Unlock a world of possibilities! Login now and discover the exclusive benefits awaiting you.
Jun 2, 2021 10:26:50 AM
Dec 12, 2017 10:25:07 AM
This can help in the troubleshooting process to find out what App/User was active and accessed an application right before an error/issue in the environment.
The entries are color coded for the name of the App in the Hub/QMC along with the APP ID and Session ID
Note: Session ID will change for different users and different browsers, this includes closing the browser and reopening it (which is a new session, but will be the same App ID). In this test there's only one session and two accesses of the app, but a user can open the app in another browser which will show it as the same user in two different sessions for the same app at the same time.
Environment:
Qlik Sense Enterprise on Windows , version 3.2.1 and newer, single node
Windows 2012 R2
App Name: Load Test APP ID
Published APP ID?: c3ed4e49-dc98-4ff8-b140-f3d945236197 - Load Test APP ID
Session ID?: fe87b122-8979-45d4-9c37-3c39ce704045 - Load Test APP ID
C:\ProgramData\Qlik\Sense\Log\Engine\Trace\QLIKSERVER1_System_Engine.txt
First Open (loaded into memory):
16 20170321T215743.565+0100 INFO QlikServer1 System.Engine.Engine 46 6f40f67b-47aa-406f-bb78-947e90cd9ff3 DOMAIN\qvservice QvSocket: Connected to server as user: 'UserDirectory=DOMAIN; UserId=qvservice' for document: '/app/c3ed4e49-dc98-4ff8-b140-f3d945236197' on socket fe80::743e:6e47:b9f:acb5:4747 <-> fe80::743e:6e47:b9f:acb5:62282 0 Internal Engine 20170321T215743.566+0100 3136 3176 20170321T215516.000+0100 6f40f67b-47aa-406f-bb78-947e90cd9ff3
17 20170321T215743.573+0100 INFO QlikServer1 System.Engine.Engine 46 31b65464-36b3-48c1-8dc8-f7b5c2ecbb9b DOMAIN\qvservice Server: Document Load: Beginning open of document fe87b122-8979-45d4-9c37-3c39ce704045 DOMAIN qvservice 20170321T215743.573+0100 3132 3176 20170321T215516.000+0100 31b65464-36b3-48c1-8dc8-f7b5c2ecbb9b
18 20170321T215743.597+0100 INFO QlikServer1 System.Engine.Engine 46 610de372-ad42-4975-863b-93f5d9fbcbec DOMAIN\qvservice DOC loading: Beginning load of document C3ED4E49-DC98-4FF8-B140-F3D945236197. fe87b122-8979-45d4-9c37-3c39ce704045 DOMAIN qvservice 20170321T215743.597+0100 3756 3176 20170321T215516.000+0100 610de372-ad42-4975-863b-93f5d9fbcbec
19 20170321T215744.640+0100 INFO QlikServer1 System.Engine.Engine 46 f15e84d0-f8d9-44d1-a8e1-3095b41e4a0d DOMAIN\qvservice Document Load: The document c3ed4e49-dc98-4ff8-b140-f3d945236197 was loaded. fe87b122-8979-45d4-9c37-3c39ce704045 DOMAIN qvservice 20170321T215744.641+0100 4468 3176 20170321T215516.000+0100 f15e84d0-f8d9-44d1-a8e1-3095b41e4a0d
Second Open (already loaded in memory):
20 20170321T220052.937+0100 INFO QlikServer1 System.Engine.Engine 47 34b26c68-67e8-4be1-9439-6026c0c59f9e DOMAIN\qvservice QvSocket: Connected to server as user: 'UserDirectory=DOMAIN; UserId=qvservice' for document: '/app/c3ed4e49-dc98-4ff8-b140-f3d945236197' on socket fe80::743e:6e47:b9f:acb5:4747 <-> fe80::743e:6e47:b9f:acb5:62296 0 Internal Engine 20170321T220052.937+0100 3136 3176 20170321T215516.000+0100 34b26c68-67e8-4be1-9439-6026c0c59f9e
21 20170321T220052.960+0100 INFO QlikServer1 System.Engine.Engine 47 cc981161-bbfd-42ec-aa5c-b512e0602283 DOMAIN\qvservice Server: Document Load: Beginning open of document fe87b122-8979-45d4-9c37-3c39ce704045 DOMAIN qvservice 20170321T220052.960+0100 3132 3176 20170321T215516.000+0100 cc981161-bbfd-42ec-aa5c-b512e0602283
Notice the first load will state what Session ID initiated the load into memory. The second attempt only gives the App ID in the first log line and then the Session ID is in an entry afterwards. While these entries should be right after each other, depending on what’s happening, they might be broken up by other entries. It’s unlikely, but does make it more difficult to troubleshoot a heavily trafficked environment without access to the Proxy logs.
