A scheduled Qlik Replicate task does not show up in the Executed Jobs list.

This is working as intended. The Executed Jobs tab will only show executed jobs that were scheduled to run once only. In other words, jobs scheduled to run periodically (e.g. Daily, Weekly, Monthly) will not be shown.

See Scheduling jobs.

Environment

Qlik Replicate 

There may be several different symptoms associated with a need to regenerate and redistribute certificates;

• After installing, renewing, or changing a third-party certificate for use with Qlik Sense the Qlik Management Console (QMC) and Hub may become inaccessible leading to Page Cannot Be Displayed error.
  
  

  This article does not cover the use of a 3rd party certificate for end user Hub access, but the certificates used for communication between the Sense services. For recommendation on how to use a 3rd party certificate for end user access, see How to: Change the certificate used by the Qlik Sense Proxy to a custom third party certificate

• In the Qlik Sense Proxy trace logs, the last line may be indicating waiting for certificates to be installed or similar. In addition, even though Proxy service remains running, port 443 (by default) will fail to bind and start listening for requests.
  
  
• Qlik Sense may sometimes fail to create the correct certificates during installation if there are old/unused certificates left from a previous installation.  Also, certs can become corrupted, or newly installed certificates configured to be used may not be compatible. See Qlik Sense: Compatibility information for third-party SSL certificates and Requirements for configuring Qlik Sense with SSL.

Do not perform the below steps in a production environment, without first doing a backup of the existing certificates. Certificates are being used to encrypt information in the QRS database, such as connection strings. By recreating certificates, you may lose information in your current setup.
By removing the old/bad certificates, and restarting the Qlik Sense Repository Service (QRS), the correct certificates can be recreated by the service. If trying to remove certs, only the removal steps need to be followed.

The instructions are to be carried out on the Qlik Sense Central Node. In the case of a multi-node deployment, verify which node is the central node before continuing.

1. Open Qlik Sense Management Console (QMC)
2. Navigate to Nodes section
3. Add the column Central Node column through Column selector

If the current central node role is held by the failover, you need to fail the role back to the original central node by shutting down all the nodes (this implies downtime). Then start the original central node, reissue the certificates on it with this article, and when the central node is working apply the article Rim node not communicating with central node - certificates not installed correctly on each Rim node.

Step by Step instructions:

Test all data connections after the certificates are regenerated.  It is likely that data connections with passwords will fail.  This is because passwords are saved in the repository database with encryption.  That encryption is based on a hash from the certificates.  When the Qlik Sense signed certificates are regenerated, this hash is no longer valid, and the saved data connection passwords can not be decrypted.  The customer must re-enter the passwords in each data connection and save.  See article: Repository System Log Shows Error "Not possible to decrypt encrypted string in database"

1. Log on to the Central node using the Qlik Service Account and navigate to the 'Services' and to the Qlik Services.
   
   
2. Stop the QRS (this will also stop the other services; however, make sure the postgresql-64-12 or Qlik Sense Repository Database is still running).
   
   
    
3. Open Microsoft Management Console (MMC). 
   
   Important: Execute the MMC as the account configured to run the services (using Run as a different user [Ctrl-Shift & Right click on the exe to see option]... )
   
   
4. Add the following snap-ins for Certificates:
   
   
   • My user account
   • Local Computer account
     
     
5. In Certificates (Local Computer) > Trusted Root Certification Authorities > Certificates, delete the Self-Signed certificates created by Qlik Sense, issued by HOSTNAME.domain-CA*
   
   *Where HOSTNAME is the machine name of the server in question and domain is the domain of the server.
   So for example, QlikServer1 is the computer hostname and the domain is domain.local, the certificate will be issued by QlikServer1.domain.local-CA
    
6. In Certificates (Local Computer) > Personal > Certificates, delete the Self-Signed certificate issued by HOSTNAME.domain-CA
   
   
7. In Certificates > Current User > Personal > Certificates, delete the Self-Signed certificate named QlikClient
    
8. Go to the folder C:\ProgramData\Qlik\Sense\Repository, delete the folder 'Exported Certificates'
   
   
9. Run this command from an elevated (admin) command prompt to create new certificates:
   
   "C:\Program Files\Qlik\Sense\Repository\Repository.exe" -bootstrap -iscentral -restorehostname 
   
   Note: If the script doesn't get to "Bootstrap mode has terminated. Press ENTER to exit.." and gets stuck at "[INFO] Entering main startup phase.." start the "Qlik Sense dispatcher service" and it will get to the end)
   
   
10. Verify the new certificates have been created by REFRESHING the screen for each certificate location, and then start the rest of the Qlik Sense services. In addition, verify that duplicate or multiple certificates were not created (rarely occurs). If so, the article will need to be followed again by starting with the deletion of the certificates.
    

There is no need to perform a full reinstall to propagate new certificates. Certificates are created by the QRS automatically if not found during the service startup process.

For Qlik Sense multi-cloud deployment (September 2020 or later):

The steps in this section must be performed after recreating certificates as described above.

1. Start Qlik Sense Repository Database service on CENTRAL NODE, or PostgreSQL Server service if running a dedicated instance of PostgreSQL database server.
   
   
2. Using pgAdmin tool or any other database client, connect to SenseServices database. (IMPORTANT: the below query needs to be executed on the SenseServices DB)
   
   

3. Execute following query against SenseServices database:

   DROP TABLE IF EXISTS hybrid_deployment_service.mt_doc_asymmetrickeysencrypt CASCADE;

    

4. Navigate to Deployments page of Multi-cloud Setup Console (MSC).

5. Delete and re-add any existing deployments by following the steps mentioned in Distributing apps from Qlik Sense Enterprise on Windows to Qlik Sense Enterprise SaaS  and Distributing apps to Qlik Sense Enterprise on Kubernetes.

Node.js certificates

After the certificates have been recreated and then redistributed to all of the rim nodes, the node.js certificates stored locally on the central and all rim nodes also need to be recreated. Follow the below steps to perform this action:

1. Stop all Qlik Sense services
   
   
2. In Windows File Explorer, navigate to %ProgramData%\Qlik\Sense\Repository\Exported_certificates
   
   
3. Back up the Local certificates directory and then delete it
   
   
4. Restart the Qlik Sense services

Test all data connections after the certificates are rebuilt.  It is likely that data connections with passwords will fail.  This is because passwords are saved in the repository database with encryption.  That encryption is based on a hash from the certs.  When the Qlik Sense self-signed cert is rebuilt, this hash is no longer valid, and so the saved data connection passwords will fail.  The customer must re-enter the passwords in each data connection and save.  See article: Repository System Log Shows Error "Not possible to decrypt encrypted string in database"

Self Signed Certificates:

Notice if using an official Signed Server Certificate from a trusted Certificate Authority

The certificate information will also be in the QMC, under Proxies, with the Certificate thumbprint listed. If trying to merely remove all aspects of certs, this will need to be removed as well.

1. Go to Proxies 
   
   
2. Select your Proxy and click Edit
   
   
3. In the right pane, select Security
   
   
4. Scroll down and locate "SSL browser certificate thumbprint" in the Security section to locate the thumprint info.

If the Central Node repository service hanging in the logs:

1. Open C:\ProgramData\Qlik\Sense\Log\Repository\Trace
   
   
2. Look for this Example "API service initialized with 1501 available methods".  This is Central Node. 
   
   
3. If you see this Example "API service initialized with 2 available methods". This is a Rim node. 
   
   
4. For Central Node you should see as an example ""API service initialized with 1501 available methods". 
   
   
5. Running this command "C:\Program Files\Qlik\Sense\Repository\Repository.exe" -bootstrap -iscentral -restorehostname will resolved this issue.
   
   

If the above does not work, see Qlik Sense Enterprise Hub and Qlik Management Console (QMC) down - bootstrap fails with "Newly created client certificate not valid; root certificate can't sign new certificates"

This Techspert Talks session addresses:

• Understanding Back-end Infrastructure
• Measure 
• Monitor
• Troubleshoot

Tip: Download the LogAnalyzer app here: LogAnalysis App: The Qlik Sense app for troubleshooting Qlik Sense Enterprise on Windows logs.

How are sessions counted in Qlik Sense? 

The following are examples of how sessions are counted within Qlik Sense.  

• One user opens Qlik Sense Hub with One browser on One machine = 1 session
• One user opens Qllik Sense Hub with One browser but Multiple tabs on One machine= 1 session
• One user opens Qlik Sense Hub with Two different browsers on One machine= 2 sessions
• One user opens Qlik Sense Hub with One browser, then closes the browser and reopens it = 2 sessions
• One user opens Qlik Sense Hub with One browser on Two different machines = 2 sessions
• One user opens Qlik Sense Hub and two Apps in one browser, two different tabs and on a mobile device = 2 sessions
• One user opens Qlik Sense Hub from Two virtual proxy with One browser on One machine= 2 sessions
• One user opens Qlik Sense Management Console (QMC) with One browser on One machine = 1 session
• One user opens a Qlik Sense Mashup using Two Apps hosted from the same proxy = 1 session

Sessions will be terminated after the currently configured Session timeout in the Qlik Sense Proxy.
If the Qlik Sense engine or Proxy are terminated or crash, Sessions are ended right away.

Once the maximum number of parallel user connections (5) is reached, this will be documented in the AuditSecurity_Repository log. To identify if this is the issue, review the relevant log and review how the user is interacting with the system. 

The log is stored in:
C:\Programdata\Qlik\Sense\Log\Repository\Audit\AuditSecurity_Repository.txt

The related message reads: 
Access was denied for User: 'Domain\USER', with AccessID '264ff070-6306-4f1b-85db-21a8468939b5', SessionID: 'e3cd957b-a501-4bec-a3f8-d35170a73efa', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied'

Related content:

Troubleshoot too many sessions active in parallel
Qlik Sense April 2018 and later- Service account getting "You cannot access Qlik Sense because you have no access pass"
 

The Qlik Sense log files can be easily collected using the Log Collector. 

The Log Collector is embedded in the Qlik Sense Management Console. It is the last item listed in the Configure Systems section.

For instructions on how to use the Log Collector, see Log collector (help.qlik.com).

