The Qlik Sense log files can be easily collected using the Log Collector. 

The Log Collector is embedded in the Qlik Sense Management Console. It is the last item listed in the Configure Systems section.

For instructions on how to use the Log Collector, see Log collector (help.qlik.com).

Content

• Requirements
• Using the Log Collector
• What does the Qlik Sense Log Collector access?
• Manually collecting log files
• Older Qlik Sense Versions (3.1 and earlier)

Requirements

The user must be a root admin and have administrative permissions.

Using the Log Collector

The best way to gather these logs is to use the Qlik Sense Log Collector. If the tool is not included in your install, it can be downloaded from this article. 

1. Login to Windows Server on Qlik Sense node
2. Open Windows File Explorer
3. Navigate to Log Collector folder at C:\Program Files\Qlik\Sense\Tools\QlikSenseLogCollector
4. Press Shift key and right click on QlikSenseLogCollector.exe 
5. Select Run as different user
6. Enter Qlik Sense service account credentials.
7. Configure log collection
   • Date range to collect logs from (minimum of 5 days if possible)
   • Support case number to include in ZIP file name
   • Select options 
   • Include Archive logs
8. Click Collect
9. If Qlik Sense is not automatically accessible on the node, further options are presented.  
   • Qlik Sense is running and on this host
     this option to get more options on automatic log collection
   • Qlik Sense is not running or accessible
     this option allows to define the path to local Qlik Sense log folder
   • Qlik Sense is located elsewhere
     this option allows to enter FQDN of remote Qlik Sense server
10. Wait until collection is finished
11. Click Close
12. Open generated ZIP file in C:\Program Files\Qlik\Sense\Tools\QlikSenseLogCollector
    Note, no need to unzip the file, simple double click on the ZIP file to browse its content
    • Confirm it contains JSON and TXT files, if system info options were enabled in Step 6
    • Confirm there is one folder per node in the deployment, named in same way as the node
    • Confirm there is a Log folder representing Archived Logs from persistent storage
13. If ZIP content is incomplete, repeat steps above or contact support for further guidance
14. If ZIP content is accurate, attach ZIP file to support case for further analysis by Qlik

What does the Qlik Sense Log Collector access?

This list provides an overview of what system information the Qlik Sense Log collector accesses and collects.

• WhoAmI (information)

  C:\Windows\System32\whoami.exe

• Port status (information)

  C:\Windows\System32\netstat.exe -anob

• Process Info (information)

  C:\Windows\System32\tasklist.exe /v

• Firewall Info (information)

  C:\Windows\System32\netsh.exe advfirewall show allprofiles

• Network Info (information)

   C:\Windows\System32\ipconfig.exe /all

• IIS Status (iisreset /STATUS Display the status of all Internet services.)

   C:\Windows\System32\iisreset.exe /status

• Proxy Activated (information)

   C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | find /i "ProxyEnable"

• Proxy Server (information)

   C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | find /i "proxyserver" 

• Proxy AutoConfig (information)

   C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | find /i "AutoConfigURL" 

• Proxy Override (information)

   C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | find /i "ProxyOverride" 

• Internet Connection (information)

   C:\Windows\System32\ping.exe google.com

• Drive Mappings (information)

   C:\Windows\System32\net.exe use

• Drive Info (information)

   C:\Windows\System32\wbem\wmic.exe /OUTPUT:STDOUT logicaldisk get size

• Localgroup Administrators (information)

   C:\Windows\System32\net.exe localgroup "Administrators"

• Localgroup Sense Service Users (information)

   C:\Windows\System32\net.exe localgroup "Qlik Sense Service Users"

• Localgroup Performance Monitor Users (information)

   C:\Windows\System32\net.exe localgroup "Performance Monitor users"

• Localgroup Qv Administrators (information)

   C:\Windows\System32\net.exe localgroup "QlikView Administrators"

• Localgroup Qv Api (information)

   C:\Windows\System32\net.exe localgroup "QlikView Management API"

• System Information (information)

   C:\Windows\System32\systeminfo.exe

• Program List (information)

   C:\Windows\System32\wbem\wmic.exe /OUTPUT:STDOUT product get name

• Service List (information)

   C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "gwmi win32_service | select Started

• Group Policy (information)

  C:\Windows\System32\gpresult.exe /z

• Local Policies - User Rights Assignment (information)

   C:\Windows\System32\secedit.exe /export /areas USER_RIGHTS /cfg

• Local Policies - Security Options (information)

   C:\Windows\System32\secedit.exe /export /areas

• Certificate - Current User(Personal) (information)

   C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "Get-ChildItem -Recurse Cert:\currentuser\my | Format-list"

• Certificate - Current User(Trusted Root) (information)

   C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "Get-ChildItem -Recurse Cert:\currentuser\Root | Format-list"

• Certificate - Local Computer(Personal) (information)

   C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "Get-ChildItem -Recurse Cert:\localmachine\my | Format-list"

• Certificate - Local Computer(Trusted Root) (information)

   C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "Get-ChildItem -Recurse Cert:\localmachine\Root | Format-list"

• HotFixes (information)

  $FormatEnumerationLimit=-1;$Session = New-Object -ComObject Microsoft.Update.Session;$Searcher = $Session.CreateUpdateSearcher();$historyCount = $Searcher.GetTotalHistoryCount();$Searcher.QueryHistory(0, $historyCount) | Select-Object Title, Description, Date, @{name="Operation"; expression={switch($_.operation){1 {"Installation"}; 2 {"Uninstallation"}; 3 {"Other"}}}} | out-string -Width 1024

• UrlAclList (information)

   C:\Windows\System32\netsh.exe http show urlacl

• PortCertList (information)

   C:\Windows\System32\netsh.exe http show sslcert

Manually collecting log files

Any versions of Qlik Sense Enterprise on Windows prior to May 2021, do not include the Log Collector.

If the Qlik Sense Log collector does not work then you can manually gather the logs.

• Default storage (before archiving): C:\ProgramData\Qlik\Sense\Log
• Default archive storage: C:\ProgramData\Qlik\Sense\Repository\Archived Logs
• Manual retrieval of Reload logs: How to find the Script (Reload) logs in Qlik Sense Enterprise

For information on when logs are archived, see How logging works in Qlik Sense Enterprise on Windows.

Older Qlik Sense Versions (3.1 and earlier)

Persistence Mechanism Current Logs(Active Logs) Archived Logs

Note: Depending on how long the system has been running, this folder can be very large so you will want to include only logs from the time frame relevant to your particular issue; preferably a day before the issue began occurring.

Related Content

How logging works in Qlik Sense Enterprise on Windows 

Qlik Sense Enterprise Client-Managed offers a range of Monitoring Applications that come pre-installed with the product.

Qlik Cloud offers the Data Capacity Reporting App for customers on a capacity subscription, and additionally customers can opt to leverage the Qlik Cloud Monitoring apps.

This article provides information on available apps for each platform.

Content:

• Qlik Cloud
• Data Capacity Reporting App
• Access Evaluator for Qlik Cloud
• Answers Analyzer for Qlik Cloud
• App Analyzer for Qlik Cloud
• Automation Analyzer for Qlik Cloud
• Entitlement Analyzer for Qlik Cloud
• Reload Analyzer for Qlik Cloud
• Report Analyzer for Qlik Cloud
• How to automate the Qlik Cloud Monitoring Apps
• Other Qlik Cloud Monitoring Apps
• OEM Dashboard for Qlik Cloud
• Monitoring Apps for Qlik Sense Enterprise on Windows
• Operations Monitor and License Monitor
• App Metadata Analyzer
• The Monitoring & Administration Topic Group
• Other Apps

Qlik Cloud

Data Capacity Reporting App

The Data Capacity Reporting App is a fully supported app distributed within the product. For more information, see Qlik Help.

Access Evaluator for Qlik Cloud

For more information, see Qlik Cloud Access Evaluator.

Answers Analyzer for Qlik Cloud

For more information, see Qlik Cloud Answers Analyzer.

App Analyzer for Qlik Cloud

For more information, see Qlik Cloud App Analyzer.

Automation Analyzer for Qlik Cloud

For more information, see Qlik Cloud Automation Analyzer.

Entitlement Analyzer for Qlik Cloud

The Entitlement Analyzer is a Qlik Sense application built for Qlik Cloud, which provides Entitlement usage overview for your Qlik Cloud tenant for user-based subscriptions.

The app provides:

• Which users are accessing which apps
• Consumption of Professional, Analyzer and Analyzer Capacity entitlements
• Whether you have the correct entitlements assigned to each of your users
• Where your Analyzer Capacity entitlements are being consumed, and forecasted usage

For more information, see The Entitlement Analyzer.

Reload Analyzer for Qlik Cloud

For more information, see Qlik Cloud Reload Analyzer.

Report Analyzer for Qlik Cloud

For more information, see Qlik Cloud Report Analyzer.

How to automate the Qlik Cloud Monitoring Apps

Do you want to automate the installation, upgrade, and management of your Qlik Cloud Monitoring apps? With the Qlik Cloud Monitoring Apps Workflow, made possible through Qlik's Application Automation, you can:

1. Install/update the apps with a fully guided, click-through installer using an out-of-the-box Qlik Application Automation template. 
2. Programmatically rotate the API key that is required for the data connection on a schedule using an out-of-the-box Qlik Application Automation template. This ensures that the data connection is always operational. 
3. Get alerted whenever a new version of a monitoring app is available using Qlik Data Alerts. 

For more information and usage instructions, see Qlik Cloud Monitoring Apps Workflow Guide.

Other Qlik Cloud Monitoring Apps

OEM Dashboard for Qlik Cloud

For more information and to download the app and usage instructions, see Qlik Cloud OEM Dashboard & Console Settings Collector.

With the exception of the Data Capacity Reporting App, all Qlik Cloud monitoring applications are provided as-is and are not supported by Qlik. Over time, the APIs and metrics used by the apps may change, so it is advised to monitor each repository for updates and to update the apps promptly when new versions are available.

If you have issues while using these apps, support is provided on a best-efforts basis by contributors to the repositories on GitHub.

Monitoring Apps for Qlik Sense Enterprise on Windows

Operations Monitor and License Monitor

The Operations Monitor loads service logs to populate charts covering performance history of hardware utilization, active users, app sessions, results of reload tasks, and errors and warnings. It also tracks changes made in the QMC that affect the Operations Monitor.