Note: The First Open is only triggered when the QVF is not in memory, so the initial load in memory might be in another log file depending on when the log files are archived.
C:\ProgramData\Qlik\Sense\Log\Proxy\Audit\QLIKSERVER1_AuditSecurity_Proxy.txt
First Open (loaded into memory):
3 11.11.0.0 20170321T215732.019+0100 QlikServer1 738f0e4c-85bc-44ab-accb-18825ec407a5 Command=Login;Result=0;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 c8d0eb48-fe7a-47da-bbca-0eab11340b92 0 DOMAIN qvservice 0 Not available Security ::ffff:172.16.16.100 Proxy AppAccess /hub/stream/e4f1e040-75cf-4db0-afbd-baaf90cab8f8 Login 0 User authenticated. User 'DOMAIN\qvservice' used authentication method 'ticket' and got session 'fe87b122-8979-45d4-9c37-3c39ce704045' 1dc02c31e1779346144cbcc4b75a81a55f466159
4 11.11.0.0 20170321T215742.970+0100 QlikServer1 97ab24cb-edb8-4930-a343-69e044ec7dd0 Command=Add app privileges;Result=0;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 0e6278ad-ffff-4d6c-9d66-af84a1596d78 0 DOMAIN qvservice c3ed4e49-dc98-4ff8-b140-f3d945236197 Not available Security ::ffff:172.16.16.100 Proxy AppAccess /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197 Add app privileges:ProcessRequestAccessResult 0 Access to app 'c3ed4e49-dc98-4ff8-b140-f3d945236197' allowed with access type 'UserAccessType', result code 'Ok' 94d89f25a8faad2ea59837ded7b6a1603a4607da
Second Open (already loaded in memory):
20 20170321T220052.937+0100 INFO QlikServer1 System.Engine.Engine 47 34b26c68-67e8-4be1-9439-6026c0c59f9e DOMAIN\qvservice QvSocket: Connected to server as user: 'UserDirectory=DOMAIN; UserId=qvservice' for document: '/app/c3ed4e49-dc98-4ff8-b140-f3d945236197' on socket fe80::743e:6e47:b9f:acb5:4747 <-> fe80::743e:6e47:b9f:acb5:62296 0 Internal Engine 20170321T220052.937+0100 3136 3176 20170321T215516.000+0100 34b26c68-67e8-4be1-9439-6026c0c59f9e
21 20170321T220052.960+0100 INFO QlikServer1 System.Engine.Engine 47 cc981161-bbfd-42ec-aa5c-b512e0602283 DOMAIN\qvservice Server: Document Load: Beginning open of document fe87b122-8979-45d4-9c37-3c39ce704045 DOMAIN qvservice 20170321T220052.960+0100 3132 3176 20170321T215516.000+0100 cc981161-bbfd-42ec-aa5c-b512e0602283
As you can see the first load will state what Session ID initiated the load into memory. The second attempt only gives the App ID in the first log line and then the Session ID is in an entry afterwards. While these entries should be right after each other, depending on what’s happening, they might be broken up by other entries. It’s unlikely, but does make it more difficult to troubleshoot a heavily trafficked environment without access to the Proxy logs.