Content

• Requirements
• Using the Log Collector
• What does the Qlik Sense Log Collector access?
• Manually collecting log files
• Older Qlik Sense Versions (3.1 and earlier)

Requirements

The user must be a root admin and have administrative permissions.

Using the Log Collector

The best way to gather these logs is to use the Qlik Sense Log Collector. If the tool is not included in your install, it can be downloaded from this article. 

1. Login to Windows Server on Qlik Sense node
2. Open Windows File Explorer
3. Navigate to Log Collector folder at C:\Program Files\Qlik\Sense\Tools\QlikSenseLogCollector
4. Press Shift key and right click on QlikSenseLogCollector.exe 
5. Select Run as different user
6. Enter Qlik Sense service account credentials.
7. Configure log collection
   • Date range to collect logs from (minimum of 5 days if possible)
   • Support case number to include in ZIP file name
   • Select options 
   • Include Archive logs
8. Click Collect
9. If Qlik Sense is not automatically accessible on the node, further options are presented.  
   • Qlik Sense is running and on this host
     this option to get more options on automatic log collection
   • Qlik Sense is not running or accessible
     this option allows to define the path to local Qlik Sense log folder
   • Qlik Sense is located elsewhere
     this option allows to enter FQDN of remote Qlik Sense server
10. Wait until collection is finished
11. Click Close
12. Open generated ZIP file in C:\Program Files\Qlik\Sense\Tools\QlikSenseLogCollector
    Note, no need to unzip the file, simple double click on the ZIP file to browse its content
    • Confirm it contains JSON and TXT files, if system info options were enabled in Step 6
    • Confirm there is one folder per node in the deployment, named in same way as the node
    • Confirm there is a Log folder representing Archived Logs from persistent storage
13. If ZIP content is incomplete, repeat steps above or contact support for further guidance
14. If ZIP content is accurate, attach ZIP file to support case for further analysis by Qlik

What does the Qlik Sense Log Collector access?

This list provides an overview of what system information the Qlik Sense Log collector accesses and collects.

• WhoAmI (information)

  C:\Windows\System32\whoami.exe

• Port status (information)

  C:\Windows\System32\netstat.exe -anob

• Process Info (information)

  C:\Windows\System32\tasklist.exe /v

• Firewall Info (information)

  C:\Windows\System32\netsh.exe advfirewall show allprofiles

• Network Info (information)

   C:\Windows\System32\ipconfig.exe /all

• IIS Status (iisreset /STATUS Display the status of all Internet services.)

   C:\Windows\System32\iisreset.exe /status

• Proxy Activated (information)

   C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | find /i "ProxyEnable"

• Proxy Server (information)

   C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | find /i "proxyserver" 

• Proxy AutoConfig (information)

   C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | find /i "AutoConfigURL" 

• Proxy Override (information)

   C:\Windows\System32\reg.exe query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | find /i "ProxyOverride" 

• Internet Connection (information)

   C:\Windows\System32\ping.exe google.com

• Drive Mappings (information)

   C:\Windows\System32\net.exe use

• Drive Info (information)

   C:\Windows\System32\wbem\wmic.exe /OUTPUT:STDOUT logicaldisk get size

• Localgroup Administrators (information)

   C:\Windows\System32\net.exe localgroup "Administrators"

• Localgroup Sense Service Users (information)

   C:\Windows\System32\net.exe localgroup "Qlik Sense Service Users"

• Localgroup Performance Monitor Users (information)

   C:\Windows\System32\net.exe localgroup "Performance Monitor users"

• Localgroup Qv Administrators (information)

   C:\Windows\System32\net.exe localgroup "QlikView Administrators"

• Localgroup Qv Api (information)

   C:\Windows\System32\net.exe localgroup "QlikView Management API"

• System Information (information)

   C:\Windows\System32\systeminfo.exe

• Program List (information)

   C:\Windows\System32\wbem\wmic.exe /OUTPUT:STDOUT product get name

• Service List (information)

   C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "gwmi win32_service | select Started

• Group Policy (information)

  C:\Windows\System32\gpresult.exe /z

• Local Policies - User Rights Assignment (information)

   C:\Windows\System32\secedit.exe /export /areas USER_RIGHTS /cfg

• Local Policies - Security Options (information)

   C:\Windows\System32\secedit.exe /export /areas

• Certificate - Current User(Personal) (information)

   C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "Get-ChildItem -Recurse Cert:\currentuser\my | Format-list"

• Certificate - Current User(Trusted Root) (information)

   C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "Get-ChildItem -Recurse Cert:\currentuser\Root | Format-list"

• Certificate - Local Computer(Personal) (information)

   C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "Get-ChildItem -Recurse Cert:\localmachine\my | Format-list"

• Certificate - Local Computer(Trusted Root) (information)

   C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "Get-ChildItem -Recurse Cert:\localmachine\Root | Format-list"

• HotFixes (information)

  $FormatEnumerationLimit=-1;$Session = New-Object -ComObject Microsoft.Update.Session;$Searcher = $Session.CreateUpdateSearcher();$historyCount = $Searcher.GetTotalHistoryCount();$Searcher.QueryHistory(0, $historyCount) | Select-Object Title, Description, Date, @{name="Operation"; expression={switch($_.operation){1 {"Installation"}; 2 {"Uninstallation"}; 3 {"Other"}}}} | out-string -Width 1024

• UrlAclList (information)

   C:\Windows\System32\netsh.exe http show urlacl

• PortCertList (information)

   C:\Windows\System32\netsh.exe http show sslcert

Manually collecting log files

Any versions of Qlik Sense Enterprise on Windows prior to May 2021, do not include the Log Collector.

If the Qlik Sense Log collector does not work then you can manually gather the logs.

• Default storage (before archiving): C:\ProgramData\Qlik\Sense\Log
• Default archive storage: C:\ProgramData\Qlik\Sense\Repository\Archived Logs
• Manual retrieval of Reload logs: How to find the Script (Reload) logs in Qlik Sense Enterprise

For information on when logs are archived, see How logging works in Qlik Sense Enterprise on Windows.

Older Qlik Sense Versions (3.1 and earlier)

Persistence Mechanism Current Logs(Active Logs) Archived Logs

Note: Depending on how long the system has been running, this folder can be very large so you will want to include only logs from the time frame relevant to your particular issue; preferably a day before the issue began occurring.

Related Content

How logging works in Qlik Sense Enterprise on Windows 

Qlik Sense Enterprise Client-Managed offers a range of Monitoring Applications that come pre-installed with the product.

Qlik Cloud offers the Data Capacity Reporting App for customers on a capacity subscription, and additionally customers can opt to leverage the Qlik Cloud Monitoring apps.

This article provides information on available apps for each platform.

Content:

• Qlik Cloud
• Data Capacity Reporting App
• Access Evaluator for Qlik Cloud
• Answers Analyzer for Qlik Cloud
• App Analyzer for Qlik Cloud
• Automation Analyzer for Qlik Cloud
• Entitlement Analyzer for Qlik Cloud
• Reload Analyzer for Qlik Cloud
• Report Analyzer for Qlik Cloud
• How to automate the Qlik Cloud Monitoring Apps
• Other Qlik Cloud Monitoring Apps
• OEM Dashboard for Qlik Cloud
• Monitoring Apps for Qlik Sense Enterprise on Windows
• Operations Monitor and License Monitor
• App Metadata Analyzer
• The Monitoring & Administration Topic Group
• Other Apps

Qlik Cloud

Data Capacity Reporting App

The Data Capacity Reporting App is a fully supported app distributed within the product. For more information, see Qlik Help.

Access Evaluator for Qlik Cloud

For more information, see Qlik Cloud Access Evaluator.

Answers Analyzer for Qlik Cloud

For more information, see Qlik Cloud Answers Analyzer.

App Analyzer for Qlik Cloud

For more information, see Qlik Cloud App Analyzer.

Automation Analyzer for Qlik Cloud

For more information, see Qlik Cloud Automation Analyzer.

Entitlement Analyzer for Qlik Cloud

The Entitlement Analyzer is a Qlik Sense application built for Qlik Cloud, which provides Entitlement usage overview for your Qlik Cloud tenant for user-based subscriptions.

The app provides:

• Which users are accessing which apps
• Consumption of Professional, Analyzer and Analyzer Capacity entitlements
• Whether you have the correct entitlements assigned to each of your users
• Where your Analyzer Capacity entitlements are being consumed, and forecasted usage

For more information, see The Entitlement Analyzer.

Reload Analyzer for Qlik Cloud

For more information, see Qlik Cloud Reload Analyzer.

Report Analyzer for Qlik Cloud

For more information, see Qlik Cloud Report Analyzer.

How to automate the Qlik Cloud Monitoring Apps

Do you want to automate the installation, upgrade, and management of your Qlik Cloud Monitoring apps? With the Qlik Cloud Monitoring Apps Workflow, made possible through Qlik's Application Automation, you can:

1. Install/update the apps with a fully guided, click-through installer using an out-of-the-box Qlik Application Automation template. 
2. Programmatically rotate the API key that is required for the data connection on a schedule using an out-of-the-box Qlik Application Automation template. This ensures that the data connection is always operational. 
3. Get alerted whenever a new version of a monitoring app is available using Qlik Data Alerts. 

For more information and usage instructions, see Qlik Cloud Monitoring Apps Workflow Guide.

Other Qlik Cloud Monitoring Apps

OEM Dashboard for Qlik Cloud

For more information and to download the app and usage instructions, see Qlik Cloud OEM Dashboard & Console Settings Collector.

With the exception of the Data Capacity Reporting App, all Qlik Cloud monitoring applications are provided as-is and are not supported by Qlik. Over time, the APIs and metrics used by the apps may change, so it is advised to monitor each repository for updates and to update the apps promptly when new versions are available.

If you have issues while using these apps, support is provided on a best-efforts basis by contributors to the repositories on GitHub.

Monitoring Apps for Qlik Sense Enterprise on Windows

Operations Monitor and License Monitor

The Operations Monitor loads service logs to populate charts covering performance history of hardware utilization, active users, app sessions, results of reload tasks, and errors and warnings. It also tracks changes made in the QMC that affect the Operations Monitor.

The License Monitor loads service logs to populate charts and tables covering token allocation, usage of login and user passes, and errors and warnings.