The License Monitor loads service logs to populate charts and tables covering token allocation, usage of login and user passes, and errors and warnings.

For a more detailed description of the sheets and visualizations in both apps, visit the story About the License Monitor or About the Operations Monitor that is available from the app overview page, under Stories.

Basic information can be found here:

The License Monitor 
The Operations Monitor 

Both apps come pre-installed with Qlik Sense. 

If a direct download is required: Sense License Monitor | Sense Operations Monitor. Note that Support can only be provided for Apps pre-installed with your latest version of Qlik Sense Enterprise on Windows. 

App Metadata Analyzer

The App Metadata Analyzer app provides a dashboard to analyze Qlik Sense application metadata across your Qlik Sense Enterprise deployment. It gives you a holistic view of all your Qlik Sense apps, including granular level detail of an app's data model and its resource utilization.

Basic information can be found here: 

App Metadata Analyzer (help.qlik.com)

For more details and best practices, see: 

App Metadata Analyzer (Admin Playbook)

The app comes pre-installed with Qlik Sense.

The Monitoring & Administration Topic Group

Looking to discuss the Monitoring Applications? Here we share key versions of the Sense Monitor Apps and the latest QV Governance Dashboard as well as discuss best practices, post video tutorials, and ask questions.

Monitoring & Administration 

Other Apps

LogAnalysis App: The Qlik Sense app for troubleshooting Qlik Sense Enterprise on Windows logs 
Sessions Monitor, Reloads-Monitor, Log-Monitor 
Connectors Log Analyzer 

All Other Apps are provided as-is and no ongoing support will be provided by Qlik Support.

Content

• Rationale
• Understanding interactive IdPs in Qlik Cloud
• Why Qlik Cloud only supports one interactive IdP
• Why Federate Identity In-House?
• Solution: Federate IdPs with an enterprise-grade IdP
• How to Implement a Federated IdP
• Conclusion

Qlik Cloud is designed to support a single interactive Identity Provider (IdP) per tenant.

This approach enhances security, governance, and operational control while simplifying authentication management. Organizations that require multiple identity sources can achieve this by using a federated IdP (such as Azure Entra, Auth0, Keycloak, or Okta) to consolidate authentication and seamlessly connect it to Qlik Cloud

Rationale

Understanding interactive IdPs in Qlik Cloud

Qlik Cloud allows organizations to configure an interactive IdP to manage user authentication. Options include:

• Qlik Account (default for new, non-government tenants).
• A standards-compliant OIDC or SAML provider, such as Azure Entra, Okta, Auth0, or Keycloak.

Any unauthenticated user attempting to access the tenant is redirected to the configured interactive IdP for authentication, ensuring a streamlined and secure login experience.

Why Qlik Cloud only supports one interactive IdP

Using a single interactive IdP is a best practice for identity management and ensures consistency, security, and simplified administration.

Key reasons include:

• User Identity Consistency: Qlik Cloud relies on a user's subject and email as unique identifiers. Managing a single interactive IdP helps prevent duplicate identities and ensures seamless user access, reducing risk of users gaining unauthorized access to sensitive data or permissions.

• Streamlined Identity & Access Management: Since Qlik Cloud does not transform incoming claims beyond remapping keys, keeping authentication centralized prevents unintended variances in usernames, email formats, or group names. This improves security and reduces maintenance of licenses and entitlements.

• Optimized Group Management: A single interactive IdP provides a consistent structure for groups, ensuring they align with an organization’s access policies. By managing group filtering in one place, organizations can maintain clear and structured permissions. Managing groups across multiple IdPs can quickly become unmanageable, leading to inconsistencies in user access.

• Simplified Access Control: Groups in Qlik Cloud are referenced by name, making it more efficient to manage access through a single federated IdP rather than multiple sources.

• Efficient Token Management: A unified IdP helps maintain consistency in authentication tokens, reducing administrative overhead and ensuring a smooth user experience.

• Enhanced Security & Auditability: By centralizing authentication through a single IdP, organizations can apply security controls, enforce device policies, and monitor user access through audit logs.

A federated IdP ensures that organizations retain full control over authentication policies, while providing a seamless experience for users accessing Qlik Cloud.

Why Federate Identity In-House?

Many organizations choose to use a federated identity provider to streamline identity management, enhance security, and improve user experience across multiple applications. Benefits include:

• Centralized User Lifecycle Management: Users from different sources can be managed in a single system, reducing duplication and inconsistencies.

• Improved Security Policies: Organizations can enforce multi-factor authentication (MFA), conditional access policies, and device trust settings at the IdP level.

• Single Sign-On (SSO) Across Applications: Users authenticate once and gain seamless access to multiple platforms, including Qlik Cloud.

• Comprehensive Logging & Compliance: A federated IdP provides consolidated audit trails and governance controls for user authentication.

By implementing a federated identity provider, organizations can maintain flexibility in their authentication strategy while ensuring compatibility with Qlik Cloud.

Solution: Federate IdPs with an enterprise-grade IdP

The recommended approach for organizations that need to authenticate users across multiple identity sources is to configure a federated IdP that consolidates authentication. Solutions like Azure Entra ID or Okta can be used to unify identity management and connect to Qlik Cloud via OIDC or SAML.

How to Implement a Federated IdP

1. Set Up a Federated IdP (Azure Entra ID, Okta, or another identity management solution).

2. Sync Identity Sources within the federated IdP to ensure unique identities across different user groups.

3. Configure OIDC/SAML Authentication in Qlik Cloud with the federated IdP.

This approach ensures a secure, efficient, and scalable authentication strategy that aligns with best practices for enterprise identity management.

Conclusion

Qlik Cloud is designed to integrate seamlessly with a single interactive IdP, providing a robust and secure authentication framework. Organizations that need to consolidate multiple identity sources can achieve this through a federated IdP, ensuring centralized management, improved security, and a streamlined user experience. By leveraging enterprise-grade IdPs like Azure Entra ID or Okta, organizations can enhance their identity management strategy while maintaining full control over authentication policies and governance.

Environment

• Qlik Cloud

When using SAML or ticket authentication in Qlik Sense, some users belonging to a big number of groups see the error 431 Request header fields too large on the hub and cannot proceed further.

Resolution

The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.

The default setting will still be a header size of 8192 bytes. The fix adds support for a configurable MaxHttpHeaderSize.

Steps:

1. To configure add it at the top section of the file under [globals] (C:\Program Files\Qlik\Sense\ServiceDispatcher\service.conf)

   [globals]
   LogPath="${ALLUSERSPROFILE}\Qlik\Sense\Log"
   (...)
   MaxHttpHeaderSize=16384

2. Once the change is done, save the file and restart the Qlik Service Dispatcher service.

Note: The above value (16384) is an example. You may need to put more depending on the total number of characters of all the AD groups to which the user belongs. The max value is 65534.

Environment:

Qlik Sense Enterprise on Windows 

Can deleted Qlik Cloud apps or sheets be recovered? Can apps, sheets, or automations owned by a deleted user be recovered?

Once an app or sheet has been deleted it cannot be recovered.

What about deleted users and their orphaned objects?

Orphaned apps (created when the user has been deleted) can be reassigned. See Qlik Cloud Analytics: Can the owner of orphaned Apps be changed after the owner is deleted? for instructions.

For more information about what to consider before deleting a user, see Deleting users.

The following cannot be recovered:

• A deleted app
• A deleted sheet
• Personal objects belonging to a deleted user become unavailable immediately and may be purged during a cleanup process
• Automations belonging to a deleted user

Qlik suggests the following techniques to ensure no work is lost:

• Duplicate the app to the same or different 'Shared' or 'Personal' space
• Setup a test or 'recycle bin' space where duplicated apps are kept until it has been verified that the app can be fully deleted
• If space is a concern, export the app without data and re-import it to the 'recycle bin' space. This will allow you to keep an empty master copy of the app

Qlik has received feedback in the past to implement a recovery feature: Recycle bin for SaaS editions of Qlik Sense (#279017) (Log in to Qlik Ideation to leave comments and vote.)

Content

• Chapters
• Environment overview
• Zabbix Server set-up
• Clone the Zabbix docker repository
• Setting up environment variables
• Re-link compose.yaml to our preferred compose file
• Logging in for the first time
• Zabbix Agent installation on Windows Server
• Zabbix Server Configuration
• Adding the first Server
• Importing Qlik Sense Enterprise for Windows templates
• Linking templates to hosts
• Engine Healthcheck Monitoring with HTTP Agent example
• Steps to configure a new HTTP Agent for QSE Health monitoring
• Defining the Virtual Proxy prefix for Zabbix HTTP Agent
• Resources & Links

Chapters

• 01:33 - Why use Zabbix
• 02:35 - Architecture for demo
• 03:41 - Downloading the installer
• 04:36 - Installing Zabbix Server
• 08:37 - Installing the Zabbix agent
• 12:17 - Applying Qlik specific templates
• 14:28 - Reviewing Qlik-specific Dashboards
• 16:49 - Configuration details
• 18:42 - How to create a dashboard
• 20:30 - Q&A: Can Zabbix run on Windows?
• 21:16 - Q&A: Is Zabbix supported by Qlik?
• 21:36 - Q&A: Can this monitor data capacity?
• 22:45 - Q&A: Can the Zabbix agents affect performance?
• 23:20 - Q&A: Can it monitor bookmark size?
• 24:02 - Q&A: Can this monitor amount of data being used?
• 24:19 - Q&A: Can this monitor sheets, and objects in apps?
• 24:49 - Q&A: Is there a similar tool for Cloud?
• 25:36 - Q&A: Would this work with QlikView?
• 26:11 - Q&A: Does this read the app data?
• 26:26 - Q&A: Can this help measure how long to open an app?

Environment overview

The environment being demonstrated in this article consists of one Central Node and Two Worker Nodes. Worker 1 is a Consumption node where both Development and Production apps are allowed. Worker 2 is a dedicated Scheduler Worker node where all reloads will be directed. Central Node is acting as a Scheduler Manager.

Zabbix Server set-up

The Zabbix Monitoring appliance can be downloaded and configured in a number of ways, including direct install on a Linux server, OVF templates and self-hosting via Docker or Kubernetes. In this example we will be using Docker. We assume you have a working docker engine running on a server or your local machine. Docker Desktop is a great way to experiment with these images and evaluate whether Zabbix fits in your organisation.