Note: The First Open is only triggered when the QVF is not in memory, so the initial load in memory might be in another log file depending on when the log files are archived.
C:\ProgramData\Qlik\Sense\Log\Proxy\Audit\QLIKSERVER1_AuditSecurity_Proxy.txt
First Open (loaded into memory):
3 11.11.0.0 20170321T215732.019+0100 QlikServer1 738f0e4c-85bc-44ab-accb-18825ec407a5 Command=Login;Result=0;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 c8d0eb48-fe7a-47da-bbca-0eab11340b92 0 DOMAIN qvservice 0 Not available Security ::ffff:172.16.16.100 Proxy AppAccess /hub/stream/e4f1e040-75cf-4db0-afbd-baaf90cab8f8 Login 0 User authenticated. User 'DOMAIN\qvservice' used authentication method 'ticket' and got session 'fe87b122-8979-45d4-9c37-3c39ce704045' 1dc02c31e1779346144cbcc4b75a81a55f466159
4 11.11.0.0 20170321T215742.970+0100 QlikServer1 97ab24cb-edb8-4930-a343-69e044ec7dd0 Command=Add app privileges;Result=0;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 0e6278ad-ffff-4d6c-9d66-af84a1596d78 0 DOMAIN qvservice c3ed4e49-dc98-4ff8-b140-f3d945236197 Not available Security ::ffff:172.16.16.100 Proxy AppAccess /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197 Add app privileges:ProcessRequestAccessResult 0 Access to app 'c3ed4e49-dc98-4ff8-b140-f3d945236197' allowed with access type 'UserAccessType', result code 'Ok' 94d89f25a8faad2ea59837ded7b6a1603a4607da
Second Open (already loaded in memory):
5 11.11.0.0 20170321T220052.910+0100 QlikServer1 881a8f23-f3a2-4f2b-ae45-969dc9c0c2e3 Command=Add app privileges;Result=0;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 a057e326-6123-406a-8ee2-e82a46efe367 0 DOMAIN qvservice c3ed4e49-dc98-4ff8-b140-f3d945236197 Not available Security ::ffff:172.16.16.100 Proxy AppAccess /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197 Add app privileges:ProcessRequestAccessResult 0 Access to app 'c3ed4e49-dc98-4ff8-b140-f3d945236197' allowed with access type 'UserAccessType', result code 'Ok' 0649a45ad43ccfcf97b82a1cd8d14dd2fa0cfe3b
6 11.11.0.0 20170321T220553.102+0100 QlikServer1 a5462a59-cf10-494e-b021-fc1c26bad82c Command=Add app privileges;Result=0;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 a057e326-6123-406a-8ee2-e82a46efe367 0 DOMAIN qvservice c3ed4e49-dc98-4ff8-b140-f3d945236197 Not available Security ::ffff:172.16.16.100 Proxy AppAccess /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197 Add app privileges:ProcessRequestAccessResult 0 Access to app 'c3ed4e49-dc98-4ff8-b140-f3d945236197' allowed with access type 'UserAccessType', result code 'Ok' 11c238cbc3edf8e921ebf0e0d8f71b199497a880
There’s a few logs listed here that will give other information along with the Session and App ID, but with the Proxy logs we can verify the Session ID that links to the App ID. This can point you to a time, user and app accessed giving you an idea of what users/apps were active and open at the time.