For a more detailed description of the sheets and visualizations in both apps, visit the story About the License Monitor or About the Operations Monitor that is available from the app overview page, under Stories.

Basic information can be found here:

The License Monitor 
The Operations Monitor 

Both apps come pre-installed with Qlik Sense. 

If a direct download is required: Sense License Monitor | Sense Operations Monitor. Note that Support can only be provided for Apps pre-installed with your latest version of Qlik Sense Enterprise on Windows. 

App Metadata Analyzer

The App Metadata Analyzer app provides a dashboard to analyze Qlik Sense application metadata across your Qlik Sense Enterprise deployment. It gives you a holistic view of all your Qlik Sense apps, including granular level detail of an app's data model and its resource utilization.

Basic information can be found here: 

App Metadata Analyzer (help.qlik.com)

For more details and best practices, see: 

App Metadata Analyzer (Admin Playbook)

The app comes pre-installed with Qlik Sense.

The Monitoring & Administration Topic Group

Looking to discuss the Monitoring Applications? Here we share key versions of the Sense Monitor Apps and the latest QV Governance Dashboard as well as discuss best practices, post video tutorials, and ask questions.

Monitoring & Administration 

Other Apps

LogAnalysis App: The Qlik Sense app for troubleshooting Qlik Sense Enterprise on Windows logs 
Sessions Monitor, Reloads-Monitor, Log-Monitor 
Connectors Log Analyzer 

All Other Apps are provided as-is and no ongoing support will be provided by Qlik Support.

Content

• Rationale
• Understanding interactive IdPs in Qlik Cloud
• Why Qlik Cloud only supports one interactive IdP
• Why Federate Identity In-House?
• Solution: Federate IdPs with an enterprise-grade IdP
• How to Implement a Federated IdP
• Conclusion

Qlik Cloud is designed to support a single interactive Identity Provider (IdP) per tenant.

This approach enhances security, governance, and operational control while simplifying authentication management. Organizations that require multiple identity sources can achieve this by using a federated IdP (such as Azure Entra, Auth0, Keycloak, or Okta) to consolidate authentication and seamlessly connect it to Qlik Cloud

Rationale

Understanding interactive IdPs in Qlik Cloud

Qlik Cloud allows organizations to configure an interactive IdP to manage user authentication. Options include:

• Qlik Account (default for new, non-government tenants).
• A standards-compliant OIDC or SAML provider, such as Azure Entra, Okta, Auth0, or Keycloak.

Any unauthenticated user attempting to access the tenant is redirected to the configured interactive IdP for authentication, ensuring a streamlined and secure login experience.

Why Qlik Cloud only supports one interactive IdP

Using a single interactive IdP is a best practice for identity management and ensures consistency, security, and simplified administration.

Key reasons include:

• User Identity Consistency: Qlik Cloud relies on a user's subject and email as unique identifiers. Managing a single interactive IdP helps prevent duplicate identities and ensures seamless user access, reducing risk of users gaining unauthorized access to sensitive data or permissions.

• Streamlined Identity & Access Management: Since Qlik Cloud does not transform incoming claims beyond remapping keys, keeping authentication centralized prevents unintended variances in usernames, email formats, or group names. This improves security and reduces maintenance of licenses and entitlements.

• Optimized Group Management: A single interactive IdP provides a consistent structure for groups, ensuring they align with an organization’s access policies. By managing group filtering in one place, organizations can maintain clear and structured permissions. Managing groups across multiple IdPs can quickly become unmanageable, leading to inconsistencies in user access.

• Simplified Access Control: Groups in Qlik Cloud are referenced by name, making it more efficient to manage access through a single federated IdP rather than multiple sources.

• Efficient Token Management: A unified IdP helps maintain consistency in authentication tokens, reducing administrative overhead and ensuring a smooth user experience.

• Enhanced Security & Auditability: By centralizing authentication through a single IdP, organizations can apply security controls, enforce device policies, and monitor user access through audit logs.

A federated IdP ensures that organizations retain full control over authentication policies, while providing a seamless experience for users accessing Qlik Cloud.

Why Federate Identity In-House?

Many organizations choose to use a federated identity provider to streamline identity management, enhance security, and improve user experience across multiple applications. Benefits include:

• Centralized User Lifecycle Management: Users from different sources can be managed in a single system, reducing duplication and inconsistencies.

• Improved Security Policies: Organizations can enforce multi-factor authentication (MFA), conditional access policies, and device trust settings at the IdP level.

• Single Sign-On (SSO) Across Applications: Users authenticate once and gain seamless access to multiple platforms, including Qlik Cloud.

• Comprehensive Logging & Compliance: A federated IdP provides consolidated audit trails and governance controls for user authentication.

By implementing a federated identity provider, organizations can maintain flexibility in their authentication strategy while ensuring compatibility with Qlik Cloud.

Solution: Federate IdPs with an enterprise-grade IdP

The recommended approach for organizations that need to authenticate users across multiple identity sources is to configure a federated IdP that consolidates authentication. Solutions like Azure Entra ID or Okta can be used to unify identity management and connect to Qlik Cloud via OIDC or SAML.

How to Implement a Federated IdP

1. Set Up a Federated IdP (Azure Entra ID, Okta, or another identity management solution).

2. Sync Identity Sources within the federated IdP to ensure unique identities across different user groups.

3. Configure OIDC/SAML Authentication in Qlik Cloud with the federated IdP.

This approach ensures a secure, efficient, and scalable authentication strategy that aligns with best practices for enterprise identity management.

Conclusion

Qlik Cloud is designed to integrate seamlessly with a single interactive IdP, providing a robust and secure authentication framework. Organizations that need to consolidate multiple identity sources can achieve this through a federated IdP, ensuring centralized management, improved security, and a streamlined user experience. By leveraging enterprise-grade IdPs like Azure Entra ID or Okta, organizations can enhance their identity management strategy while maintaining full control over authentication policies and governance.

Environment

• Qlik Cloud

When using SAML or ticket authentication in Qlik Sense, some users belonging to a big number of groups see the error 431 Request header fields too large on the hub and cannot proceed further.

Resolution

The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.

The default setting will still be a header size of 8192 bytes. The fix adds support for a configurable MaxHttpHeaderSize.

Steps:

1. To configure add it at the top section of the file under [globals] (C:\Program Files\Qlik\Sense\ServiceDispatcher\service.conf)

   [globals]
   LogPath="${ALLUSERSPROFILE}\Qlik\Sense\Log"
   (...)
   MaxHttpHeaderSize=16384

2. Once the change is done, save the file and restart the Qlik Service Dispatcher service.

Note: The above value (16384) is an example. You may need to put more depending on the total number of characters of all the AD groups to which the user belongs. The max value is 65534.

Environment:

Qlik Sense Enterprise on Windows 

Can deleted Qlik Cloud apps or sheets be recovered? Can apps, sheets, or automations owned by a deleted user be recovered?

Once an app or sheet has been deleted it cannot be recovered.

What about deleted users and their orphaned objects?

Orphaned apps (created when the user has been deleted) can be reassigned. See Qlik Cloud Analytics: Can the owner of orphaned Apps be changed after the owner is deleted? for instructions.

For more information about what to consider before deleting a user, see Deleting users.

The following cannot be recovered:

• A deleted app
• A deleted sheet
• Personal objects belonging to a deleted user become unavailable immediately and may be purged during a cleanup process
• Automations belonging to a deleted user

Qlik suggests the following techniques to ensure no work is lost:

• Duplicate the app to the same or different 'Shared' or 'Personal' space
• Setup a test or 'recycle bin' space where duplicated apps are kept until it has been verified that the app can be fully deleted
• If space is a concern, export the app without data and re-import it to the 'recycle bin' space. This will allow you to keep an empty master copy of the app

Qlik has received feedback in the past to implement a recovery feature: Recycle bin for SaaS editions of Qlik Sense (#279017) (Log in to Qlik Ideation to leave comments and vote.)

Content

• Chapters
• Environment overview
• Zabbix Server set-up
• Clone the Zabbix docker repository
• Setting up environment variables
• Re-link compose.yaml to our preferred compose file
• Logging in for the first time
• Zabbix Agent installation on Windows Server
• Zabbix Server Configuration
• Adding the first Server
• Importing Qlik Sense Enterprise for Windows templates
• Linking templates to hosts
• Engine Healthcheck Monitoring with HTTP Agent example
• Steps to configure a new HTTP Agent for QSE Health monitoring
• Defining the Virtual Proxy prefix for Zabbix HTTP Agent
• Resources & Links

Chapters

• 01:33 - Why use Zabbix
• 02:35 - Architecture for demo
• 03:41 - Downloading the installer
• 04:36 - Installing Zabbix Server
• 08:37 - Installing the Zabbix agent
• 12:17 - Applying Qlik specific templates
• 14:28 - Reviewing Qlik-specific Dashboards
• 16:49 - Configuration details
• 18:42 - How to create a dashboard
• 20:30 - Q&A: Can Zabbix run on Windows?
• 21:16 - Q&A: Is Zabbix supported by Qlik?
• 21:36 - Q&A: Can this monitor data capacity?
• 22:45 - Q&A: Can the Zabbix agents affect performance?
• 23:20 - Q&A: Can it monitor bookmark size?
• 24:02 - Q&A: Can this monitor amount of data being used?
• 24:19 - Q&A: Can this monitor sheets, and objects in apps?
• 24:49 - Q&A: Is there a similar tool for Cloud?
• 25:36 - Q&A: Would this work with QlikView?
• 26:11 - Q&A: Does this read the app data?
• 26:26 - Q&A: Can this help measure how long to open an app?

Environment overview

The environment being demonstrated in this article consists of one Central Node and Two Worker Nodes. Worker 1 is a Consumption node where both Development and Production apps are allowed. Worker 2 is a dedicated Scheduler Worker node where all reloads will be directed. Central Node is acting as a Scheduler Manager.

Zabbix Server set-up

The Zabbix Monitoring appliance can be downloaded and configured in a number of ways, including direct install on a Linux server, OVF templates and self-hosting via Docker or Kubernetes. In this example we will be using Docker. We assume you have a working docker engine running on a server or your local machine. Docker Desktop is a great way to experiment with these images and evaluate whether Zabbix fits in your organisation.