Clone the Zabbix docker repository

This will include all necessary files to get started, including docker compose stack definitions supporting different base images, features and databases, such as MySQL or PostgreSQL. In our example, we will invoke one of the existing Docker compose files which will use PostgreSQL as our database engine.

Source: https://www.zabbix.com/documentation/current/en/manual/installation/containers#docker-compose

git clone https://github.com/zabbix/zabbix-docker.git

Setting up environment variables

Here you can modify environment variables as needed, to change things like the Stack / Composition name, default ports and many other settings supported by Zabbix.

cd ./zabbix-docker/env_vars
ls -la #to list all hidden files (.dotfiles)
nano .env_web

In this file, we will change the value for ZBX_SERVER_NAME to something else, like "Qlik STT - Monitoring". Save the changes and we are ready to start up Zabbix Server.

Re-link compose.yaml to our preferred compose file

./zabbix-docker folder contains many different docker compose templates, either using public images or locally built (latest and local tags).

You can run your chosen base image and database version with:

docker compose -f compose-file.yaml up -d && docker compose logs -f --since 1m

Or unlink and re-create the symbolic link to compose.yaml, which enables managing the stack without specifying a compose file. Run the following commands inside the zabbix-docker folder to use the latest Ubuntu-based image with PostgreSQL database:

1. unlink compose.yaml
2. ln -s ./docker-compose_v3_ubuntu_pgsql_latest.yaml compose.yaml
3. Start the Zabbix stack in detached mode with docker compose up -d

If you skip the -d flag, the Docker stack will start and your command line will be connected to the log output for all containers. The stack will stop if you exit this mode with CTRL+C or by closing the terminal session. Detached mode will run the stack in background. You can still connect to the live log output, pull logs from history, manage the stack state or tear it down using docker compose down.

Pro tip: you will be using docker compose commands often when working with Docker. You can create an alias in most shells to a short-hand, such as "dc = docker compose". This will still accept all following verbs, such as start|stop|restart|up|down|logs and all following flags. docker compose up -d && docker compose logs -f --since 1m would become dc up -d && dc logs -f --since 1m.

Logging in for the first time

• By default, the Zabbix Web GUI will be exposed on ports 80/443
• Using tools like Portainer makes Docker stack management easier

Use the IP address of your Docker host: http://IPADDRESS or https://IPADDRESS.

The Zabbix server stack can be hosted behind a Reverse Proxy.

The default username is Admin and the default password is zabbix. They are case sensitive.

Zabbix Agent installation on Windows Server

Download link: https://www.zabbix.com/download_agents, in this case download the Windows installer MSI.

1. Run the installer .msi
2. Leave components unchanged
3. Hostname = your machine hostname, we will have to use the same hostname when adding a Host in Zabbix Server.
4. Zabbix server IP/DNS: IP address or DNS name of your Zabbix Server
5. Agent listening port, the same port will be used when when adding a Host in Zabbix Server.
6. Enable "Add agent location to the PATH" for convenience in the command line
7. Finish installation

Zabbix Server Configuration

Adding the first Server

After Agent is installed, in Zabbix go to Data Collection > Hosts and click on Create host in the top right-hand corner. Provide details like hostname and port to connect to the Agent, a display name and adjust any other parameters. You can join clusters with Host groups. This makes navigating Zabbix easier.

Fig 1: Adding a Host

 

Note: Remember to change how Zabbix Server will connect to the Agent on this node, either with IP address or DNS. Note that the default IP address points to the Zabbix Server.

Importing Qlik Sense Enterprise for Windows templates

In the Zabbix Web GUI, navigate to Data Collection > Templates and click on the Import button in the top right-hand corner. You can find the templates file at the following download link:

LINK to zabbix templates

Linking templates to hosts

Once you have added all your hosts to the Data Collection section, we can link all Qlik Sense servers in a cluster using the same templates. Zabbix will automatically populate metrics where these performance counters are found. From Data Collection > Hosts, select all your Qlik Sense servers and click on "Mass update". In the dialog that comes up, select the "Link templates" checkbox. Here you can link/replace/unlink templates across many servers in bulk.

Select "Link" and click on the "Select" button. This new panel will let us search for Template groups and make linking a bit easier. The Template Group we provided contains 4 individual templates.

Fig 2: Mass update panel

Fig 3: Search for Template Group

Once you Select and Update on the main panel, all selected Hosts will receive all items contained in the templates, and populate all graphs and Dashboards automatically.

To review your data, navigate to Monitoring > Hosts and click on the "Dashboards" or "Graphs" link for any node, here is the default view when all Qlik Sense templates are linked to a node:

Fig 4: Host Dashboards

 

Fig 5: Repository Service metrics - Example

Engine Healthcheck Monitoring with HTTP Agent example

We will query the Engine Healthcheck end-point on QlikServer3 (our consumer node) and extract usage metrics from by parsing the JSON output.

Steps to configure a new HTTP Agent for QSE Health monitoring

We will be using a new Anonymous Access Virtual Proxy set up on each node. This Virtual Proxy will only Balance on the node it represents, to ensure we extract meaningful metrics from the Engine and we won't be load-balanced by the Proxy service across multiple nodes. There won't be a way to determine which node is responding, without looking at DevTools in your browser. You can also use Header or Certificate authentication in the HTTP Agent configuration.

Once the Virtual Proxy is configured with Anonymous Only access, we can use this new prefix to configure our HTTP Agent in Zabbix.

Defining the Virtual Proxy prefix for Zabbix HTTP Agent

In the Zabbix web GUI, go to Data collection > Hosts. Click on any of your hosts. On tabs at the top of the pop-up, click on Macros and click on the "Inherited and host macros" button. Once the list has loaded, search for the following Macro: {$VP_PREFIX}. This is set by default to "anon". Click on "Change" and set Macro value to your custom Virtual Proxy Prefix for Engine diagnostics, and click Update. The Virtual Proxy prefix will have to be changed on each node for the "Engine Performance via HTTP Agent" item to work. Alterantively, you can modify the MACRO value for the Template, this will replicate the changes across all nodes associated to this Template.

To make this change at the Template level, go to Data collection > Templates. Search for the "Engine Performance via HTTP Agent" and click on the Template. Navigate to the Macros tab in the pop-up and add your Virtual Proxy Prefix here to make this the new default for your environment. No further changes to Node configuration are required at this point.

The Zabbix templates provided in this article contain the following Engine metric JSONParsers:

• Memory: Allocated, Committed, Free, Total Physical
• Calls, Selections
• Saturation status (true/false)
• Sessions: Active/Total
• Users: Active/Total

These are the same performance counters that you can see in the Engine Health section in QMC.

Stay tuned to new releases of the Monitoring Templates. Feel free to customise these to your needs and share with the Community.

Resources & Links

• Zabbix home page
• Zabbix Installation from containers documentation
• Zabbix Docker repository on GitHub
• Install Docker Engine on Ubuntu

Environment

• Qlik Sense Enterprise on Windows

Some script logs are not transferred to Archive log Folder.

Storage Locations:

Qlik Sense log folder:

C:\ProgramData\Qlik\Sense\Log\Script
Log names consist out of the AppID and a year, date, and timestamp.

Archived log Folder:

 \\SERVICECLUSTER-SHARE\ArchivedLogs\NodeName\Script
Log names consist out of the AppID and a year, date, and timestamp.

Environment:

• Qlik Sense Enterprise on Windows, all versions

Resolution:

By design, not all script logs are transferred to the Archived logs folder. Reloads executed from the hub are not transferred. 

1. When reloading data in app via hub, Script log will be left in Script log folder C:\ProgramData\Qlik\Sense\Log\Script

2. When reloading data via QMC/task, Script log will be transferred to Archived logs folder \\SERVICECLUSTER-SHARE\ArchivedLogs\NodeName\Script

Related Content:

• How to find the Script (Reload) logs in Qlik Sense Enterprise

Question

When using the unattended installer to install Talend on-prem products, such as TAC (Talend Administration Center), there is no visible log. Where can you find the log, and how can you determine if the products have been successfully installed?

The installation log is located in /tmp for Linux and %TEMP% for Windows. The file name will be "installbuilderinstaller.log". To locate the correct install log, please refer to the timestamp at the end, as multiple installation logs may exist in the temp directory.

To confirm successful installation, it is best to inspect the installation folder. Upon successful completion, a file named uninstall (for Linux) or uninstall.exe (for Windows) will be generated at the root of the installation folder. With default settings, the file will be located at /opt/Talend-8.0.1/uninstall or C:\Talend\8.0.1\uninstall.exe.

It is not possible to set up a Microsoft Office 365 email provider with OAuth 2.0 authentication.
The HAR file shows this message in Network:

{connectionFailed: true, message: "Error during email request", success: false}
connectionFailed: true
message: "Error during email request"
success: false

Resolution

Configure the Mail.Send permission as it is described in Configuring a Microsoft 365 email provider using OAuth2.

Cause

This problem occurs when the Mail.Send permission has not been configured in the app registration.

Related Content

More information about the  Mail.Send permission can be found in Application permission to Microsoft Graph (learn.microsoft.com).

Environment

• Qlik Tabular reporting
• Qlik Cloud

Information about app and storage size for Qlik Cloud for Qlik Sense Enterprise SaaS and Qlik Sense Business can be found in Qlik Sense capacity.  

Note: An app on disk is typically 4-6 times bigger in memory, although this is a rule of thumb and exceptions can and do occur, and an app within the "on-disk" size limit may balloon past the "in memory" limit.  

App Objects have a memory limit of 10 GB, except when run on dedicated capacity.

If you are looking to compare other features between Qlik Sense Business and Qlik Sense Enterprise SaaS, see Compare product features 

For more information about capacity, see:

Qlik Sense specifications and capacity 
Pricing | Qlik Sense

This can help in the troubleshooting process to find out what App/User was active and accessed an application right before an error/issue in the environment.
 
The entries are color coded for the name of the App in the Hub/QMC along with the APP ID and Session ID
 
Note: Session ID will change for different users and different browsers, this includes closing the browser and reopening it (which is a new session, but will be the same App ID). In this test there's only one session and two accesses of the app, but a user can open the app in another browser which will show it as the same user in two different sessions for the same app at the same time.
 