C:\ProgramData\Qlik\Sense\Log\Engine\Audit\QLIKSERVER1_AuditActivity_Engine.txt
First Open (loaded into memory):
1 12.16.1.0 20170321T215745.019+0100 QlikServer1 48345a91-0cef-4f54-adce-e1137ab27acd 20170321T215745.007+0100 12.2.2.0 Command=Open app;Result=0;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 0e6278ad-ffff-4d6c-9d66-af84a1596d78 1 DOMAIN qvservice c3ed4e49-dc98-4ff8-b140-f3d945236197 Not available Engine Not available Global::OpenApp Open app 0 Success 48345a91-0cef-4f54-adce-e1137ab27acd
Second Open (already loaded in memory):
2 12.16.1.0 20170321T220053.193+0100 QlikServer1 ea7e3197-3651-4a87-9c56-a4d51872f01f 20170321T220053.193+0100 12.2.2.0 Command=Open app;Result=0;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 a057e326-6123-406a-8ee2-e82a46efe367 1 DOMAIN qvservice c3ed4e49-dc98-4ff8-b140-f3d945236197 Not available Engine Not available Global::OpenApp Open app 0 Success ea7e3197-3651-4a87-9c56-a4d51872f01f
This log gives the information on the app being opened with its Session ID.
C:\ProgramData\Qlik\Sense\Log\Engine\Trace\QLIKSERVER1_Session_Engine.txt
First Open (Closed browser tab):
1 20170321T220016.240+0100 INFO QlikServer1 Session.Engine.Engine 53 6f637615-237c-4716-87d1-4a3f06ed81be DOMAIN\qvservice fe87b122-8979-45d4-9c37-3c39ce704045 DOMAIN qvservice 20170321T220016.238+0100 3132 3176 12.2.50504.0409.10 20170321T215516.000+0100 0e6278ad-ffff-4d6c-9d66-af84a1596d78 c3ed4e49-dc98-4ff8-b140-f3d945236197 Load Test APP ID 20170320T195542.497Z Socket closed by client 20170321T215743.000+0100 0.001771 0.006285 1902 5619 13 0 UserDirectory=DOMAIN; UserId=qvservice Off 6f637615-237c-4716-87d1-4a3f06ed81be
This has one entry for when tab in the browser was closed (but maintained the actual Session ID since the browser was still active) and you can see by the time stamp of 20170321T220016 is before the Second Open of 20170321T220053. If you had closed the Second Open session you would have a similar entry.
C:\ProgramData\Qlik\Sense\Log\Proxy\Audit\QLIKSERVER1_AuditActivity_Proxy.txt
First Open (No Session established until now):
1 11.11.0.0 20170321T215731.469+0100 QlikServer1 201ee217-3713-44cb-9277-d374799a84fb Command=Get ticket;Result=0;ResultText=Success 0 0 0 INTERNAL sa_proxy 0 Not available Proxy Not available /hub/stream/e4f1e040-75cf-4db0-afbd-baaf90cab8f8 Get ticket:ConsumeIncomingTicket 0 User claimed ticket: 'ewXLiJDk6xM1Q0TH'. Session will be etablished 201ee217-3713-44cb-9277-d374799a84fb
2 11.11.0.0 20170321T215731.512+0100 QlikServer1 7042d186-3f1d-4759-9d87-663b73522766 Command=Start session;Result=0;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 0 0 DOMAIN qvservice 0 DOMAIN\qvservice Proxy Not available /qps/sessionstart/qvservice Start session 0 Start session for user: 'DOMAIN\qvservice' 7042d186-3f1d-4759-9d87-663b73522766