Clone the Zabbix docker repository

This will include all necessary files to get started, including docker compose stack definitions supporting different base images, features and databases, such as MySQL or PostgreSQL. In our example, we will invoke one of the existing Docker compose files which will use PostgreSQL as our database engine.

Source: https://www.zabbix.com/documentation/current/en/manual/installation/containers#docker-compose

git clone https://github.com/zabbix/zabbix-docker.git

Setting up environment variables

Here you can modify environment variables as needed, to change things like the Stack / Composition name, default ports and many other settings supported by Zabbix.

cd ./zabbix-docker/env_vars
ls -la #to list all hidden files (.dotfiles)
nano .env_web

In this file, we will change the value for ZBX_SERVER_NAME to something else, like "Qlik STT - Monitoring". Save the changes and we are ready to start up Zabbix Server.

Re-link compose.yaml to our preferred compose file

./zabbix-docker folder contains many different docker compose templates, either using public images or locally built (latest and local tags).

You can run your chosen base image and database version with:

docker compose -f compose-file.yaml up -d && docker compose logs -f --since 1m

Or unlink and re-create the symbolic link to compose.yaml, which enables managing the stack without specifying a compose file. Run the following commands inside the zabbix-docker folder to use the latest Ubuntu-based image with PostgreSQL database:

1. unlink compose.yaml
2. ln -s ./docker-compose_v3_ubuntu_pgsql_latest.yaml compose.yaml
3. Start the Zabbix stack in detached mode with docker compose up -d

If you skip the -d flag, the Docker stack will start and your command line will be connected to the log output for all containers. The stack will stop if you exit this mode with CTRL+C or by closing the terminal session. Detached mode will run the stack in background. You can still connect to the live log output, pull logs from history, manage the stack state or tear it down using docker compose down.

Pro tip: you will be using docker compose commands often when working with Docker. You can create an alias in most shells to a short-hand, such as "dc = docker compose". This will still accept all following verbs, such as start|stop|restart|up|down|logs and all following flags. docker compose up -d && docker compose logs -f --since 1m would become dc up -d && dc logs -f --since 1m.

Logging in for the first time

• By default, the Zabbix Web GUI will be exposed on ports 80/443
• Using tools like Portainer makes Docker stack management easier

Use the IP address of your Docker host: http://IPADDRESS or https://IPADDRESS.

The Zabbix server stack can be hosted behind a Reverse Proxy.

The default username is Admin and the default password is zabbix. They are case sensitive.

Zabbix Agent installation on Windows Server

Download link: https://www.zabbix.com/download_agents, in this case download the Windows installer MSI.

1. Run the installer .msi
2. Leave components unchanged
3. Hostname = your machine hostname, we will have to use the same hostname when adding a Host in Zabbix Server.
4. Zabbix server IP/DNS: IP address or DNS name of your Zabbix Server
5. Agent listening port, the same port will be used when when adding a Host in Zabbix Server.
6. Enable "Add agent location to the PATH" for convenience in the command line
7. Finish installation

Zabbix Server Configuration

Adding the first Server

After Agent is installed, in Zabbix go to Data Collection > Hosts and click on Create host in the top right-hand corner. Provide details like hostname and port to connect to the Agent, a display name and adjust any other parameters. You can join clusters with Host groups. This makes navigating Zabbix easier.

Fig 1: Adding a Host

 

Note: Remember to change how Zabbix Server will connect to the Agent on this node, either with IP address or DNS. Note that the default IP address points to the Zabbix Server.

Importing Qlik Sense Enterprise for Windows templates

In the Zabbix Web GUI, navigate to Data Collection > Templates and click on the Import button in the top right-hand corner. You can find the templates file at the following download link:

LINK to zabbix templates

Linking templates to hosts

Once you have added all your hosts to the Data Collection section, we can link all Qlik Sense servers in a cluster using the same templates. Zabbix will automatically populate metrics where these performance counters are found. From Data Collection > Hosts, select all your Qlik Sense servers and click on "Mass update". In the dialog that comes up, select the "Link templates" checkbox. Here you can link/replace/unlink templates across many servers in bulk.

Select "Link" and click on the "Select" button. This new panel will let us search for Template groups and make linking a bit easier. The Template Group we provided contains 4 individual templates.

Fig 2: Mass update panel

Fig 3: Search for Template Group

Once you Select and Update on the main panel, all selected Hosts will receive all items contained in the templates, and populate all graphs and Dashboards automatically.

To review your data, navigate to Monitoring > Hosts and click on the "Dashboards" or "Graphs" link for any node, here is the default view when all Qlik Sense templates are linked to a node:

Fig 4: Host Dashboards

 

Fig 5: Repository Service metrics - Example

Engine Healthcheck Monitoring with HTTP Agent example

We will query the Engine Healthcheck end-point on QlikServer3 (our consumer node) and extract usage metrics from by parsing the JSON output.

Steps to configure a new HTTP Agent for QSE Health monitoring

We will be using a new Anonymous Access Virtual Proxy set up on each node. This Virtual Proxy will only Balance on the node it represents, to ensure we extract meaningful metrics from the Engine and we won't be load-balanced by the Proxy service across multiple nodes. There won't be a way to determine which node is responding, without looking at DevTools in your browser. You can also use Header or Certificate authentication in the HTTP Agent configuration.

Once the Virtual Proxy is configured with Anonymous Only access, we can use this new prefix to configure our HTTP Agent in Zabbix.

Defining the Virtual Proxy prefix for Zabbix HTTP Agent

In the Zabbix web GUI, go to Data collection > Hosts. Click on any of your hosts. On tabs at the top of the pop-up, click on Macros and click on the "Inherited and host macros" button. Once the list has loaded, search for the following Macro: {$VP_PREFIX}. This is set by default to "anon". Click on "Change" and set Macro value to your custom Virtual Proxy Prefix for Engine diagnostics, and click Update. The Virtual Proxy prefix will have to be changed on each node for the "Engine Performance via HTTP Agent" item to work. Alterantively, you can modify the MACRO value for the Template, this will replicate the changes across all nodes associated to this Template.

To make this change at the Template level, go to Data collection > Templates. Search for the "Engine Performance via HTTP Agent" and click on the Template. Navigate to the Macros tab in the pop-up and add your Virtual Proxy Prefix here to make this the new default for your environment. No further changes to Node configuration are required at this point.

The Zabbix templates provided in this article contain the following Engine metric JSONParsers:

• Memory: Allocated, Committed, Free, Total Physical
• Calls, Selections
• Saturation status (true/false)
• Sessions: Active/Total
• Users: Active/Total

These are the same performance counters that you can see in the Engine Health section in QMC.

Stay tuned to new releases of the Monitoring Templates. Feel free to customise these to your needs and share with the Community.

Resources & Links

• Zabbix home page
• Zabbix Installation from containers documentation
• Zabbix Docker repository on GitHub
• Install Docker Engine on Ubuntu

Environment

• Qlik Sense Enterprise on Windows

Some script logs are not transferred to Archive log Folder.

Storage Locations:

Qlik Sense log folder:

C:\ProgramData\Qlik\Sense\Log\Script
Log names consist out of the AppID and a year, date, and timestamp.

Archived log Folder:

 \\SERVICECLUSTER-SHARE\ArchivedLogs\NodeName\Script
Log names consist out of the AppID and a year, date, and timestamp.

Environment:

• Qlik Sense Enterprise on Windows, all versions

Resolution:

By design, not all script logs are transferred to the Archived logs folder. Reloads executed from the hub are not transferred. 

1. When reloading data in app via hub, Script log will be left in Script log folder C:\ProgramData\Qlik\Sense\Log\Script

2. When reloading data via QMC/task, Script log will be transferred to Archived logs folder \\SERVICECLUSTER-SHARE\ArchivedLogs\NodeName\Script

Related Content:

• How to find the Script (Reload) logs in Qlik Sense Enterprise

Question

When using the unattended installer to install Talend on-prem products, such as TAC (Talend Administration Center), there is no visible log. Where can you find the log, and how can you determine if the products have been successfully installed?

The installation log is located in /tmp for Linux and %TEMP% for Windows. The file name will be "installbuilderinstaller.log". To locate the correct install log, please refer to the timestamp at the end, as multiple installation logs may exist in the temp directory.

To confirm successful installation, it is best to inspect the installation folder. Upon successful completion, a file named uninstall (for Linux) or uninstall.exe (for Windows) will be generated at the root of the installation folder. With default settings, the file will be located at /opt/Talend-8.0.1/uninstall or C:\Talend\8.0.1\uninstall.exe.

It is not possible to set up a Microsoft Office 365 email provider with OAuth 2.0 authentication.
The HAR file shows this message in Network:

{connectionFailed: true, message: "Error during email request", success: false}
connectionFailed: true
message: "Error during email request"
success: false

Resolution

Configure the Mail.Send permission as it is described in Configuring a Microsoft 365 email provider using OAuth2.

Cause

This problem occurs when the Mail.Send permission has not been configured in the app registration.

Related Content

More information about the  Mail.Send permission can be found in Application permission to Microsoft Graph (learn.microsoft.com).

Environment

• Qlik Tabular reporting
• Qlik Cloud

Information about app and storage size for Qlik Cloud for Qlik Sense Enterprise SaaS and Qlik Sense Business can be found in Qlik Sense capacity.  

Note: An app on disk is typically 4-6 times bigger in memory, although this is a rule of thumb and exceptions can and do occur, and an app within the "on-disk" size limit may balloon past the "in memory" limit.  

App Objects have a memory limit of 10 GB, except when run on dedicated capacity.

If you are looking to compare other features between Qlik Sense Business and Qlik Sense Enterprise SaaS, see Compare product features 

For more information about capacity, see:

Qlik Sense specifications and capacity 
Pricing | Qlik Sense

This can help in the troubleshooting process to find out what App/User was active and accessed an application right before an error/issue in the environment.
 
The entries are color coded for the name of the App in the Hub/QMC along with the APP ID and Session ID
 
Note: Session ID will change for different users and different browsers, this includes closing the browser and reopening it (which is a new session, but will be the same App ID). In this test there's only one session and two accesses of the app, but a user can open the app in another browser which will show it as the same user in two different sessions for the same app at the same time.
 

