you can configure global settings by navigating to Settings > Global Settings > General Settings (Global Settings for Client Sessions in Horizon Console ) | pae-MaxSessionTimeUser Idle TimeoutThis is a Global Setting in your Horizon Admin Console. Protects application sessions when there is no keyboard or mouse activity on the client device for a certain configured period | pae-UserIdleTimeoutHeartbeat Interval (set-last-user-activity)This is a session keepalive sent from the Horizon Client machine. The heartbeat interval (set-last-user-activity). If this interval expires, with no beat received & we miss three consecutive heartbeats, the session will endYou can see these being sent and received within the Horizon 2022-12-02T08:41:20.659-05:00 INFO (01) [libcdk] : CdkSetLastUserActivityTask_CreateRequest: Sending last user activity: 349. From 7.13.1 and Later, a maximum interval of 30 minutes between heartbeats is enforced - The period between heartbeat checks cannot be longer than 30 minutes. All larger idle timeout values, including never will be handled as a 30 minute intervalif configured with values below 30 minutes, a combination of the values set for "Forcibly Disconnect Users" & "User Idle Timeout" Example: This means for an idle timeout of one minute (the minimum value), heartbeats will be sent every 20 seconds, and this increases linearly to an idle timeout of 90 minutes (heartbeats every 30 minutes)Load Balancer PersistenceHeartbeats will never be further apart than 30 minutes. We allow the possibility of two consecutive heartbeats going astray but will tear down the connection if we miss three consecutive heartbeats. Examples of Potential Configuration Scenarios:T = "Forcibly Disconnect User's" value in minutesY = "User Idle Timeout" value in minutesZ = Heartbeat Interval value in minutes. Example Forcibly Disconnect Users User Idle Timeout Heartbeat Interval (set-last-user-activity) Load Balancer Persistence Horizon <= 7.13.0 Horizon >= 7.13.1 Horizon <= 7.13.0 Horizon >= 7.13.1 1NeverNeverEvery 6 Hour 40 Minutes Hardcoded 30mins7 hr90 minutes 2T MinutesNeverT/3 = Z If Z < 30 minutes, the Interval is Z30 minutes if Z> 30 Z Minutes90 minutes or Z Minutes if <303NeverY MinutesY/3 =Z If Z < 30 minutes, the Interval is T 30 minutes if Z > 30 Z Minutes90 minutes or Z Minutes if <304T MinutesY Minutes(If T < Y) T/3 = Z else (if Y < T) Y/3 = Z If Z < 30 minutes, the Interval is T 30 minutes if Z > 30 Z Minutes90 minutes or Z Minutes if <30 Deployment Options: Option 1Internal Users go through an Internal LB, by skipping the UAG.Client --> External LB --> UAG --> Internal LB --> CSOption 2One-to-one mapping of UAG with Connection Broker is recommended to have a fair distribution of loadClient --> LB --> UAG --> CSOption 3 Horizon Security Server Security Server Topologies Client --> LB --> Security Server --> CS Monitoring the Health of the Connection Server To monitor load balancing health for a Horizon Connection Server, follow these best practices. The response received will allow the load balancer to determine where to route traffic.Polling Interval: 30 secs (default recommended) The reason behind using 30 seconds is to not flood the connection server with a high number of health check requests.Setting too low a value like 5 seconds or less is going to cause a higher load on the Connection Server and can lead to unexpected results. Recommended Range: 30 - 9000 seconds. Response Timeout: The calculation of the Response Timeout value is triple the value of polling interval + 1.With a polling interval of the default 30 seconds, the Response Timeout would be 91 seconds.Example Calculation: 30 * 3 = 90 + 1 = 91 secs.Configuring Load Balancers for Horizon Connection Server Health Monitoring Load Balancer Limits: When multiple load balancers are configured to monitor the health of a server simultaneously, they can occupy a significant number of open threads on the connection server.This can lead to resource contention and potentially impact the server's ability to handle incoming requests. For example: In a scenario where 15 load balancers are set up to poll a