3 11.11.0.0 20170321T215731.892+0100 QlikServer1 2e9f0d03-aabe-403a-b282-ec01a47283a0 Command=Add session;Result=0;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 c8d0eb48-fe7a-47da-bbca-0eab11340b92 0 DOMAIN qvservice 0 Not available Proxy Not available /hub/stream/e4f1e040-75cf-4db0-afbd-baaf90cab8f8 Add session:NotifyOfPostSession 0 Syncing user attributes for user 'DOMAIN\qvservice' 2e9f0d03-aabe-403a-b282-ec01a47283a0
4 11.11.0.0 20170321T215736.774+0100 QlikServer1 4f3ec3ce-604b-4fad-930c-6c5d3c417112 Command=Get session;Result=200;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 bcce5b5b-a2e5-455c-9a36-f3fe076b03e3 0 DOMAIN qvservice 0 Not available Proxy AppAccess /qps/user?targeturi=http:%2f%2fqlikserver1.domain.local%2fhub%2f Get session:HandleRequest 200 Handle connection request 4f3ec3ce-604b-4fad-930c-6c5d3c417112
5 11.11.0.0 20170321T215743.567+0100 QlikServer1 1fcb5c5c-15f5-40a6-bd54-0819643cd197 Command=Open connection;Result=0;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 0e6278ad-ffff-4d6c-9d66-af84a1596d78 0 DOMAIN qvservice c3ed4e49-dc98-4ff8-b140-f3d945236197 Not available Proxy AppAccess /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197 Open connection 0 Backend web socket connection Opened for session 'fe87b122-8979-45d4-9c37-3c39ce704045'. App id: 'c3ed4e49-dc98-4ff8-b140-f3d945236197'. UserAgent: 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36' 1fcb5c5c-15f5-40a6-bd54-0819643cd197
First Open (Closed tab)
6 11.11.0.0 20170321T220016.242+0100 QlikServer1 12a1b6ff-d000-4f56-a58c-8ca1bd36a567 Command=Close connection;Result=0;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 0e6278ad-ffff-4d6c-9d66-af84a1596d78 0 DOMAIN qvservice c3ed4e49-dc98-4ff8-b140-f3d945236197 Not available Proxy AppAccess /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197 Close connection 0 Backend web socket connection Closed for session 'fe87b122-8979-45d4-9c37-3c39ce704045'. App id: 'c3ed4e49-dc98-4ff8-b140-f3d945236197. UserAgent: 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36' 12a1b6ff-d000-4f56-a58c-8ca1bd36a567
Second Open:
7 11.11.0.0 20170321T220052.937+0100 QlikServer1 f1f1350f-0b00-4cf1-b30c-51ddbfecb6bb Command=Open connection;Result=0;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 a057e326-6123-406a-8ee2-e82a46efe367 0 DOMAIN qvservice c3ed4e49-dc98-4ff8-b140-f3d945236197 Not available Proxy AppAccess /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197 Open connection 0 Backend web socket connection Opened for session 'fe87b122-8979-45d4-9c37-3c39ce704045'. App id: 'c3ed4e49-dc98-4ff8-b140-f3d945236197'. UserAgent: 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36' f1f1350f-0b00-4cf1-b30c-51ddbfecb6bb
Notice in this log the user gets a Ticket and Session in the first open to kick off the Session ID. You can then see that web socket connection is closed to the application for that session and then reopened right after it.
Note: The Syncing of attributes in the First Open that gets the ticket, it only does that the start of the session and will not be triggered until a new session is established.