Environment: 

Qlik Sense Enterprise on Windows , version 3.2.1 and newer, single node

Windows 2012 R2

App Name: Load Test APP ID
Published APP ID?: c3ed4e49-dc98-4ff8-b140-f3d945236197 - Load Test APP ID
Session ID?: fe87b122-8979-45d4-9c37-3c39ce704045 - Load Test APP ID

C:\ProgramData\Qlik\Sense\Log\Engine\Trace\QLIKSERVER1_System_Engine.txt
 
First Open (loaded into memory):
 
16           20170321T215743.565+0100       INFO      QlikServer1         System.Engine.Engine   46           6f40f67b-47aa-406f-bb78-947e90cd9ff3         DOMAIN\qvservice         QvSocket: Connected to server as user: 'UserDirectory=DOMAIN; UserId=qvservice' for document: '/app/c3ed4e49-dc98-4ff8-b140-f3d945236197' on socket fe80::743e:6e47:b9f:acb5:4747 <-> fe80::743e:6e47:b9f:acb5:62282         0              Internal Engine                20170321T215743.566+0100       3136       3176       20170321T215516.000+0100       6f40f67b-47aa-406f-bb78-947e90cd9ff3
17           20170321T215743.573+0100       INFO      QlikServer1         System.Engine.Engine   46           31b65464-36b3-48c1-8dc8-f7b5c2ecbb9b              DOMAIN\qvservice         Server: Document Load: Beginning open of document                fe87b122-8979-45d4-9c37-3c39ce704045              DOMAIN              qvservice             20170321T215743.573+0100                3132       3176       20170321T215516.000+0100       31b65464-36b3-48c1-8dc8-f7b5c2ecbb9b
18           20170321T215743.597+0100       INFO      QlikServer1         System.Engine.Engine   46           610de372-ad42-4975-863b-93f5d9fbcbec              DOMAIN\qvservice         DOC loading: Beginning load of document C3ED4E49-DC98-4FF8-B140-F3D945236197.           fe87b122-8979-45d4-9c37-3c39ce704045              DOMAIN              qvservice                20170321T215743.597+0100       3756       3176       20170321T215516.000+0100       610de372-ad42-4975-863b-93f5d9fbcbec
19           20170321T215744.640+0100       INFO      QlikServer1         System.Engine.Engine   46           f15e84d0-f8d9-44d1-a8e1-3095b41e4a0d        DOMAIN\qvservice         Document Load: The document c3ed4e49-dc98-4ff8-b140-f3d945236197 was loaded.          fe87b122-8979-45d4-9c37-3c39ce704045              DOMAIN              qvservice                20170321T215744.641+0100       4468       3176       20170321T215516.000+0100       f15e84d0-f8d9-44d1-a8e1-3095b41e4a0d
 
Second Open (already loaded in memory):
 
20           20170321T220052.937+0100       INFO      QlikServer1         System.Engine.Engine   47           34b26c68-67e8-4be1-9439-6026c0c59f9e          DOMAIN\qvservice         QvSocket: Connected to server as user: 'UserDirectory=DOMAIN; UserId=qvservice' for document: '/app/c3ed4e49-dc98-4ff8-b140-f3d945236197' on socket fe80::743e:6e47:b9f:acb5:4747 <-> fe80::743e:6e47:b9f:acb5:62296         0              Internal Engine                20170321T220052.937+0100       3136       3176       20170321T215516.000+0100       34b26c68-67e8-4be1-9439-6026c0c59f9e
21           20170321T220052.960+0100       INFO      QlikServer1         System.Engine.Engine   47           cc981161-bbfd-42ec-aa5c-b512e0602283         DOMAIN\qvservice         Server: Document Load: Beginning open of document     fe87b122-8979-45d4-9c37-3c39ce704045   DOMAIN              qvservice             20170321T220052.960+0100       3132       3176                20170321T215516.000+0100       cc981161-bbfd-42ec-aa5c-b512e0602283
 
Notice the first load will state what Session ID initiated the load into memory. The second attempt only gives the App ID in the first log line and then the Session ID is in an entry afterwards. While these entries should be right after each other, depending on what’s happening, they might be broken up by other entries. It’s unlikely, but does make it more difficult to troubleshoot a heavily trafficked environment without access to the Proxy logs.
 
Note: The First Open is only triggered when the QVF is not in memory, so the initial load in memory might be in another log file depending on when the log files are archived.
 
C:\ProgramData\Qlik\Sense\Log\Proxy\Audit\QLIKSERVER1_AuditSecurity_Proxy.txt
 
First Open (loaded into memory):
 
3              11.11.0.0              20170321T215732.019+0100       QlikServer1         738f0e4c-85bc-44ab-accb-18825ec407a5                Command=Login;Result=0;ResultText=Success   fe87b122-8979-45d4-9c37-3c39ce704045              c8d0eb48-fe7a-47da-bbca-0eab11340b92  0              DOMAIN              qvservice             0              Not available      Security                ::ffff:172.16.16.100          Proxy    AppAccess          /hub/stream/e4f1e040-75cf-4db0-afbd-baaf90cab8f8    Login                0              User authenticated. User 'DOMAIN\qvservice' used authentication method 'ticket' and got session 'fe87b122-8979-45d4-9c37-3c39ce704045'            1dc02c31e1779346144cbcc4b75a81a55f466159
4              11.11.0.0              20170321T215742.970+0100       QlikServer1         97ab24cb-edb8-4930-a343-69e044ec7dd0                Command=Add app privileges;Result=0;ResultText=Success         fe87b122-8979-45d4-9c37-3c39ce704045                0e6278ad-ffff-4d6c-9d66-af84a1596d78                 0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Security                ::ffff:172.16.16.100          Proxy    AppAccess                /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197            Add app privileges:ProcessRequestAccessResult 0                Access to app 'c3ed4e49-dc98-4ff8-b140-f3d945236197' allowed with access type 'UserAccessType', result code 'Ok'              94d89f25a8faad2ea59837ded7b6a1603a4607da

Second Open (already loaded in memory):
 
20           20170321T220052.937+0100       INFO      QlikServer1         System.Engine.Engine   47           34b26c68-67e8-4be1-9439-6026c0c59f9e          DOMAIN\qvservice         QvSocket: Connected to server as user: 'UserDirectory=DOMAIN; UserId=qvservice' for document: '/app/c3ed4e49-dc98-4ff8-b140-f3d945236197' on socket fe80::743e:6e47:b9f:acb5:4747 <-> fe80::743e:6e47:b9f:acb5:62296         0              Internal Engine                20170321T220052.937+0100       3136       3176       20170321T215516.000+0100       34b26c68-67e8-4be1-9439-6026c0c59f9e
21           20170321T220052.960+0100       INFO      QlikServer1         System.Engine.Engine   47           cc981161-bbfd-42ec-aa5c-b512e0602283         DOMAIN\qvservice         Server: Document Load: Beginning open of document     fe87b122-8979-45d4-9c37-3c39ce704045   DOMAIN              qvservice             20170321T220052.960+0100       3132       3176                20170321T215516.000+0100       cc981161-bbfd-42ec-aa5c-b512e0602283
 
As you can see the first load will state what Session ID initiated the load into memory. The second attempt only gives the App ID in the first log line and then the Session ID is in an entry afterwards. While these entries should be right after each other, depending on what’s happening, they might be broken up by other entries. It’s unlikely, but does make it more difficult to troubleshoot a heavily trafficked environment without access to the Proxy logs.
 
Note: The First Open is only triggered when the QVF is not in memory, so the initial load in memory might be in another log file depending on when the log files are archived.

C:\ProgramData\Qlik\Sense\Log\Proxy\Audit\QLIKSERVER1_AuditSecurity_Proxy.txt
 
First Open (loaded into memory):
 
3              11.11.0.0              20170321T215732.019+0100       QlikServer1         738f0e4c-85bc-44ab-accb-18825ec407a5                Command=Login;Result=0;ResultText=Success   fe87b122-8979-45d4-9c37-3c39ce704045              c8d0eb48-fe7a-47da-bbca-0eab11340b92  0              DOMAIN              qvservice             0              Not available      Security                ::ffff:172.16.16.100          Proxy    AppAccess          /hub/stream/e4f1e040-75cf-4db0-afbd-baaf90cab8f8    Login                0              User authenticated. User 'DOMAIN\qvservice' used authentication method 'ticket' and got session 'fe87b122-8979-45d4-9c37-3c39ce704045'            1dc02c31e1779346144cbcc4b75a81a55f466159
4              11.11.0.0              20170321T215742.970+0100       QlikServer1         97ab24cb-edb8-4930-a343-69e044ec7dd0                Command=Add app privileges;Result=0;ResultText=Success         fe87b122-8979-45d4-9c37-3c39ce704045                0e6278ad-ffff-4d6c-9d66-af84a1596d78                 0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Security                ::ffff:172.16.16.100          Proxy    AppAccess                /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197            Add app privileges:ProcessRequestAccessResult 0                Access to app 'c3ed4e49-dc98-4ff8-b140-f3d945236197' allowed with access type 'UserAccessType', result code 'Ok'              94d89f25a8faad2ea59837ded7b6a1603a4607da
 
Second Open (already loaded in memory):
 
5              11.11.0.0              20170321T220052.910+0100       QlikServer1         881a8f23-f3a2-4f2b-ae45-969dc9c0c2e3                Command=Add app privileges;Result=0;ResultText=Success         fe87b122-8979-45d4-9c37-3c39ce704045                a057e326-6123-406a-8ee2-e82a46efe367             0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Security                ::ffff:172.16.16.100          Proxy    AppAccess                /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197            Add app privileges:ProcessRequestAccessResult 0                Access to app 'c3ed4e49-dc98-4ff8-b140-f3d945236197' allowed with access type 'UserAccessType', result code 'Ok'              0649a45ad43ccfcf97b82a1cd8d14dd2fa0cfe3b
6              11.11.0.0              20170321T220553.102+0100       QlikServer1         a5462a59-cf10-494e-b021-fc1c26bad82c                Command=Add app privileges;Result=0;ResultText=Success         fe87b122-8979-45d4-9c37-3c39ce704045                a057e326-6123-406a-8ee2-e82a46efe367             0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Security                ::ffff:172.16.16.100          Proxy    AppAccess                /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197            Add app privileges:ProcessRequestAccessResult 0                Access to app 'c3ed4e49-dc98-4ff8-b140-f3d945236197' allowed with access type 'UserAccessType', result code 'Ok'              11c238cbc3edf8e921ebf0e0d8f71b199497a880
 
There’s a few logs listed here that will give other information along with the Session and App ID, but with the Proxy logs we can verify the Session ID that links to the App ID. This can point you to a time, user and app accessed giving you an idea of what users/apps were active and open at the time.