Environment: 

Qlik Sense Enterprise on Windows , version 3.2.1 and newer, single node

Windows 2012 R2

App Name: Load Test APP ID
Published APP ID?: c3ed4e49-dc98-4ff8-b140-f3d945236197 - Load Test APP ID
Session ID?: fe87b122-8979-45d4-9c37-3c39ce704045 - Load Test APP ID

C:\ProgramData\Qlik\Sense\Log\Engine\Trace\QLIKSERVER1_System_Engine.txt
 
First Open (loaded into memory):
 
16           20170321T215743.565+0100       INFO      QlikServer1         System.Engine.Engine   46           6f40f67b-47aa-406f-bb78-947e90cd9ff3         DOMAIN\qvservice         QvSocket: Connected to server as user: 'UserDirectory=DOMAIN; UserId=qvservice' for document: '/app/c3ed4e49-dc98-4ff8-b140-f3d945236197' on socket fe80::743e:6e47:b9f:acb5:4747 <-> fe80::743e:6e47:b9f:acb5:62282         0              Internal Engine                20170321T215743.566+0100       3136       3176       20170321T215516.000+0100       6f40f67b-47aa-406f-bb78-947e90cd9ff3
17           20170321T215743.573+0100       INFO      QlikServer1         System.Engine.Engine   46           31b65464-36b3-48c1-8dc8-f7b5c2ecbb9b              DOMAIN\qvservice         Server: Document Load: Beginning open of document                fe87b122-8979-45d4-9c37-3c39ce704045              DOMAIN              qvservice             20170321T215743.573+0100                3132       3176       20170321T215516.000+0100       31b65464-36b3-48c1-8dc8-f7b5c2ecbb9b
18           20170321T215743.597+0100       INFO      QlikServer1         System.Engine.Engine   46           610de372-ad42-4975-863b-93f5d9fbcbec              DOMAIN\qvservice         DOC loading: Beginning load of document C3ED4E49-DC98-4FF8-B140-F3D945236197.           fe87b122-8979-45d4-9c37-3c39ce704045              DOMAIN              qvservice                20170321T215743.597+0100       3756       3176       20170321T215516.000+0100       610de372-ad42-4975-863b-93f5d9fbcbec
19           20170321T215744.640+0100       INFO      QlikServer1         System.Engine.Engine   46           f15e84d0-f8d9-44d1-a8e1-3095b41e4a0d        DOMAIN\qvservice         Document Load: The document c3ed4e49-dc98-4ff8-b140-f3d945236197 was loaded.          fe87b122-8979-45d4-9c37-3c39ce704045              DOMAIN              qvservice                20170321T215744.641+0100       4468       3176       20170321T215516.000+0100       f15e84d0-f8d9-44d1-a8e1-3095b41e4a0d
 
Second Open (already loaded in memory):
 
20           20170321T220052.937+0100       INFO      QlikServer1         System.Engine.Engine   47           34b26c68-67e8-4be1-9439-6026c0c59f9e          DOMAIN\qvservice         QvSocket: Connected to server as user: 'UserDirectory=DOMAIN; UserId=qvservice' for document: '/app/c3ed4e49-dc98-4ff8-b140-f3d945236197' on socket fe80::743e:6e47:b9f:acb5:4747 <-> fe80::743e:6e47:b9f:acb5:62296         0              Internal Engine                20170321T220052.937+0100       3136       3176       20170321T215516.000+0100       34b26c68-67e8-4be1-9439-6026c0c59f9e
21           20170321T220052.960+0100       INFO      QlikServer1         System.Engine.Engine   47           cc981161-bbfd-42ec-aa5c-b512e0602283         DOMAIN\qvservice         Server: Document Load: Beginning open of document     fe87b122-8979-45d4-9c37-3c39ce704045   DOMAIN              qvservice             20170321T220052.960+0100       3132       3176                20170321T215516.000+0100       cc981161-bbfd-42ec-aa5c-b512e0602283
 
Notice the first load will state what Session ID initiated the load into memory. The second attempt only gives the App ID in the first log line and then the Session ID is in an entry afterwards. While these entries should be right after each other, depending on what’s happening, they might be broken up by other entries. It’s unlikely, but does make it more difficult to troubleshoot a heavily trafficked environment without access to the Proxy logs.
 
Note: The First Open is only triggered when the QVF is not in memory, so the initial load in memory might be in another log file depending on when the log files are archived.
 
C:\ProgramData\Qlik\Sense\Log\Proxy\Audit\QLIKSERVER1_AuditSecurity_Proxy.txt
 
First Open (loaded into memory):
 
3              11.11.0.0              20170321T215732.019+0100       QlikServer1         738f0e4c-85bc-44ab-accb-18825ec407a5                Command=Login;Result=0;ResultText=Success   fe87b122-8979-45d4-9c37-3c39ce704045              c8d0eb48-fe7a-47da-bbca-0eab11340b92  0              DOMAIN              qvservice             0              Not available      Security                ::ffff:172.16.16.100          Proxy    AppAccess          /hub/stream/e4f1e040-75cf-4db0-afbd-baaf90cab8f8    Login                0              User authenticated. User 'DOMAIN\qvservice' used authentication method 'ticket' and got session 'fe87b122-8979-45d4-9c37-3c39ce704045'            1dc02c31e1779346144cbcc4b75a81a55f466159
4              11.11.0.0              20170321T215742.970+0100       QlikServer1         97ab24cb-edb8-4930-a343-69e044ec7dd0                Command=Add app privileges;Result=0;ResultText=Success         fe87b122-8979-45d4-9c37-3c39ce704045                0e6278ad-ffff-4d6c-9d66-af84a1596d78                 0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Security                ::ffff:172.16.16.100          Proxy    AppAccess                /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197            Add app privileges:ProcessRequestAccessResult 0                Access to app 'c3ed4e49-dc98-4ff8-b140-f3d945236197' allowed with access type 'UserAccessType', result code 'Ok'              94d89f25a8faad2ea59837ded7b6a1603a4607da

Second Open (already loaded in memory):
 
20           20170321T220052.937+0100       INFO      QlikServer1         System.Engine.Engine   47           34b26c68-67e8-4be1-9439-6026c0c59f9e          DOMAIN\qvservice         QvSocket: Connected to server as user: 'UserDirectory=DOMAIN; UserId=qvservice' for document: '/app/c3ed4e49-dc98-4ff8-b140-f3d945236197' on socket fe80::743e:6e47:b9f:acb5:4747 <-> fe80::743e:6e47:b9f:acb5:62296         0              Internal Engine                20170321T220052.937+0100       3136       3176       20170321T215516.000+0100       34b26c68-67e8-4be1-9439-6026c0c59f9e
21           20170321T220052.960+0100       INFO      QlikServer1         System.Engine.Engine   47           cc981161-bbfd-42ec-aa5c-b512e0602283         DOMAIN\qvservice         Server: Document Load: Beginning open of document     fe87b122-8979-45d4-9c37-3c39ce704045   DOMAIN              qvservice             20170321T220052.960+0100       3132       3176                20170321T215516.000+0100       cc981161-bbfd-42ec-aa5c-b512e0602283
 
As you can see the first load will state what Session ID initiated the load into memory. The second attempt only gives the App ID in the first log line and then the Session ID is in an entry afterwards. While these entries should be right after each other, depending on what’s happening, they might be broken up by other entries. It’s unlikely, but does make it more difficult to troubleshoot a heavily trafficked environment without access to the Proxy logs.
 
Note: The First Open is only triggered when the QVF is not in memory, so the initial load in memory might be in another log file depending on when the log files are archived.

C:\ProgramData\Qlik\Sense\Log\Proxy\Audit\QLIKSERVER1_AuditSecurity_Proxy.txt
 
First Open (loaded into memory):
 
3              11.11.0.0              20170321T215732.019+0100       QlikServer1         738f0e4c-85bc-44ab-accb-18825ec407a5                Command=Login;Result=0;ResultText=Success   fe87b122-8979-45d4-9c37-3c39ce704045              c8d0eb48-fe7a-47da-bbca-0eab11340b92  0              DOMAIN              qvservice             0              Not available      Security                ::ffff:172.16.16.100          Proxy    AppAccess          /hub/stream/e4f1e040-75cf-4db0-afbd-baaf90cab8f8    Login                0              User authenticated. User 'DOMAIN\qvservice' used authentication method 'ticket' and got session 'fe87b122-8979-45d4-9c37-3c39ce704045'            1dc02c31e1779346144cbcc4b75a81a55f466159
4              11.11.0.0              20170321T215742.970+0100       QlikServer1         97ab24cb-edb8-4930-a343-69e044ec7dd0                Command=Add app privileges;Result=0;ResultText=Success         fe87b122-8979-45d4-9c37-3c39ce704045                0e6278ad-ffff-4d6c-9d66-af84a1596d78                 0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Security                ::ffff:172.16.16.100          Proxy    AppAccess                /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197            Add app privileges:ProcessRequestAccessResult 0                Access to app 'c3ed4e49-dc98-4ff8-b140-f3d945236197' allowed with access type 'UserAccessType', result code 'Ok'              94d89f25a8faad2ea59837ded7b6a1603a4607da
 
Second Open (already loaded in memory):
 
5              11.11.0.0              20170321T220052.910+0100       QlikServer1         881a8f23-f3a2-4f2b-ae45-969dc9c0c2e3                Command=Add app privileges;Result=0;ResultText=Success         fe87b122-8979-45d4-9c37-3c39ce704045                a057e326-6123-406a-8ee2-e82a46efe367             0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Security                ::ffff:172.16.16.100          Proxy    AppAccess                /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197            Add app privileges:ProcessRequestAccessResult 0                Access to app 'c3ed4e49-dc98-4ff8-b140-f3d945236197' allowed with access type 'UserAccessType', result code 'Ok'              0649a45ad43ccfcf97b82a1cd8d14dd2fa0cfe3b
6              11.11.0.0              20170321T220553.102+0100       QlikServer1         a5462a59-cf10-494e-b021-fc1c26bad82c                Command=Add app privileges;Result=0;ResultText=Success         fe87b122-8979-45d4-9c37-3c39ce704045                a057e326-6123-406a-8ee2-e82a46efe367             0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Security                ::ffff:172.16.16.100          Proxy    AppAccess                /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197            Add app privileges:ProcessRequestAccessResult 0                Access to app 'c3ed4e49-dc98-4ff8-b140-f3d945236197' allowed with access type 'UserAccessType', result code 'Ok'              11c238cbc3edf8e921ebf0e0d8f71b199497a880
 
There’s a few logs listed here that will give other information along with the Session and App ID, but with the Proxy logs we can verify the Session ID that links to the App ID. This can point you to a time, user and app accessed giving you an idea of what users/apps were active and open at the time.