C:\ProgramData\Qlik\Sense\Log\Proxy\Audit\QLIKSERVER1_AuditActivity_Proxy.txt
First Open (No Session established until now):
1 11.11.0.0 20170321T215731.469+0100 QlikServer1 201ee217-3713-44cb-9277-d374799a84fb Command=Get ticket;Result=0;ResultText=Success 0 0 0 INTERNAL sa_proxy 0 Not available Proxy Not available /hub/stream/e4f1e040-75cf-4db0-afbd-baaf90cab8f8 Get ticket:ConsumeIncomingTicket 0 User claimed ticket: 'ewXLiJDk6xM1Q0TH'. Session will be etablished 201ee217-3713-44cb-9277-d374799a84fb
2 11.11.0.0 20170321T215731.512+0100 QlikServer1 7042d186-3f1d-4759-9d87-663b73522766 Command=Start session;Result=0;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 0 0 DOMAIN qvservice 0 DOMAIN\qvservice Proxy Not available /qps/sessionstart/qvservice Start session 0 Start session for user: 'DOMAIN\qvservice' 7042d186-3f1d-4759-9d87-663b73522766
3 11.11.0.0 20170321T215731.892+0100 QlikServer1 2e9f0d03-aabe-403a-b282-ec01a47283a0 Command=Add session;Result=0;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 c8d0eb48-fe7a-47da-bbca-0eab11340b92 0 DOMAIN qvservice 0 Not available Proxy Not available /hub/stream/e4f1e040-75cf-4db0-afbd-baaf90cab8f8 Add session:NotifyOfPostSession 0 Syncing user attributes for user 'DOMAIN\qvservice' 2e9f0d03-aabe-403a-b282-ec01a47283a0
4 11.11.0.0 20170321T215736.774+0100 QlikServer1 4f3ec3ce-604b-4fad-930c-6c5d3c417112 Command=Get session;Result=200;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 bcce5b5b-a2e5-455c-9a36-f3fe076b03e3 0 DOMAIN qvservice 0 Not available Proxy AppAccess /qps/user?targeturi=http:%2f%2fqlikserver1.domain.local%2fhub%2f Get session:HandleRequest 200 Handle connection request 4f3ec3ce-604b-4fad-930c-6c5d3c417112
5 11.11.0.0 20170321T215743.567+0100 QlikServer1 1fcb5c5c-15f5-40a6-bd54-0819643cd197 Command=Open connection;Result=0;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 0e6278ad-ffff-4d6c-9d66-af84a1596d78 0 DOMAIN qvservice c3ed4e49-dc98-4ff8-b140-f3d945236197 Not available Proxy AppAccess /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197 Open connection 0 Backend web socket connection Opened for session 'fe87b122-8979-45d4-9c37-3c39ce704045'. App id: 'c3ed4e49-dc98-4ff8-b140-f3d945236197'. UserAgent: 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36' 1fcb5c5c-15f5-40a6-bd54-0819643cd197
First Open (Closed tab)
6 11.11.0.0 20170321T220016.242+0100 QlikServer1 12a1b6ff-d000-4f56-a58c-8ca1bd36a567 Command=Close connection;Result=0;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 0e6278ad-ffff-4d6c-9d66-af84a1596d78 0 DOMAIN qvservice c3ed4e49-dc98-4ff8-b140-f3d945236197 Not available Proxy AppAccess /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197 Close connection 0 Backend web socket connection Closed for session 'fe87b122-8979-45d4-9c37-3c39ce704045'. App id: 'c3ed4e49-dc98-4ff8-b140-f3d945236197. UserAgent: 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36' 12a1b6ff-d000-4f56-a58c-8ca1bd36a567
Second Open:
7 11.11.0.0 20170321T220052.937+0100 QlikServer1 f1f1350f-0b00-4cf1-b30c-51ddbfecb6bb Command=Open connection;Result=0;ResultText=Success fe87b122-8979-45d4-9c37-3c39ce704045 a057e326-6123-406a-8ee2-e82a46efe367 0 DOMAIN qvservice c3ed4e49-dc98-4ff8-b140-f3d945236197 Not available Proxy AppAccess /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197 Open connection 0 Backend web socket connection Opened for session 'fe87b122-8979-45d4-9c37-3c39ce704045'. App id: 'c3ed4e49-dc98-4ff8-b140-f3d945236197'. UserAgent: 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36' f1f1350f-0b00-4cf1-b30c-51ddbfecb6bb
Notice in this log the user gets a Ticket and Session in the first open to kick off the Session ID. You can then see that web socket connection is closed to the application for that session and then reopened right after it.
Note: The Syncing of attributes in the First Open that gets the ticket, it only does that the start of the session and will not be triggered until a new session is established.