C:\ProgramData\Qlik\Sense\Log\Engine\Audit\QLIKSERVER1_AuditActivity_Engine.txt

First Open (loaded into memory):
 
1              12.16.1.0              20170321T215745.019+0100       QlikServer1         48345a91-0cef-4f54-adce-e1137ab27acd                20170321T215745.007+0100       12.2.2.0                Command=Open app;Result=0;ResultText=Success                fe87b122-8979-45d4-9c37-3c39ce704045              0e6278ad-ffff-4d6c-9d66-af84a1596d78                 1                DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197               Not available      Engine  Not available              Global::OpenApp             Open app            0              Success 48345a91-0cef-4f54-adce-e1137ab27acd
 
Second Open (already loaded in memory):
 
2              12.16.1.0              20170321T220053.193+0100       QlikServer1         ea7e3197-3651-4a87-9c56-a4d51872f01f                20170321T220053.193+0100       12.2.2.0                Command=Open app;Result=0;ResultText=Success                fe87b122-8979-45d4-9c37-3c39ce704045              a057e326-6123-406a-8ee2-e82a46efe367             1                DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197               Not available      Engine  Not available              Global::OpenApp             Open app            0              Success ea7e3197-3651-4a87-9c56-a4d51872f01f
 
This log gives the information on the app being opened with its Session ID.
 
C:\ProgramData\Qlik\Sense\Log\Engine\Trace\QLIKSERVER1_Session_Engine.txt
 
First Open (Closed browser tab):
 
1              20170321T220016.240+0100       INFO      QlikServer1         Session.Engine.Engine   53           6f637615-237c-4716-87d1-4a3f06ed81be        DOMAIN\qvservice                         fe87b122-8979-45d4-9c37-3c39ce704045              DOMAIN                qvservice             20170321T220016.238+0100       3132       3176       12.2.50504.0409.10                20170321T215516.000+0100       0e6278ad-ffff-4d6c-9d66-af84a1596d78                 c3ed4e49-dc98-4ff8-b140-f3d945236197    Load Test APP ID              20170320T195542.497Z                 Socket closed by client                20170321T215743.000+0100       0.001771              0.006285              1902       5619       13           0                UserDirectory=DOMAIN; UserId=qvservice           Off         6f637615-237c-4716-87d1-4a3f06ed81be
 
This has one entry for when tab in the browser was closed (but maintained the actual Session ID since the browser was still active) and you can see by the time stamp of 20170321T220016 is before the Second Open of 20170321T220053. If you had closed the Second Open session you would have a similar entry.
 
C:\ProgramData\Qlik\Sense\Log\Proxy\Audit\QLIKSERVER1_AuditActivity_Proxy.txt
 
First Open (No Session established until now):
 
1              11.11.0.0              20170321T215731.469+0100       QlikServer1         201ee217-3713-44cb-9277-d374799a84fb                Command=Get ticket;Result=0;ResultText=Success          0              0              0              INTERNAL            sa_proxy                0              Not available      Proxy    Not available      /hub/stream/e4f1e040-75cf-4db0-afbd-baaf90cab8f8    Get ticket:ConsumeIncomingTicket  0              User claimed ticket: 'ewXLiJDk6xM1Q0TH'. Session will be etablished                201ee217-3713-44cb-9277-d374799a84fb
2              11.11.0.0              20170321T215731.512+0100       QlikServer1         7042d186-3f1d-4759-9d87-663b73522766                Command=Start session;Result=0;ResultText=Success    fe87b122-8979-45d4-9c37-3c39ce704045              0                0              DOMAIN              qvservice             0              DOMAIN\qvservice         Proxy    Not available                /qps/sessionstart/qvservice        Start session      0              Start session for user: 'DOMAIN\qvservice'                7042d186-3f1d-4759-9d87-663b73522766
3              11.11.0.0              20170321T215731.892+0100       QlikServer1         2e9f0d03-aabe-403a-b282-ec01a47283a0                Command=Add session;Result=0;ResultText=Success      fe87b122-8979-45d4-9c37-3c39ce704045                c8d0eb48-fe7a-47da-bbca-0eab11340b92             0              DOMAIN              qvservice             0              Not available                Proxy    Not available      /hub/stream/e4f1e040-75cf-4db0-afbd-baaf90cab8f8    Add session:NotifyOfPostSession       0              Syncing user attributes for user 'DOMAIN\qvservice'        2e9f0d03-aabe-403a-b282-ec01a47283a0
4              11.11.0.0              20170321T215736.774+0100       QlikServer1         4f3ec3ce-604b-4fad-930c-6c5d3c417112                Command=Get session;Result=200;ResultText=Success  fe87b122-8979-45d4-9c37-3c39ce704045                bcce5b5b-a2e5-455c-9a36-f3fe076b03e3              0              DOMAIN              qvservice             0              Not available                Proxy    AppAccess          /qps/user?targeturi=http:%2f%2fqlikserver1.domain.local%2fhub%2f     Get session:HandleRequest 200         Handle connection request         4f3ec3ce-604b-4fad-930c-6c5d3c417112
5              11.11.0.0              20170321T215743.567+0100       QlikServer1         1fcb5c5c-15f5-40a6-bd54-0819643cd197                Command=Open connection;Result=0;ResultText=Success           fe87b122-8979-45d4-9c37-3c39ce704045                0e6278ad-ffff-4d6c-9d66-af84a1596d78                 0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Proxy    AppAccess          /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197                Open connection             0              Backend web socket connection Opened for session 'fe87b122-8979-45d4-9c37-3c39ce704045'. App id: 'c3ed4e49-dc98-4ff8-b140-f3d945236197'. UserAgent: 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36'           1fcb5c5c-15f5-40a6-bd54-0819643cd197
 
First Open (Closed tab)
 
6              11.11.0.0              20170321T220016.242+0100       QlikServer1         12a1b6ff-d000-4f56-a58c-8ca1bd36a567                Command=Close connection;Result=0;ResultText=Success            fe87b122-8979-45d4-9c37-3c39ce704045                0e6278ad-ffff-4d6c-9d66-af84a1596d78                 0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Proxy    AppAccess          /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197                Close connection              0              Backend web socket connection Closed for session 'fe87b122-8979-45d4-9c37-3c39ce704045'. App id: 'c3ed4e49-dc98-4ff8-b140-f3d945236197. UserAgent: 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36'           12a1b6ff-d000-4f56-a58c-8ca1bd36a567
 
Second Open:
 
7              11.11.0.0              20170321T220052.937+0100       QlikServer1         f1f1350f-0b00-4cf1-b30c-51ddbfecb6bb                Command=Open connection;Result=0;ResultText=Success           fe87b122-8979-45d4-9c37-3c39ce704045                a057e326-6123-406a-8ee2-e82a46efe367             0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Proxy    AppAccess          /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197                Open connection             0              Backend web socket connection Opened for session 'fe87b122-8979-45d4-9c37-3c39ce704045'. App id: 'c3ed4e49-dc98-4ff8-b140-f3d945236197'. UserAgent: 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36'           f1f1350f-0b00-4cf1-b30c-51ddbfecb6bb

 
Notice in this log the user gets a Ticket and Session in the first open to kick off the Session ID. You can then see that web socket connection is closed to the application for that session and then reopened right after it.
 
Note: The Syncing of attributes in the First Open that gets the ticket, it only does that the start of the session and will not be triggered until a new session is established.

C:\ProgramData\Qlik\Sense\Log\Proxy\Audit\QLIKSERVER1_AuditActivity_Proxy.txt
 
First Open (No Session established until now):
 
1              11.11.0.0              20170321T215731.469+0100       QlikServer1         201ee217-3713-44cb-9277-d374799a84fb                Command=Get ticket;Result=0;ResultText=Success          0              0              0              INTERNAL            sa_proxy                0              Not available      Proxy    Not available      /hub/stream/e4f1e040-75cf-4db0-afbd-baaf90cab8f8    Get ticket:ConsumeIncomingTicket  0              User claimed ticket: 'ewXLiJDk6xM1Q0TH'. Session will be etablished                201ee217-3713-44cb-9277-d374799a84fb
2              11.11.0.0              20170321T215731.512+0100       QlikServer1         7042d186-3f1d-4759-9d87-663b73522766                Command=Start session;Result=0;ResultText=Success    fe87b122-8979-45d4-9c37-3c39ce704045              0                0              DOMAIN              qvservice             0              DOMAIN\qvservice         Proxy    Not available                /qps/sessionstart/qvservice        Start session      0              Start session for user: 'DOMAIN\qvservice'                7042d186-3f1d-4759-9d87-663b73522766
3              11.11.0.0              20170321T215731.892+0100       QlikServer1         2e9f0d03-aabe-403a-b282-ec01a47283a0                Command=Add session;Result=0;ResultText=Success      fe87b122-8979-45d4-9c37-3c39ce704045                c8d0eb48-fe7a-47da-bbca-0eab11340b92             0              DOMAIN              qvservice             0              Not available                Proxy    Not available      /hub/stream/e4f1e040-75cf-4db0-afbd-baaf90cab8f8    Add session:NotifyOfPostSession       0              Syncing user attributes for user 'DOMAIN\qvservice'        2e9f0d03-aabe-403a-b282-ec01a47283a0
4              11.11.0.0              20170321T215736.774+0100       QlikServer1         4f3ec3ce-604b-4fad-930c-6c5d3c417112                Command=Get session;Result=200;ResultText=Success  fe87b122-8979-45d4-9c37-3c39ce704045                bcce5b5b-a2e5-455c-9a36-f3fe076b03e3              0              DOMAIN              qvservice             0              Not available                Proxy    AppAccess          /qps/user?targeturi=http:%2f%2fqlikserver1.domain.local%2fhub%2f     Get session:HandleRequest 200         Handle connection request         4f3ec3ce-604b-4fad-930c-6c5d3c417112
5              11.11.0.0              20170321T215743.567+0100       QlikServer1         1fcb5c5c-15f5-40a6-bd54-0819643cd197                Command=Open connection;Result=0;ResultText=Success           fe87b122-8979-45d4-9c37-3c39ce704045                0e6278ad-ffff-4d6c-9d66-af84a1596d78                 0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Proxy    AppAccess          /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197                Open connection             0              Backend web socket connection Opened for session 'fe87b122-8979-45d4-9c37-3c39ce704045'. App id: 'c3ed4e49-dc98-4ff8-b140-f3d945236197'. UserAgent: 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36'           1fcb5c5c-15f5-40a6-bd54-0819643cd197