C:\ProgramData\Qlik\Sense\Log\Engine\Audit\QLIKSERVER1_AuditActivity_Engine.txt

First Open (loaded into memory):
 
1              12.16.1.0              20170321T215745.019+0100       QlikServer1         48345a91-0cef-4f54-adce-e1137ab27acd                20170321T215745.007+0100       12.2.2.0                Command=Open app;Result=0;ResultText=Success                fe87b122-8979-45d4-9c37-3c39ce704045              0e6278ad-ffff-4d6c-9d66-af84a1596d78                 1                DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197               Not available      Engine  Not available              Global::OpenApp             Open app            0              Success 48345a91-0cef-4f54-adce-e1137ab27acd
 
Second Open (already loaded in memory):
 
2              12.16.1.0              20170321T220053.193+0100       QlikServer1         ea7e3197-3651-4a87-9c56-a4d51872f01f                20170321T220053.193+0100       12.2.2.0                Command=Open app;Result=0;ResultText=Success                fe87b122-8979-45d4-9c37-3c39ce704045              a057e326-6123-406a-8ee2-e82a46efe367             1                DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197               Not available      Engine  Not available              Global::OpenApp             Open app            0              Success ea7e3197-3651-4a87-9c56-a4d51872f01f
 
This log gives the information on the app being opened with its Session ID.
 
C:\ProgramData\Qlik\Sense\Log\Engine\Trace\QLIKSERVER1_Session_Engine.txt
 
First Open (Closed browser tab):
 
1              20170321T220016.240+0100       INFO      QlikServer1         Session.Engine.Engine   53           6f637615-237c-4716-87d1-4a3f06ed81be        DOMAIN\qvservice                         fe87b122-8979-45d4-9c37-3c39ce704045              DOMAIN                qvservice             20170321T220016.238+0100       3132       3176       12.2.50504.0409.10                20170321T215516.000+0100       0e6278ad-ffff-4d6c-9d66-af84a1596d78                 c3ed4e49-dc98-4ff8-b140-f3d945236197    Load Test APP ID              20170320T195542.497Z                 Socket closed by client                20170321T215743.000+0100       0.001771              0.006285              1902       5619       13           0                UserDirectory=DOMAIN; UserId=qvservice           Off         6f637615-237c-4716-87d1-4a3f06ed81be
 
This has one entry for when tab in the browser was closed (but maintained the actual Session ID since the browser was still active) and you can see by the time stamp of 20170321T220016 is before the Second Open of 20170321T220053. If you had closed the Second Open session you would have a similar entry.
 
C:\ProgramData\Qlik\Sense\Log\Proxy\Audit\QLIKSERVER1_AuditActivity_Proxy.txt
 
First Open (No Session established until now):
 
1              11.11.0.0              20170321T215731.469+0100       QlikServer1         201ee217-3713-44cb-9277-d374799a84fb                Command=Get ticket;Result=0;ResultText=Success          0              0              0              INTERNAL            sa_proxy                0              Not available      Proxy    Not available      /hub/stream/e4f1e040-75cf-4db0-afbd-baaf90cab8f8    Get ticket:ConsumeIncomingTicket  0              User claimed ticket: 'ewXLiJDk6xM1Q0TH'. Session will be etablished                201ee217-3713-44cb-9277-d374799a84fb
2              11.11.0.0              20170321T215731.512+0100       QlikServer1         7042d186-3f1d-4759-9d87-663b73522766                Command=Start session;Result=0;ResultText=Success    fe87b122-8979-45d4-9c37-3c39ce704045              0                0              DOMAIN              qvservice             0              DOMAIN\qvservice         Proxy    Not available                /qps/sessionstart/qvservice        Start session      0              Start session for user: 'DOMAIN\qvservice'                7042d186-3f1d-4759-9d87-663b73522766
3              11.11.0.0              20170321T215731.892+0100       QlikServer1         2e9f0d03-aabe-403a-b282-ec01a47283a0                Command=Add session;Result=0;ResultText=Success      fe87b122-8979-45d4-9c37-3c39ce704045                c8d0eb48-fe7a-47da-bbca-0eab11340b92             0              DOMAIN              qvservice             0              Not available                Proxy    Not available      /hub/stream/e4f1e040-75cf-4db0-afbd-baaf90cab8f8    Add session:NotifyOfPostSession       0              Syncing user attributes for user 'DOMAIN\qvservice'        2e9f0d03-aabe-403a-b282-ec01a47283a0
4              11.11.0.0              20170321T215736.774+0100       QlikServer1         4f3ec3ce-604b-4fad-930c-6c5d3c417112                Command=Get session;Result=200;ResultText=Success  fe87b122-8979-45d4-9c37-3c39ce704045                bcce5b5b-a2e5-455c-9a36-f3fe076b03e3              0              DOMAIN              qvservice             0              Not available                Proxy    AppAccess          /qps/user?targeturi=http:%2f%2fqlikserver1.domain.local%2fhub%2f     Get session:HandleRequest 200         Handle connection request         4f3ec3ce-604b-4fad-930c-6c5d3c417112
5              11.11.0.0              20170321T215743.567+0100       QlikServer1         1fcb5c5c-15f5-40a6-bd54-0819643cd197                Command=Open connection;Result=0;ResultText=Success           fe87b122-8979-45d4-9c37-3c39ce704045                0e6278ad-ffff-4d6c-9d66-af84a1596d78                 0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Proxy    AppAccess          /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197                Open connection             0              Backend web socket connection Opened for session 'fe87b122-8979-45d4-9c37-3c39ce704045'. App id: 'c3ed4e49-dc98-4ff8-b140-f3d945236197'. UserAgent: 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36'           1fcb5c5c-15f5-40a6-bd54-0819643cd197
 
First Open (Closed tab)
 
6              11.11.0.0              20170321T220016.242+0100       QlikServer1         12a1b6ff-d000-4f56-a58c-8ca1bd36a567                Command=Close connection;Result=0;ResultText=Success            fe87b122-8979-45d4-9c37-3c39ce704045                0e6278ad-ffff-4d6c-9d66-af84a1596d78                 0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Proxy    AppAccess          /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197                Close connection              0              Backend web socket connection Closed for session 'fe87b122-8979-45d4-9c37-3c39ce704045'. App id: 'c3ed4e49-dc98-4ff8-b140-f3d945236197. UserAgent: 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36'           12a1b6ff-d000-4f56-a58c-8ca1bd36a567
 
Second Open:
 
7              11.11.0.0              20170321T220052.937+0100       QlikServer1         f1f1350f-0b00-4cf1-b30c-51ddbfecb6bb                Command=Open connection;Result=0;ResultText=Success           fe87b122-8979-45d4-9c37-3c39ce704045                a057e326-6123-406a-8ee2-e82a46efe367             0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Proxy    AppAccess          /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197                Open connection             0              Backend web socket connection Opened for session 'fe87b122-8979-45d4-9c37-3c39ce704045'. App id: 'c3ed4e49-dc98-4ff8-b140-f3d945236197'. UserAgent: 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36'           f1f1350f-0b00-4cf1-b30c-51ddbfecb6bb

 
Notice in this log the user gets a Ticket and Session in the first open to kick off the Session ID. You can then see that web socket connection is closed to the application for that session and then reopened right after it.
 
Note: The Syncing of attributes in the First Open that gets the ticket, it only does that the start of the session and will not be triggered until a new session is established.

C:\ProgramData\Qlik\Sense\Log\Proxy\Audit\QLIKSERVER1_AuditActivity_Proxy.txt
 
First Open (No Session established until now):
 
1              11.11.0.0              20170321T215731.469+0100       QlikServer1         201ee217-3713-44cb-9277-d374799a84fb                Command=Get ticket;Result=0;ResultText=Success          0              0              0              INTERNAL            sa_proxy                0              Not available      Proxy    Not available      /hub/stream/e4f1e040-75cf-4db0-afbd-baaf90cab8f8    Get ticket:ConsumeIncomingTicket  0              User claimed ticket: 'ewXLiJDk6xM1Q0TH'. Session will be etablished                201ee217-3713-44cb-9277-d374799a84fb
2              11.11.0.0              20170321T215731.512+0100       QlikServer1         7042d186-3f1d-4759-9d87-663b73522766                Command=Start session;Result=0;ResultText=Success    fe87b122-8979-45d4-9c37-3c39ce704045              0                0              DOMAIN              qvservice             0              DOMAIN\qvservice         Proxy    Not available                /qps/sessionstart/qvservice        Start session      0              Start session for user: 'DOMAIN\qvservice'                7042d186-3f1d-4759-9d87-663b73522766
3              11.11.0.0              20170321T215731.892+0100       QlikServer1         2e9f0d03-aabe-403a-b282-ec01a47283a0                Command=Add session;Result=0;ResultText=Success      fe87b122-8979-45d4-9c37-3c39ce704045                c8d0eb48-fe7a-47da-bbca-0eab11340b92             0              DOMAIN              qvservice             0              Not available                Proxy    Not available      /hub/stream/e4f1e040-75cf-4db0-afbd-baaf90cab8f8    Add session:NotifyOfPostSession       0              Syncing user attributes for user 'DOMAIN\qvservice'        2e9f0d03-aabe-403a-b282-ec01a47283a0
4              11.11.0.0              20170321T215736.774+0100       QlikServer1         4f3ec3ce-604b-4fad-930c-6c5d3c417112                Command=Get session;Result=200;ResultText=Success  fe87b122-8979-45d4-9c37-3c39ce704045                bcce5b5b-a2e5-455c-9a36-f3fe076b03e3              0              DOMAIN              qvservice             0              Not available                Proxy    AppAccess          /qps/user?targeturi=http:%2f%2fqlikserver1.domain.local%2fhub%2f     Get session:HandleRequest 200         Handle connection request         4f3ec3ce-604b-4fad-930c-6c5d3c417112
5              11.11.0.0              20170321T215743.567+0100       QlikServer1         1fcb5c5c-15f5-40a6-bd54-0819643cd197                Command=Open connection;Result=0;ResultText=Success           fe87b122-8979-45d4-9c37-3c39ce704045                0e6278ad-ffff-4d6c-9d66-af84a1596d78                 0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Proxy    AppAccess          /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197                Open connection             0              Backend web socket connection Opened for session 'fe87b122-8979-45d4-9c37-3c39ce704045'. App id: 'c3ed4e49-dc98-4ff8-b140-f3d945236197'. UserAgent: 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36'           1fcb5c5c-15f5-40a6-bd54-0819643cd197