C:\ProgramData\Qlik\Sense\Log\Proxy\Trace\QLIKSERVER1_Audit_Proxy.txt
First Open (loaded into memory):
1 20170321T215731.134+0100 INFO QlikServer1 Audit.Proxy.Proxy.SessionEstablishment.Authentication.AuthenticationHandler 14 384a5be2-8c1f-4569-8b17-a6fa747b8f2f DOMAIN\qvservice Session 'a0ee67d2-581b-47db-9514-443ac4a008b1' is invalid (possibly timed out or logged out) 0 45b4435a-3e05-47c4-b78b-0e5311154a91 ::ffff:172.16.16.100 {} 1650cb4421d90c3f0e3af23e1f5e2c8176219ad8
2 20170321T215731.188+0100 INFO QlikServer1 Audit.Proxy.Proxy.SessionEstablishment.RedirectionHandler 14 17bed8a0-b6ec-4316-9dfd-ff062b4b1c79 DOMAIN\qvservice Authentication required, redirecting client@http://[::ffff:172.16.16.100]:62230/ to http://qlikserver1.domain.local:4248/windows_authentication/?targetId=6b07f3fb-5d9e-462f-b424-bb389054e645 0 45b4435a-3e05-47c4-b78b-0e5311154a91 ::ffff:172.16.16.100 {} 8da259cac80248a0b1258dffa22a0bc5585c668b
3 20170321T215731.444+0100 INFO QlikServer1 Audit.Proxy.Proxy.SessionEstablishment.Authentication.TicketValidator 14 ab854bb8-5c99-4a1c-8b76-00a443e94684 DOMAIN\qvservice Issued ticket 'ewXLiJDk6xM1Q0TH' for user, valid for 1 minute(s) 0 DOMAIN qvservice ewXLiJDk6xM1Q0TH 7f97ce8a8282eb9ed7aa0b61722b2504241e0e09
4 20170321T215731.470+0100 INFO QlikServer1 Audit.Proxy.Proxy.SessionEstablishment.Authentication.AuthenticationHandler 14 f27f9ebc-4ad4-4d5a-968d-13e910e1efab DOMAIN\qvservice User claimed ticket: 'ewXLiJDk6xM1Q0TH' 0 583a2b2e-5aeb-4292-9d02-d1c4e5a1cd0b DOMAIN qvservice ewXLiJDk6xM1Q0TH ::ffff:172.16.16.100 {} e025a74e13bb4c759fe5ad99787ad5589381b7bf
5 20170321T215731.891+0100 INFO QlikServer1 Audit.Proxy.Proxy.DefaultModules.Session.SessionClientHandler 8 8dfacde2-3963-432b-af75-22d5122b5fea DOMAIN\qvservice Syncing user attributes for user DOMAIN\qvservice was successful fe87b122-8979-45d4-9c37-3c39ce704045 583a2b2e-5aeb-4292-9d02-d1c4e5a1cd0b DOMAIN qvservice ewXLiJDk6xM1Q0TH ::ffff:172.16.16.100 {} df162a32bfed4ae4c37531b6f1ad4e7cb18b708e
6 20170321T215732.018+0100 INFO QlikServer1 Audit.Proxy.Proxy.SessionEstablishment.Authentication.AuthenticationHandler 14 711c200a-60e9-457a-be6c-89f1ce11bf82 DOMAIN\qvservice User 'qvservice' used 'ticket' authentication, got session: 'fe87b122-8979-45d4-9c37-3c39ce704045' fe87b122-8979-45d4-9c37-3c39ce704045 583a2b2e-5aeb-4292-9d02-d1c4e5a1cd0b DOMAIN qvservice ewXLiJDk6xM1Q0TH ::ffff:172.16.16.100 {} 7fa218f968005afa6c0e635058e1e6c290e90d76
7 20170321T215735.128+0100 INFO QlikServer1 Audit.Proxy.Proxy.SessionEstablishment.LoadBalancingHandlerDependencies 8 11c49eb7-4ce8-45be-98d1-76a10f34562c DOMAIN\qvservice Retrieved 1 engine(s) from repository, result code Ok, app: __hub fe87b122-8979-45d4-9c37-3c39ce704045 355bcda7-26f1-4a41-94d5-c5c88499abb8 DOMAIN qvservice ::ffff:172.16.16.100 qlikserver1.domain.local:4242 {} 7b0262f7f34c583b38c13639692a495540079d74