First Open (Closed tab)
 
6              11.11.0.0              20170321T220016.242+0100       QlikServer1         12a1b6ff-d000-4f56-a58c-8ca1bd36a567                Command=Close connection;Result=0;ResultText=Success            fe87b122-8979-45d4-9c37-3c39ce704045                0e6278ad-ffff-4d6c-9d66-af84a1596d78                 0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Proxy    AppAccess          /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197                Close connection              0              Backend web socket connection Closed for session 'fe87b122-8979-45d4-9c37-3c39ce704045'. App id: 'c3ed4e49-dc98-4ff8-b140-f3d945236197. UserAgent: 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36'           12a1b6ff-d000-4f56-a58c-8ca1bd36a567
 
Second Open:
 
7              11.11.0.0              20170321T220052.937+0100       QlikServer1         f1f1350f-0b00-4cf1-b30c-51ddbfecb6bb                Command=Open connection;Result=0;ResultText=Success           fe87b122-8979-45d4-9c37-3c39ce704045                a057e326-6123-406a-8ee2-e82a46efe367             0              DOMAIN              qvservice             c3ed4e49-dc98-4ff8-b140-f3d945236197         Not available      Proxy    AppAccess          /app/c3ed4e49-dc98-4ff8-b140-f3d945236197?reloaduri=http%3a%2f%2fqlikserver1.domain.local%2fsense%2fapp%2fc3ed4e49-dc98-4ff8-b140-f3d945236197                Open connection             0              Backend web socket connection Opened for session 'fe87b122-8979-45d4-9c37-3c39ce704045'. App id: 'c3ed4e49-dc98-4ff8-b140-f3d945236197'. UserAgent: 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36'           f1f1350f-0b00-4cf1-b30c-51ddbfecb6bb
 
Notice in this log the user gets a Ticket and Session in the first open to kick off the Session ID. You can then see that web socket connection is closed to the application for that session and then reopened right after it.
 
Note: The Syncing of attributes in the First Open that gets the ticket, it only does that the start of the session and will not be triggered until a new session is established.

C:\ProgramData\Qlik\Sense\Log\Proxy\Trace\QLIKSERVER1_Audit_Proxy.txt
 
First Open (loaded into memory):
  
1              20170321T215731.134+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.Authentication.AuthenticationHandler 14           384a5be2-8c1f-4569-8b17-a6fa747b8f2f          DOMAIN\qvservice         Session 'a0ee67d2-581b-47db-9514-443ac4a008b1' is invalid (possibly timed out or logged out)            0              45b4435a-3e05-47c4-b78b-0e5311154a91                                                             ::ffff:172.16.16.100                                          {}             1650cb4421d90c3f0e3af23e1f5e2c8176219ad8
2              20170321T215731.188+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.RedirectionHandler       14           17bed8a0-b6ec-4316-9dfd-ff062b4b1c79     DOMAIN\qvservice         Authentication required, redirecting client@http://[::ffff:172.16.16.100]:62230/  to http://qlikserver1.domain.local:4248/windows_authentication/?targetId=6b07f3fb-5d9e-462f-b424-bb389054e645            0              45b4435a-3e05-47c4-b78b-0e5311154a91                                                             ::ffff:172.16.16.100                                          {}                8da259cac80248a0b1258dffa22a0bc5585c668b
3              20170321T215731.444+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.Authentication.TicketValidator 14           ab854bb8-5c99-4a1c-8b76-00a443e94684    DOMAIN\qvservice         Issued ticket 'ewXLiJDk6xM1Q0TH' for user, valid for 1 minute(s)               0                                DOMAIN              qvservice             ewXLiJDk6xM1Q0TH                                                                       7f97ce8a8282eb9ed7aa0b61722b2504241e0e09
4              20170321T215731.470+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.Authentication.AuthenticationHandler 14           f27f9ebc-4ad4-4d5a-968d-13e910e1efab        DOMAIN\qvservice         User claimed ticket: 'ewXLiJDk6xM1Q0TH'            0              583a2b2e-5aeb-4292-9d02-d1c4e5a1cd0b DOMAIN              qvservice             ewXLiJDk6xM1Q0TH       ::ffff:172.16.16.100                                          {}             e025a74e13bb4c759fe5ad99787ad5589381b7bf
5              20170321T215731.891+0100       INFO      QlikServer1                Audit.Proxy.Proxy.DefaultModules.Session.SessionClientHandler               8              8dfacde2-3963-432b-af75-22d5122b5fea    DOMAIN\qvservice         Syncing user attributes for user DOMAIN\qvservice was successful                fe87b122-8979-45d4-9c37-3c39ce704045              583a2b2e-5aeb-4292-9d02-d1c4e5a1cd0b            DOMAIN                qvservice             ewXLiJDk6xM1Q0TH       ::ffff:172.16.16.100                                          {}                df162a32bfed4ae4c37531b6f1ad4e7cb18b708e
6              20170321T215732.018+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.Authentication.AuthenticationHandler 14           711c200a-60e9-457a-be6c-89f1ce11bf82          DOMAIN\qvservice         User 'qvservice' used 'ticket' authentication, got session: 'fe87b122-8979-45d4-9c37-3c39ce704045'                  fe87b122-8979-45d4-9c37-3c39ce704045              583a2b2e-5aeb-4292-9d02-d1c4e5a1cd0b   DOMAIN              qvservice             ewXLiJDk6xM1Q0TH       ::ffff:172.16.16.100                                          {}                7fa218f968005afa6c0e635058e1e6c290e90d76
7              20170321T215735.128+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.LoadBalancingHandlerDependencies     8              11c49eb7-4ce8-45be-98d1-76a10f34562c          DOMAIN\qvservice         Retrieved 1 engine(s) from repository, result code Ok, app: __hub                fe87b122-8979-45d4-9c37-3c39ce704045              355bcda7-26f1-4a41-94d5-c5c88499abb8              DOMAIN                qvservice                             ::ffff:172.16.16.100                          qlikserver1.domain.local:4242    {}                7b0262f7f34c583b38c13639692a495540079d74
8              20170321T215735.144+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.LoadBalancingHandlerDependencies     8              29022811-cbe3-4f9d-ba19-b3bb50f37e0e        DOMAIN\qvservice         Cached 1 prioritised Engine(s), app: __hub           fe87b122-8979-45d4-9c37-3c39ce704045          355bcda7-26f1-4a41-94d5-c5c88499abb8              DOMAIN              qvservice                             ::ffff:172.16.16.100                          qlikserver1.domain.local:4242    {}                5ff601a6ada967d7d6c9990a1bddbe25e7bbc1cf
9              20170321T215735.186+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.LoadBalancingHandlerDependencies     24           dbf6cd5b-735e-4112-94c3-4db366bbe4b2       DOMAIN\qvservice         New target uri chosen: https://qlikserver1.domain.local:4900/ , app: __hub   fe87b122-8979-45d4-9c37-3c39ce704045              355bcda7-26f1-4a41-94d5-c5c88499abb8              DOMAIN                qvservice                             ::ffff:172.16.16.100                          qlikserver1.domain.local:4900    {}                ba0e44b68b214c47fea575e93244c3c5f159c281
10           20170321T215743.535+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.LoadBalancingHandlerDependencies     8              7bcf1a03-6cfe-45ea-a06b-d1a780528be0        DOMAIN\qvservice         Retrieved 1 engine(s) from repository, result code Ok, app: c3ed4e49-dc98-4ff8-b140-f3d945236197    fe87b122-8979-45d4-9c37-3c39ce704045              79705676-f6f7-4396-8771-9f9f2a57f711      DOMAIN              qvservice                             ::ffff:172.16.16.100          c3ed4e49-dc98-4ff8-b140-f3d945236197                    {}             fe793ff3d692d1992e38f7be35c3a15d93ada65d
11           20170321T215743.535+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.LoadBalancingHandlerDependencies     8              425b5b86-579e-410f-8721-a816841bc16a         DOMAIN\qvservice         Cached 1 prioritised Engine(s), app: c3ed4e49-dc98-4ff8-b140-f3d945236197    fe87b122-8979-45d4-9c37-3c39ce704045              79705676-f6f7-4396-8771-9f9f2a57f711                DOMAIN              qvservice                             ::ffff:172.16.16.100          c3ed4e49-dc98-4ff8-b140-f3d945236197                                {}             ab51d2ad92cef8fff57fb15b1d5b115eeabedecb
12           20170321T215743.563+0100       INFO      QlikServer1                Audit.Proxy.Proxy.SessionEstablishment.LoadBalancingHandlerDependencies     24           4c8e93c3-b3c9-475b-aa03-b8290f196014         DOMAIN\qvservice         New target uri chosen: wss://qlikserver1.domain.local:4747/, app: c3ed4e49-dc98-4ff8-b140-f3d945236197               fe87b122-8979-45d4-9c37-3c39ce704045              79705676-f6f7-4396-8771-9f9f2a57f711           DOMAIN              qvservice                             ::ffff:172.16.16.100          c3ed4e49-dc98-4ff8-b140-f3d945236197    qlikserver1.domain.local:4747    {}             f27c34ac0b7976a062ef3ea21d129acf451b0e65

This log only tracks the initial Session from the first Open, since the session is already established for the User. Further opening of the same app will not trigger a new entry for this Session/App ID
  
Final Note: There were no tests and review of entries for any new user sessions, different App IDs or for when the session times out or is forcible closed (closing the browser).  