First Open (Closed tab)
 
6              11.11.0.0              20170321T220016.242+0100       QlikServer1         12a1b6ff-d000-4f56-a58c-8ca1bd36a567                Command=Close connection;Result=0;ResultText=Success            fe87b122-8979-45d4-9c37-3c39ce704045                0e6278ad-ffff-4d6c-9d66-af84a1596d78                 0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Proxy    AppAccess          /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197                Close connection              0              Backend web socket connection Closed for session 'fe87b122-8979-45d4-9c37-3c39ce704045'. App id: 'c3ed4e49-dc98-4ff8-b140-f3d945236197. UserAgent: 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36'           12a1b6ff-d000-4f56-a58c-8ca1bd36a567
 
Second Open:
 
7              11.11.0.0              20170321T220052.937+0100       QlikServer1         f1f1350f-0b00-4cf1-b30c-51ddbfecb6bb                Command=Open connection;Result=0;ResultText=Success           fe87b122-8979-45d4-9c37-3c39ce704045                a057e326-6123-406a-8ee2-e82a46efe367             0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Proxy    AppAccess          /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197                Open connection             0              Backend web socket connection Opened for session 'fe87b122-8979-45d4-9c37-3c39ce704045'. App id: 'c3ed4e49-dc98-4ff8-b140-f3d945236197'. UserAgent: 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36'           f1f1350f-0b00-4cf1-b30c-51ddbfecb6bb
 
Notice in this log the user gets a Ticket and Session in the first open to kick off the Session ID. You can then see that web socket connection is closed to the application for that session and then reopened right after it.
 
Note: The Syncing of attributes in the First Open that gets the ticket, it only does that the start of the session and will not be triggered until a new session is established.

C:\ProgramData\Qlik\Sense\Log\Proxy\Trace\QLIKSERVER1_Audit_Proxy.txt
 
First Open (loaded into memory):
  
1              20170321T215731.134+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.Authentication.AuthenticationHandler 14           384a5be2-8c1f-4569-8b17-a6fa747b8f2f          DOMAIN\qvservice         Session 'a0ee67d2-581b-47db-9514-443ac4a008b1' is invalid (possibly timed out or logged out)            0              45b4435a-3e05-47c4-b78b-0e5311154a91                                                             ::ffff:172.16.16.100                                          {}             1650cb4421d90c3f0e3af23e1f5e2c8176219ad8
2              20170321T215731.188+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.RedirectionHandler       14           17bed8a0-b6ec-4316-9dfd-ff062b4b1c79     DOMAIN\qvservice         Authentication required, redirecting client@http://[::ffff:172.16.16.100]:62230/  to http://qlikserver1.domain.local:4248/windows_authentication/?targetId=6b07f3fb-5d9e-462f-b424-bb389054e645            0              45b4435a-3e05-47c4-b78b-0e5311154a91                                                             ::ffff:172.16.16.100                                          {}                8da259cac80248a0b1258dffa22a0bc5585c668b
3              20170321T215731.444+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.Authentication.TicketValidator 14           ab854bb8-5c99-4a1c-8b76-00a443e94684    DOMAIN\qvservice         Issued ticket 'ewXLiJDk6xM1Q0TH' for user, valid for 1 minute(s)               0                                DOMAIN              qvservice             ewXLiJDk6xM1Q0TH                                                                       7f97ce8a8282eb9ed7aa0b61722b2504241e0e09
4              20170321T215731.470+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.Authentication.AuthenticationHandler 14           f27f9ebc-4ad4-4d5a-968d-13e910e1efab        DOMAIN\qvservice         User claimed ticket: 'ewXLiJDk6xM1Q0TH'            0              583a2b2e-5aeb-4292-9d02-d1c4e5a1cd0b DOMAIN              qvservice             ewXLiJDk6xM1Q0TH       ::ffff:172.16.16.100                                          {}             e025a74e13bb4c759fe5ad99787ad5589381b7bf
5              20170321T215731.891+0100       INFO      QlikServer1                Audit.Proxy.Proxy.DefaultModules.Session.SessionClientHandler               8              8dfacde2-3963-432b-af75-22d5122b5fea    DOMAIN\qvservice         Syncing user attributes for user DOMAIN\qvservice was successful                fe87b122-8979-45d4-9c37-3c39ce704045              583a2b2e-5aeb-4292-9d02-d1c4e5a1cd0b            DOMAIN                qvservice             ewXLiJDk6xM1Q0TH       ::ffff:172.16.16.100                                          {}                df162a32bfed4ae4c37531b6f1ad4e7cb18b708e
6              20170321T215732.018+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.Authentication.AuthenticationHandler 14           711c200a-60e9-457a-be6c-89f1ce11bf82          DOMAIN\qvservice         User 'qvservice' used 'ticket' authentication, got session: 'fe87b122-8979-45d4-9c37-3c39ce704045'                  fe87b122-8979-45d4-9c37-3c39ce704045              583a2b2e-5aeb-4292-9d02-d1c4e5a1cd0b   DOMAIN              qvservice             ewXLiJDk6xM1Q0TH       ::ffff:172.16.16.100                                          {}                7fa218f968005afa6c0e635058e1e6c290e90d76
7              20170321T215735.128+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.LoadBalancingHandlerDependencies     8              11c49eb7-4ce8-45be-98d1-76a10f34562c          DOMAIN\qvservice         Retrieved 1 engine(s) from repository, result code Ok, app: __hub                fe87b122-8979-45d4-9c37-3c39ce704045              355bcda7-26f1-4a41-94d5-c5c88499abb8              DOMAIN                qvservice                             ::ffff:172.16.16.100                          qlikserver1.domain.local:4242    {}                7b0262f7f34c583b38c13639692a495540079d74
8              20170321T215735.144+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.LoadBalancingHandlerDependencies     8              29022811-cbe3-4f9d-ba19-b3bb50f37e0e        DOMAIN\qvservice         Cached 1 prioritised Engine(s), app: __hub           fe87b122-8979-45d4-9c37-3c39ce704045          355bcda7-26f1-4a41-94d5-c5c88499abb8              DOMAIN              qvservice                             ::ffff:172.16.16.100                          qlikserver1.domain.local:4242    {}                5ff601a6ada967d7d6c9990a1bddbe25e7bbc1cf
9              20170321T215735.186+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.LoadBalancingHandlerDependencies     24           dbf6cd5b-735e-4112-94c3-4db366bbe4b2       DOMAIN\qvservice         New target uri chosen: https://qlikserver1.domain.local:4900/ , app: __hub   fe87b122-8979-45d4-9c37-3c39ce704045              355bcda7-26f1-4a41-94d5-c5c88499abb8              DOMAIN                qvservice                             ::ffff:172.16.16.100                          qlikserver1.domain.local:4900    {}                ba0e44b68b214c47fea575e93244c3c5f159c281
10           20170321T215743.535+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.LoadBalancingHandlerDependencies     8              7bcf1a03-6cfe-45ea-a06b-d1a780528be0        DOMAIN\qvservice         Retrieved 1 engine(s) from repository, result code Ok, app: c3ed4e49-dc98-4ff8-b140-f3d945236197    fe87b122-8979-45d4-9c37-3c39ce704045              79705676-f6f7-4396-8771-9f9f2a57f711      DOMAIN              qvservice                             ::ffff:172.16.16.100          c3ed4e49-dc98-4ff8-b140-f3d945236197                    {}             fe793ff3d692d1992e38f7be35c3a15d93ada65d
11           20170321T215743.535+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.LoadBalancingHandlerDependencies     8              425b5b86-579e-410f-8721-a816841bc16a         DOMAIN\qvservice         Cached 1 prioritised Engine(s), app: c3ed4e49-dc98-4ff8-b140-f3d945236197    fe87b122-8979-45d4-9c37-3c39ce704045              79705676-f6f7-4396-8771-9f9f2a57f711                DOMAIN              qvservice                             ::ffff:172.16.16.100          c3ed4e49-dc98-4ff8-b140-f3d945236197                                {}             ab51d2ad92cef8fff57fb15b1d5b115eeabedecb
12           20170321T215743.563+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.LoadBalancingHandlerDependencies     24           4c8e93c3-b3c9-475b-aa03-b8290f196014         DOMAIN\qvservice         New target uri chosen: wss://qlikserver1.domain.local:4747/, app: c3ed4e49-dc98-4ff8-b140-f3d945236197               fe87b122-8979-45d4-9c37-3c39ce704045              79705676-f6f7-4396-8771-9f9f2a57f711           DOMAIN              qvservice                             ::ffff:172.16.16.100          c3ed4e49-dc98-4ff8-b140-f3d945236197    qlikserver1.domain.local:4747    {}             f27c34ac0b7976a062ef3ea21d129acf451b0e65

This log only tracks the initial Session from the first Open, since the session is already established for the User. Further opening of the same app will not trigger a new entry for this Session/App ID
  
Final Note: There were no tests and review of entries for any new user sessions, different App IDs or for when the session times out or is forcible closed (closing the browser).  

What is legacy mode?
Legacy mode in Qlik Sense allows users who have access to the data load editor to write load statements which reference file paths rather than through LIB statements.

Simple example:
Standard Mode:
LOAD * 
FROM [lib://data/data.csv]
(txt, codepage is 28591, embedded labels, delimiter is ',', msq);

Legacy Mode:
LOAD * 
FROM C:\data\data.csv
(txt, codepage is 28591, embedded labels, delimiter is ',', msq);

What are the security considerations when using legacy mode?

Out of the box, for a user to do development in Qlik Sense, they need some combination of two types of access:

1. An ability to create a data connection
2. An ability to read (or see) a data connection

This security model is the intermediary between the user inside of Qlik Sense and the data sources.

When using legacy mode, any user who has access to the Data Load Editor can now access the file system of the local Qlik Sense server as well as any network file shares that the Qlik Sense service account independent of the security rules configured on the Qlik Sense deployment. In this example, the user has access to AttachedFiles, which all users would out of the box, as well as a Salesforce data connection, yet they are still able to load from the data.csv:

This means that the traditional mechanism for ensuring governance and security over data access inside of the Data Load Editor will no longer apply and the user(s) will be accessing the files as the Qlik Sense Service account

What are the benefits of using Legacy Mode?