single connection server every 30 seconds, it results in 15 requests being sent to the server within that time frame. If the server takes 2 to 3 seconds to respond, the remaining free thread count on the Tomcat server would be 85. This is a crucial consideration in a scaled environment. Essentially, try not to have more than two load balancers engaged in monitoring the health of a connection server. favicon.ico is the only supported configuration for monitoring connection server health from load balancers HTTP Response with monitoring strings: 200 OKThe Connection server is responsive to brokering requests.500 Internal Server ErrorThe Connection server is not responsive to brokering requests. Horizon VersionMonitoring StringUsage Description7.7 and later GET /favicon.ico HTTP/1.0 or GET /favicon.ico HTTP/1.1 Supports the broker disable status. Sends back 500 status code when it cannot broker end-user sessions. 7.10.2 and later 7.11 Cumulative HP 7.12 Cumulative HP Horizon 7.x and later HEAD /favicon.ico HTTP/1.0 or HEAD /favicon.ico HTTP/1.1 or GET /favicon.ico HTTP/1.0 or GET /favicon.ico HTTP/1.1 Fixes a potential Denial of Service issue identified in the connection server. Using this monitoring string creates no heap load on the server while handling the HTTP sessions on each of the requests sent from external (Load Balancer). HEAD monitoring string is the optimized way of monitoring connection server health. Provides, zero payload response and saves bandwidth of the network. GET can be used as well as usual. It has the following improvements. Response favicon.ico size is reduced to 9 KB from 360 KB Load Balancer config must use one of the listed monitoring strings. Any other custom monitoring strings are not officially supported by VMware. Prior to Horizon 7.7 GET / HTTP/1.0 or GET /favicon.ico Monitors the portal status. Lacks the broker disable status check improvement. An alternate way of monitoring it is in use using the monitoring string GET /broker/xml. This is not supported as a monitoring string. Monitoring the Health of Unified Access Gateway (UAG) Horizon 7.13 is interoperable with Unified Access Gateway. Please see our interoperability pagesConfigure Unified Access Gateway System Settings UAG has a Maximum number of TCP connections allowed per TLS session / Maximum Connections per SessionThe default value is 16 From Unified Access Gateway Load Balancing Topologies in the UAG Deployment Documentation :A load balancer monitors the health of each Unified Access Gateway appliance by periodically sending an HTTPS GET /favicon.ico request. For example, https://uag1.myco-dmz.com/favicon.ico. This monitoring is configured on the load balancer. It will perform this HTTPS GET and expect a "HTTP/1.1 200 OK" response from Unified Access Gateway to know that it is "healthy". If it gets a response other than "HTTP/1.1 200 OK" response or does not get any response, it will mark the particular Unified Access Gateway appliance as down and will not attempt to route client requests to it. It will continue to poll so that it can detect when it is available again.Samples: These example configurations are provided 'as-is'Please refer to UAG documentation and Load Balancer Vendor documentation for your particular release for the most current and relevant settingsIncorrectly crafted health checks and excess frequent health checks do lead to unexpected outcomes. Verification against the latest available documentation for the various devices involved is encouraged. Sample Health Monitor Configuration for an Avi Vantage Load Balancer: Health Monitor Port: 443 Client Request Data: GET /favicon.ico HTTP/1.1 Response Code: 2XX SSL Attributes: Enabled SSL Profile: System-Standard Maintenance Response Code: 503 Sample Health Monitor Configuration for Health Monitor for an F5 Load Balancer: Interval: 30 Timeout: 91 Send String: GET /favicon.ico HTTP/1.1\r\nHost: VIP.FQDN\r\nConnection: Close\r\n\r\n Receive String: 200 OK
For Horizon 8, Please reference Horizon 8: Monitoring health of Horizon Connection Server using Load Balancer, timeout, Load Balancer persistence settings (56636)