What is legacy mode?
Legacy mode in Qlik Sense allows users who have access to the data load editor to write load statements which reference file paths rather than through LIB statements.

Simple example:
Standard Mode:
LOAD * 
FROM [lib://data/data.csv]
(txt, codepage is 28591, embedded labels, delimiter is ',', msq);

Legacy Mode:
LOAD * 
FROM C:\data\data.csv
(txt, codepage is 28591, embedded labels, delimiter is ',', msq);

What are the security considerations when using legacy mode?

Out of the box, for a user to do development in Qlik Sense, they need some combination of two types of access:

1. An ability to create a data connection
2. An ability to read (or see) a data connection

This security model is the intermediary between the user inside of Qlik Sense and the data sources.

When using legacy mode, any user who has access to the Data Load Editor can now access the file system of the local Qlik Sense server as well as any network file shares that the Qlik Sense service account independent of the security rules configured on the Qlik Sense deployment. In this example, the user has access to AttachedFiles, which all users would out of the box, as well as a Salesforce data connection, yet they are still able to load from the data.csv:

This means that the traditional mechanism for ensuring governance and security over data access inside of the Data Load Editor will no longer apply and the user(s) will be accessing the files as the Qlik Sense Service account

What are the benefits of using Legacy Mode?

This is difficult to answer in an exhaustive manner, but generally the benefits are narrowly scoped to deployments where app development, self-service capabilities are disabled or where this level of access is restricted to a vetted set of administrators. Some benefits include:

• The ability to use relative paths in load scripts (e.g. LOAD * FROM ..\..\Customer1\sales.csv). Often used in conjunction with include scripts which allow easy deployment to multiple customers or tenants.
• The ability to use the EXECUTE function (in conjunction with an additional Settings.ini change) to directly call external processes during script execution
• The ability to re-use load statements from QlikView documents in Qlik Sense
• And others

Is legacy mode recommended by Qlik?
For most deployments, no, legacy mode is not recommended. It can be useful in some deployment scenarios where the security concerns are mitigated.

How do I switch to Legacy mode / disable standard mode?
Disabling standard mode - Enabling Legacy Mode - Qlik Sense on Windows

Qlik Sense Legacy mode

Qlik Sense Legacy Mode - Qlik Design Blog

This is a recording of a Support Techspert Thursdays session.

This session addresses:
- What the App Analyzer can do
- How to set it up
- How to improve app performance
- Troubleshooting issues

Chapters:

00:00 – Intro

 01:26 - App Analyzer Overview

 02:39 - When the App Analyzer is Useful

 03:43 - SaaS Standard Tier Capabilities

 06:23 - How Qlik Sense Stores Data

 07:32 - App Analyzer Dashboard demo

 08:58 - Example App Optimization

 10:54 - Best Practice thresholds

 12:02 - Threshold Analysis Sheet Demo

 12:32 - App RAM to Quota Sheet Demo

13:19 - Example App

 13:47 - App Analysis Sheet Demo

14:39 - Rolling Analysis Sheet Demo

16:28 - Reload Time

17:06 - Setting it up

 18:11 - TIP: Relative Path

 18:47 - Creating a REST Connection

 20:34 - The right space to use

 21:16 - Troubleshooting: SET ErrorMode

 22:13 - TroubleShooting: API Key

 23:29 - App Analyzer on Qlik Community

 24:41 - Qlik Diagnostic Toolkit

 25:41 - Qlik Sense Admin Playbook

 26:13 - Q&A

Environment

• Qlik Sense Enterprise SaaS - Standard Tier

Related Content 

App Analyzer on Qlik Community

Qlik Dignostic Toolkit

Qlik Sense Admin Playbook

STT - Optimizing Qlik Sense SaaS Apps with App Analyzer

Q&A:

Q: I noticed sheets supposedly in my app according to the App MetaData Analyser that are not part of my app. Is the presented data reliable?

A: Neither the App Analyzer for Qlik Sense Enterprise SaaS or the App Metadata Analyzer for Qlik Sense Enterprise on Windows track sheets – they only gather data model and reload metadata. That said, there was a bug in the App Metadata Analyzer for Qlik Sense Enterprise on Windows that did associate some fields/tables to the wrong apps that has since been addressed. You can always grab the latest version of the App Metadata Analyzer for Windows here.

Q: Hi, super interesting stuff!  is the very same App Analyzer available to non-SaaS customers?

A: The application that the App Analyzer was modeled off of is the App Metadata Analyzer for Qlik Sense Enterprise on Windows that ships with the product. You can find the most recent version of that application here.

Q: The configuration of REST Connector is throwing error "cannot connect"...are there any setup needed on the tenant level?

A: Please refer to the installation guide for the App Analyzer and if you are still having issues, please post on the Qlik Community entry here.

Q: Can we setup Qlik Alerting to inform us as we get closer to threshholds?

A: Absolutely, yes. This is a great way to stay on top of monitoring your applications. In addition, you can also monitor one of the charts from the app in the Hub to have a quick look at where everything stands each time you login to the tenant.

Transcript

Currently, there is no available feature to delete (or update) existing tags in Qlik Sense SaaS.

Environment

Qlik Cloud 

Resolution

Qlik has previously received feedback on this feature. For up to date information and to express your interest in this feature, review https://community.qlik.com/t5/Suggest-an-Idea/Enable-Deletion-Update-of-Tags-in-Qlik-Sense-SaaS/idi-p/1831354 

When accessing the QlikSense Hub with an iOS device (iPad/iPhone) Apps are not loaded or cannot be opened. HTTPS access is used.

The user tries to open the Qlik Sense Hub on an iOS device (iOS 8 and above) using the address https://servername/hub

When attempting to open an App they are presented with an endless loading screen or "Connection to the Qlik Sense engine failed for unspecified reasons"
 

A review of the QlikSense Proxy logs (Folder Trace\ and  SERVER_Audit_Proxy) might show SslNoClientValidation WARN entries. 

Environment: 

Qlik Sense Mobile  on iOS

Cause:

Apple has removed the ability of users to ignore certificate warnings on devices iOS 8 and above. On laptops or desktops you would have the option to ignore the SSL warning, but this option is not possible with iOS devices.

Resolution:

1) Since the "Connection Lost" message or endless "bubble" loading screen are typically indicative of an allowed url/host problem, be sure that the Domain that the user is accessing the Hub has been allowed through firewalls and proxies. See article Error Message "Connection lost" When Connecting To Qlik Sense Hub for more clarity on this. If users on laptops / desktops do not receive this message then proceed to step 2.

2) Access https://sense-demo.qlik.com/hub using the iOS device. If this works then proceed to step 3.

• If the demo link does not work, you have a possible browser, network, or internet connectivity issue at the device level.

3) Apple requires an SSL cert from a trusted CA when accessing websites via HTTPS (check their knowledge base for a list of providers). You can either acquire a certificate from one of the vetted list of providers or the user(s) can access the Hub using HTTP. For guidance on applying a third party certificate, see article How to change certificate for the Proxy.  

4) If no certificate from a trusted CA can be acquired, it will be necessary to install the current one.  See Apple and it's Apple Configurator for details. 

The Qlik Sense Mobile app allows you to securely connect to your Qlik Sense Enterprise deployment from your supported mobile device. This is the process of configuring Qlik Sense to function with the mobile app on iPad  / iPhone.

This article applies to the Qlik Sense Mobile app used with Qlik Sense Enterprise on Windows. For information regarding the Qlik Cloud Mobile app, see Setting up Qlik Sense Mobile SaaS. 

Content:

• Pre-requirements (Client-side)
• Configuration (Server-side)
• Update the Host White List in the proxy
• Configuration (Client side)

Pre-requirements (Client-side)

See the requirements for your mobile app version on the official Qlik Online Help > Planning your Qlik Sense Enterprise deployment > System requirements for Qlik Sense Enterprise > Qlik Sense Mobile app

Configuration (Server-side)

Acquire a signed and trusted Certificate.

Out of the box, Qlik Sense is installed with HTTPS enabled on the hub and HTTP disabled. Due to iOS specific certificate requirements, a signed and trusted certificate is required when connecting from an iOS device. If using HTTPS, make sure to use a certificate issued by an Apple-approved Certification Authority.
Also check Qlik Sense Mobile on iOS: cannot open apps on the HUB  for issues related to Qlik Sense Mobile on iOS and certificates.

For testing purposes, it is possible to enable port 80.

(Optional) Enable HTTP (port 80).

1. Open the Qlik Sense Management Console and navigate to Proxies.
2. Select the Proxy you wish to use and click Edit Proxy.  
3. Check Allow HTTP 

Update the Host White List in the proxy 

If not already done, add an address to the White List:

1. In Qlik Management Console, go to CONFIGURE SYSTEM -> Virtual Proxies
2. Select the proxy and click Edit
3. Select Advanced in Properties list on the right pane
   
   

    

4. Scroll to Advanced section in the middle pane
5. Locate "Allow list"
   
   

    

6. Click "Add new value" and add the addresses being used when connecting to the Qlik Sense Hub from a client. See How to configure the WebSocket origin allow list and best practices for details. 
   
   

Generate the authentication link:

An authentication link is required for the Qlik Sense Mobile App.

1. Navigate to Virtual Proxies in the Qlik Sense Management Console and edit the proxy used for mobile App access
2. Enable the Client authentication link menu in the far right menu.
3. Generate the link.

NOTE: In the client authentication link host URI, you may need to remove the "/" from the end of the URL, such as http://10.76.193.52/ would be http://10.76.193.52 

Associate User access pass

Users connecting to Qlik Sense Enterprise need a valid license available. See the Qlik Sense Online Help for more information on how to assign available access types.
Qlik Sense Enterprise on Windows > Administer Qlik Sense Enterprise on Windows > Managing a Qlik Sense Enterprise on Windows site > Managing QMC resource > Managing licenses

• Managing professional access
• Managing analyzer access
• Managing user access
• Creating login access rules

Configuration (Client side)

1. Install Qlik Sense mobile app from AppStore.
2. Provide authentication link generated in QMC
   • Open the link from your device (this can be also done by going to the Hub, clicking on the menu icon at the top right and selecting "Client Authentication"), the installed application will be triggered automatically, and the configuration parameters will be applied.
   •  Enter user credentials for QS server