This is difficult to answer in an exhaustive manner, but generally the benefits are narrowly scoped to deployments where app development, self-service capabilities are disabled or where this level of access is restricted to a vetted set of administrators. Some benefits include:

• The ability to use relative paths in load scripts (e.g. LOAD * FROM ..\..\Customer1\sales.csv). Often used in conjunction with include scripts which allow easy deployment to multiple customers or tenants.
• The ability to use the EXECUTE function (in conjunction with an additional Settings.ini change) to directly call external processes during script execution
• The ability to re-use load statements from QlikView documents in Qlik Sense
• And others

Is legacy mode recommended by Qlik?
For most deployments, no, legacy mode is not recommended. It can be useful in some deployment scenarios where the security concerns are mitigated.

How do I switch to Legacy mode / disable standard mode?
Disabling standard mode - Enabling Legacy Mode - Qlik Sense on Windows

Qlik Sense Legacy mode

Qlik Sense Legacy Mode - Qlik Design Blog

This is a recording of a Support Techspert Thursdays session.

This session addresses:
- What the App Analyzer can do
- How to set it up
- How to improve app performance
- Troubleshooting issues

Chapters:

00:00 – Intro

 01:26 - App Analyzer Overview

 02:39 - When the App Analyzer is Useful

 03:43 - SaaS Standard Tier Capabilities

 06:23 - How Qlik Sense Stores Data

 07:32 - App Analyzer Dashboard demo

 08:58 - Example App Optimization

 10:54 - Best Practice thresholds

 12:02 - Threshold Analysis Sheet Demo

 12:32 - App RAM to Quota Sheet Demo

13:19 - Example App

 13:47 - App Analysis Sheet Demo

14:39 - Rolling Analysis Sheet Demo

16:28 - Reload Time

17:06 - Setting it up

 18:11 - TIP: Relative Path

 18:47 - Creating a REST Connection

 20:34 - The right space to use

 21:16 - Troubleshooting: SET ErrorMode

 22:13 - TroubleShooting: API Key

 23:29 - App Analyzer on Qlik Community

 24:41 - Qlik Diagnostic Toolkit

 25:41 - Qlik Sense Admin Playbook

 26:13 - Q&A

Environment

• Qlik Sense Enterprise SaaS - Standard Tier

Related Content 

App Analyzer on Qlik Community

Qlik Dignostic Toolkit

Qlik Sense Admin Playbook

STT - Optimizing Qlik Sense SaaS Apps with App Analyzer

Q&A:

Q: I noticed sheets supposedly in my app according to the App MetaData Analyser that are not part of my app. Is the presented data reliable?

A: Neither the App Analyzer for Qlik Sense Enterprise SaaS or the App Metadata Analyzer for Qlik Sense Enterprise on Windows track sheets – they only gather data model and reload metadata. That said, there was a bug in the App Metadata Analyzer for Qlik Sense Enterprise on Windows that did associate some fields/tables to the wrong apps that has since been addressed. You can always grab the latest version of the App Metadata Analyzer for Windows here.

Q: Hi, super interesting stuff!  is the very same App Analyzer available to non-SaaS customers?

A: The application that the App Analyzer was modeled off of is the App Metadata Analyzer for Qlik Sense Enterprise on Windows that ships with the product. You can find the most recent version of that application here.

Q: The configuration of REST Connector is throwing error "cannot connect"...are there any setup needed on the tenant level?

A: Please refer to the installation guide for the App Analyzer and if you are still having issues, please post on the Qlik Community entry here.

Q: Can we setup Qlik Alerting to inform us as we get closer to threshholds?

A: Absolutely, yes. This is a great way to stay on top of monitoring your applications. In addition, you can also monitor one of the charts from the app in the Hub to have a quick look at where everything stands each time you login to the tenant.

Transcript

Currently, there is no available feature to delete (or update) existing tags in Qlik Sense SaaS.

Environment

Qlik Cloud 

Resolution

Qlik has previously received feedback on this feature. For up to date information and to express your interest in this feature, review https://community.qlik.com/t5/Suggest-an-Idea/Enable-Deletion-Update-of-Tags-in-Qlik-Sense-SaaS/idi-p/1831354 

When accessing the QlikSense Hub with an iOS device (iPad/iPhone) Apps are not loaded or cannot be opened. HTTPS access is used.

The user tries to open the Qlik Sense Hub on an iOS device (iOS 8 and above) using the address https://servername/hub

When attempting to open an App they are presented with an endless loading screen or "Connection to the Qlik Sense engine failed for unspecified reasons"
 

A review of the QlikSense Proxy logs (Folder Trace\ and  SERVER_Audit_Proxy) might show SslNoClientValidation WARN entries. 

Environment: 

Qlik Sense Mobile  on iOS

Cause:

Apple has removed the ability of users to ignore certificate warnings on devices iOS 8 and above. On laptops or desktops you would have the option to ignore the SSL warning, but this option is not possible with iOS devices.

Resolution:

1) Since the "Connection Lost" message or endless "bubble" loading screen are typically indicative of an allowed url/host problem, be sure that the Domain that the user is accessing the Hub has been allowed through firewalls and proxies. See article Error Message "Connection lost" When Connecting To Qlik Sense Hub for more clarity on this. If users on laptops / desktops do not receive this message then proceed to step 2.

2) Access https://sense-demo.qlik.com/hub using the iOS device. If this works then proceed to step 3.

• If the demo link does not work, you have a possible browser, network, or internet connectivity issue at the device level.

3) Apple requires an SSL cert from a trusted CA when accessing websites via HTTPS (check their knowledge base for a list of providers). You can either acquire a certificate from one of the vetted list of providers or the user(s) can access the Hub using HTTP. For guidance on applying a third party certificate, see article How to change certificate for the Proxy.  

4) If no certificate from a trusted CA can be acquired, it will be necessary to install the current one.  See Apple and it's Apple Configurator for details. 

The Qlik Sense Mobile app allows you to securely connect to your Qlik Sense Enterprise deployment from your supported mobile device. This is the process of configuring Qlik Sense to function with the mobile app on iPad  / iPhone.

This article applies to the Qlik Sense Mobile app used with Qlik Sense Enterprise on Windows. For information regarding the Qlik Cloud Mobile app, see Setting up Qlik Sense Mobile SaaS. 

Content:

• Pre-requirements (Client-side)
• Configuration (Server-side)
• Update the Host White List in the proxy
• Configuration (Client side)

Pre-requirements (Client-side)

See the requirements for your mobile app version on the official Qlik Online Help > Planning your Qlik Sense Enterprise deployment > System requirements for Qlik Sense Enterprise > Qlik Sense Mobile app

Configuration (Server-side)

Acquire a signed and trusted Certificate.

Out of the box, Qlik Sense is installed with HTTPS enabled on the hub and HTTP disabled. Due to iOS specific certificate requirements, a signed and trusted certificate is required when connecting from an iOS device. If using HTTPS, make sure to use a certificate issued by an Apple-approved Certification Authority.
Also check Qlik Sense Mobile on iOS: cannot open apps on the HUB  for issues related to Qlik Sense Mobile on iOS and certificates.

For testing purposes, it is possible to enable port 80.

(Optional) Enable HTTP (port 80).

1. Open the Qlik Sense Management Console and navigate to Proxies.
2. Select the Proxy you wish to use and click Edit Proxy.  
3. Check Allow HTTP 

Update the Host White List in the proxy 

If not already done, add an address to the White List:

1. In Qlik Management Console, go to CONFIGURE SYSTEM -> Virtual Proxies
2. Select the proxy and click Edit
3. Select Advanced in Properties list on the right pane
   
   

    

4. Scroll to Advanced section in the middle pane
5. Locate "Allow list"
   
   

    

6. Click "Add new value" and add the addresses being used when connecting to the Qlik Sense Hub from a client. See How to configure the WebSocket origin allow list and best practices for details. 
   
   

Generate the authentication link:

An authentication link is required for the Qlik Sense Mobile App.

1. Navigate to Virtual Proxies in the Qlik Sense Management Console and edit the proxy used for mobile App access
2. Enable the Client authentication link menu in the far right menu.
3. Generate the link.

NOTE: In the client authentication link host URI, you may need to remove the "/" from the end of the URL, such as http://10.76.193.52/ would be http://10.76.193.52 

Associate User access pass

Users connecting to Qlik Sense Enterprise need a valid license available. See the Qlik Sense Online Help for more information on how to assign available access types.
Qlik Sense Enterprise on Windows > Administer Qlik Sense Enterprise on Windows > Managing a Qlik Sense Enterprise on Windows site > Managing QMC resource > Managing licenses

• Managing professional access
• Managing analyzer access
• Managing user access
• Creating login access rules

Configuration (Client side)

1. Install Qlik Sense mobile app from AppStore.
2. Provide authentication link generated in QMC
   • Open the link from your device (this can be also done by going to the Hub, clicking on the menu icon at the top right and selecting "Client Authentication"), the installed application will be triggered automatically, and the configuration parameters will be applied.
   •  Enter user credentials for QS server

The TAC configuration page's Artifact section displays an error for JFrog access check：

error unauthorized : https://<JFROG_PLATFORM_URL>:<PORT>/access/api/v1/system/ping

Cause

$ curl -u "admin:password" "https://<JFROG_PLATFORM_URL>:<PORT>/access/api/v1/system/ping"
{
"errors" : [ {
"code" : "UNAUTHORIZED",
"message" : "Unsupported authentication method Basic"
} ]
}

Resolution

For every Access-related API, you must use an admin-scoped Access Token or an Admin Identity Token. For further details, please refer to How to generate access token from JFrog admin UI.

Environment

• Talend Administration Center 8.0.1

The following steps are only applicable to Qlik Sense deployments originally installed with versions prior to the June 2019 release. For any Qlik Sense deployments installed with later versions, follow standard steps for patching Qlik Sense and do not perform the steps in this article.

In these steps we will occasionally ask you to run Powershell code.