8 20170321T215735.144+0100 INFO QlikServer1 Audit.Proxy.Proxy.SessionEstablishment.LoadBalancingHandlerDependencies 8 29022811-cbe3-4f9d-ba19-b3bb50f37e0e DOMAIN\qvservice Cached 1 prioritised Engine(s), app: __hub fe87b122-8979-45d4-9c37-3c39ce704045 355bcda7-26f1-4a41-94d5-c5c88499abb8 DOMAIN qvservice ::ffff:172.16.16.100 qlikserver1.domain.local:4242 {} 5ff601a6ada967d7d6c9990a1bddbe25e7bbc1cf
9 20170321T215735.186+0100 INFO QlikServer1 Audit.Proxy.Proxy.SessionEstablishment.LoadBalancingHandlerDependencies 24 dbf6cd5b-735e-4112-94c3-4db366bbe4b2 DOMAIN\qvservice New target uri chosen: https://qlikserver1.domain.local:4900/ , app: __hub fe87b122-8979-45d4-9c37-3c39ce704045 355bcda7-26f1-4a41-94d5-c5c88499abb8 DOMAIN qvservice ::ffff:172.16.16.100 qlikserver1.domain.local:4900 {} ba0e44b68b214c47fea575e93244c3c5f159c281
10 20170321T215743.535+0100 INFO QlikServer1 Audit.Proxy.Proxy.SessionEstablishment.LoadBalancingHandlerDependencies 8 7bcf1a03-6cfe-45ea-a06b-d1a780528be0 DOMAIN\qvservice Retrieved 1 engine(s) from repository, result code Ok, app: c3ed4e49-dc98-4ff8-b140-f3d945236197 fe87b122-8979-45d4-9c37-3c39ce704045 79705676-f6f7-4396-8771-9f9f2a57f711 DOMAIN qvservice ::ffff:172.16.16.100 c3ed4e49-dc98-4ff8-b140-f3d945236197 {} fe793ff3d692d1992e38f7be35c3a15d93ada65d
11 20170321T215743.535+0100 INFO QlikServer1 Audit.Proxy.Proxy.SessionEstablishment.LoadBalancingHandlerDependencies 8 425b5b86-579e-410f-8721-a816841bc16a DOMAIN\qvservice Cached 1 prioritised Engine(s), app: c3ed4e49-dc98-4ff8-b140-f3d945236197 fe87b122-8979-45d4-9c37-3c39ce704045 79705676-f6f7-4396-8771-9f9f2a57f711 DOMAIN qvservice ::ffff:172.16.16.100 c3ed4e49-dc98-4ff8-b140-f3d945236197 {} ab51d2ad92cef8fff57fb15b1d5b115eeabedecb
12 20170321T215743.563+0100 INFO QlikServer1 Audit.Proxy.Proxy.SessionEstablishment.LoadBalancingHandlerDependencies 24 4c8e93c3-b3c9-475b-aa03-b8290f196014 DOMAIN\qvservice New target uri chosen: wss://qlikserver1.domain.local:4747/, app: c3ed4e49-dc98-4ff8-b140-f3d945236197 fe87b122-8979-45d4-9c37-3c39ce704045 79705676-f6f7-4396-8771-9f9f2a57f711 DOMAIN qvservice ::ffff:172.16.16.100 c3ed4e49-dc98-4ff8-b140-f3d945236197 qlikserver1.domain.local:4747 {} f27c34ac0b7976a062ef3ea21d129acf451b0e65
This log only tracks the initial Session from the first Open, since the session is already established for the User. Further opening of the same app will not trigger a new entry for this Session/App ID
Final Note: There were no tests and review of entries for any new user sessions, different App IDs or for when the session times out or is forcible closed (closing the browser).