Executing PowerShell code:

1. Copy the code and save it in a ps1 file, in example: certificates_backup.ps1
2. Open elevated command line and navigate to the location where the script was saved.
3. Start PowerShell by executing following command: Powershell
4. Run the script by executing following command: .\<name_of_the_script>.ps1 in example: .\certificates_backup.ps1

Environment

• Qlik Sense Enterprise on Windows, June 2019 thru November 2019

Resolution

1. After upgrading to June 2019 or above, check the Root certificate by running the C2 Validator tool on ALL NODES. If CA and Critical display 'Missing', please follow the instructions below.
2. Stop all services on ALL NODES in the Qlik Sense cluster.
3. Back up all current Qlik Sense certificates from the CENTRAL NODE by executing the following PowerShell code:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

function ExportCertificatesFromStore(
    [string] $name,
    [string] $location)
{
    $success = 1
    $oid = "1.3.6.1.5.5.7.13.3"
    
    $localStore = new-object System.Security.Cryptography.X509Certificates.X509Store $name, $location
    $localStore.Open("MaxAllowed")

    $mypwd = ConvertTo-SecureString -String "MyPassword" -Force -AsPlainText

    try
    {
        $certs = $localStore.Certificates
        foreach ($cert in $certs)
        {
            $extensions = $cert.Extensions
            foreach($extension in $extensions)
            {
                if ($extension.Oid.Value.Equals($oid))
                {
                    Get-ChildItem -Path cert:\$($localStore.Location)\$($localStore.Name) | Where-Object { $_.PrivateKey.CspKeyContainerInfo.Exportable } | Export-PfxCertificate -FilePath "$($localStore.Name)_$($localStore.Location).pfx" -Password $mypwd
                    break;
                }
            }
        }
    }

    catch
    {
        write-host "An error occurred while removing certificates" -ForegroundColor Red
        write-host $_.Exception.GetType().FullName -ForegroundColor Red
        write-host $_.Exception.Message -ForegroundColor Red
        $success = 0
    }

    finally
    {
        $localStore.Close()
    }
    
    if ($success -ne 1)
    {
        exit 20
    }
}

function ExportCertificates()
{
    ExportCertificatesFromStore "Root" "LocalMachine"
    ExportCertificatesFromStore "My" "LocalMachine"
    ExportCertificatesFromStore "My" "CurrentUser"
}

ExportCertificates
write-host "Done."
exit 0

NOTE: For information on how to execute above code please refer to “Executing PowerShell code” section at the top. Modify $mypwd variable to define custom password. Make sure certificates were backed up after running the script:

• Root_LocalMachine.pfx – root CA
• My_LocalMachine.pfx – server
• My_CurrentUser – client

NOTE: If you happen to have more certificates with the same values in Issued To, Issued By and Friendly Name columns and you are unable to identify the correct certificate, please refer to Identifying Qlik Sense root CA and server certificates in certificate store.

1. Remove current Qlik Sense root CA certificate from CENTRAL NODE by executing the following PowerShell code:
   

   Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
   
   function RemoveCertificatesFromStore(
   [string] $name,
   [string] $location)
   {
       $success = 1
       $oid = "1.3.6.1.5.5.7.13.3"
   
       $localStore = new-object System.Security.Cryptography.X509Certificates.X509Store $name, $location
       $localStore.Open("MaxAllowed")
       try
       {
           $certs = $localStore.Certificates
           foreach ($cert in $certs)
           {
               $extensions = $cert.Extensions
               foreach($extension in $extensions)
               {
                   if ($extension.Oid.Value.Equals($oid))
                   {
                       write-host "Deleting certificate from" $localStore.Name $localStore.Location
                       write-host " Subject:"$cert.Subject
                       write-host " Issuer:"$cert.Issuer
                       write-host " Serial:"$cert.SerialNumber
                       $localStore.Remove($cert)
                       break;
                   }
               }
           }
       }
       catch
       {
           write-host "An error occurred while removing certificates" -ForegroundColor Red
           write-host $_.Exception.GetType().FullName -ForegroundColor Red
           write-host $_.Exception.Message -ForegroundColor Red
           $success = 0
       }
       finally
       {
           $localStore.Close()
       }
   
       if ($success -ne 1)
       {
           exit 20
       }
   }
   
   function CleanCertificates()
   {
       RemoveCertificatesFromStore "Root" "LocalMachine"
   }
   
   CleanCertificates
   write-host "Done."
   exit 0​

2. Make sure script completes without any errors. Otherwise remove Qlik Sense root CA certificate manually (please see Recreating Qlik Sense root CA certificate (manual back-up and removal of existing certificates).
3. Remove all current Qlik Sense certificates from NON-CENTRAL NODES by executing the following PowerShell code:
   

   Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
   
   function RemoveCertificatesFromStore(
       [string] $name,
       [string] $location)
   {
       $success = 1
       $oid = "1.3.6.1.5.5.7.13.3"
   
       $localStore = new-object System.Security.Cryptography.X509Certificates.X509Store $name, $location
       $localStore.Open("MaxAllowed")
   
       try
       {
           $certs = $localStore.Certificates
           foreach ($cert in $certs)
           {
               $extensions = $cert.Extensions
               foreach($extension in $extensions)
               {
                   if ($extension.Oid.Value.Equals($oid))
                   {
                       write-host "Deleting certificate from" $localStore.Name $localStore.Location
                       write-host " Subject:"$cert.Subject
                       write-host " Issuer:"$cert.Issuer
                       write-host " Serial:"$cert.SerialNumber
                       $localStore.Remove($cert)
                       break;
                   }
               }
           }
       }
   
       catch
       {
           write-host "An error occurred while removing certificates" -ForegroundColor Red
           write-host $_.Exception.GetType().FullName -ForegroundColor Red
           write-host $_.Exception.Message -ForegroundColor Red
           $success = 0
       }
   
       finally
       {
           $localStore.Close()
       }
   
       if ($success -ne 1)
       {
           exit 20
       }
   }
   
   function CleanCertificates()
   {
       RemoveCertificatesFromStore "Root" "LocalMachine"
       RemoveCertificatesFromStore "My" "LocalMachine"
       RemoveCertificatesFromStore "My" "CurrentUser"
   }
   
   CleanCertificates
   write-host "Done."
   exit 0​

4. Make sure script completes without any errors. Otherwise remove certificates manually (please see Recreating Qlik Sense root CA certificate (manual back-up and removal of existing certificates).
5. Remove all current Qlik Sense certificates from NON-CENTRAL NODES stored locally by deleting all files from following location:
   
   C:\ProgramData\Qlik\Sense\Repository\Exported Certificates\.Local Certificates
   
   
6. On ALL NODES navigate to C:\Program Files\Qlik\Sense\Repository (or corresponding nondefault location) and open Repository.exe.config file.
7. Make sure Certificates.SelfSignedRoot.BasicConstraintsCA key has value set to true, in example:
   
   <add key="Certificates.SelfSignedRoot.BasicConstraintsCA" value="true" />
   
   If the above key is not present, add it within <appSettings> section, in example:
   

   (…)
   <add key="BackgroundWork.CountLimit" value="3" />
   <add key="Certificates.SelfSignedRoot.BasicConstraintsCA" value="true" />
   <add key="DatabaseCommandTimeout" value="00:01:30" />
   (…)​

   
   NOTE: If you are installing a patch on November 2018 track, name of the key is: <add key="CertificatesSelfSignedRootBasicConstraintsCA" value="true" />
   
8. On the CENTRAL NODE, start Qlik Sense Repository Database service.
9. On CENTRAL NODE, from an elevated command line navigate to C:\Program Files\Qlik\Sense\Repository (or corresponding nondefault location) and run:
   

   repository.exe -bootstrap -iscentral​

10. When bootstrap mode has reached Entering main startup phase.., start Qlik Sense Service Dispatcher service and make sure that the Bootstrap mode has terminated. Press ENTER to exit.. final message is shown

Note: If this message is not shown, open Windows Task Manager, find Qlik Sense Repository Service in the Processes tab and end it by right-clicking on it and selecting End task.

1. To make sure new certificate is in use, run the C2 Validator tool,
2. On CENTRAL NODE restart Qlik Sense Service Dispatcher and start all remaining services.
3. On the NON-CENTRAL NODES, depending on the setup, perform either step a) or b) below:
   • Account running the Qlik Sense services has administrator privileges:
     1. [Applicable ONLY for April 2019 track]: Delete host.cfg file from C:\ProgramData\Qlik\Sense\ 
     2. Start Qlik Sense Repository Service.
     3. Open the Qlik Management Console (QMC) and redistribute the certificates according to Redistributing a certificate
     4. Restart Qlik Sense Repository Service and start all remaining services on the node to make sure they are using the newly distributed certificates.
   • Account running the Qlik Sense service does not have administrator privileges:
     1. [Applicable ONLY for April 2019 track]: Delete host.cfg file from C:\ProgramData\Qlik\Sense\ 
     2. At the command line, navigate to C:\Program Files\Qlik\Sense\Repository (or corresponding nondefault location), and run:
        repository.exe -bootstrap
     3. When the Waiting for certificates to be installed.. message is displayed, redistribute the certificates according to Redistributing a certificate
4. Once the bootstrap mode has terminated, start the Qlik Sense Service Dispatcher, then start the Qlik Sense Repository Service, and finally the remaining Qlik Sense services.

Access Denied

Or

You will not see any files/folders

Resolution

• Make sure the path you are accessing has proper Read rights and permissions are granted. Please read here to check effective permissions, Effective Permission.
• If it is a multi-node environment, ensure that the path is accessible from all the Qlik Sense Windows machines (RIM nodes).
• Make sure to use UNC paths. Please read more about UNC Paths here, File Path Formats 
• Qlik Sense Service account must have access to the path you are connecting to. Please read more about Service Account here,
  • Qlik Sense Service Account requirements 
  • What is the Service Account for Qlik Sense Enterprise on Windows? 
• The Network Shared folder must be on the same domain as the Qlik Sense Windows machine.
• If it is a network path, ensure that the users' credentials of those who do not have access to Qlik Sense are not saved. If the users' credentials are saved, accessing the network path may result in the following warning:

The username or password is incorrect

Cause

• Qlik Sense Service Account does not have proper rights and permissions to access the path.
• The Network Shared path is not accessible from the other Qlik Sense Windows machines (RIM nodes) in a multi-node environment.
• The Path provided is a Mapped drive. Please read here as the mapped drives are not supported, Cannot use mapped network drives for Qlik Sense folder connections
• Network share is Password protected and not accessible to the Qlik Sense Service account.
  
  

When the network share is password-protected, even if the service account has access to it, you must first enter the network share from the Qlik Sense Windows machine/s with credentials to access it.

Note that for every reboot, the password-protected folder will prompt for credentials, causing the Folder Data Connection to fail since Folder Data Connection does not have an option to save user credentials.

Environment

• Qlik Sense Enterprise on Windows