Call us:+1 (407) 567-0096
Open a ticket
Chat with us
En De Es


This website uses cookies

This website uses cookies to improve user experience. By using our website you consent to all cookies in accordance with our Cookie Policy.
Read more

Monitoring Windows Virtual Desktop using Azure Log Analytics and Azure Monitor

Windows Virtual desktop is a rapidly improving DAAS solution. While facing the pandemic situation, Windows virtual desktop solution helps to make Work from Home a reality. From this post, let's discuss how we can monitor Windows Virtual Desktop activities. Please refer to the links of my previous posts of WVD at the end of this article.

Some basic information in WVD can be monitored through Azure portal WVD blade and using PowerShell command lets. However, integrating with Azure log analytics and Azure monitor allow you to access deep-dive analytical data from log analytics queries or Azure monitor dashboards. Following are some examples of monitoring information.

  • Session details such as connected users, duration, and their state
  • Number of hosts, active users for each host
  • Management and admin activities
  • Hosts performance, CPU Memory, and Disk usage
  • Errors on session connectivity, host issues
  • User analytics such as the number of users connected the last 24 hours, last 7 days, their duration, peak time, etc.

Before monitoring, it is obvious you should have an up and running WVD environment, and you should have at least Monitoring Contributor, Log Analytics Contributor, and Security Administrator permissions access to all WVD components. I’m using Subscription owner to make things simpler. Let’s discuss everything related to WVD monitoring in the following manner.

  1. Create Azure Log Analytics workspace
  2. Integrate with WVD Components
  3. Deploy Log analytics agent from Azure monitor
  4. Configuring performance counters
  5. Deploy Azure WVD workbook
  6. Running custom queries from Azure monitor.
  7. Creating your own dashboard


Create Azure Log Analytics Workspace

  1. Login to and type Log analytics in the search area

  2. Select Create Log analytics workspace and provide Resource group, Region, and Name for the workspace

  3. Select the pricing tier. Here I am using the Pay as you go model.


Integrate with WVD environment

In each WVD workspace, Host pool, and Application groups, you need to enable log collection and add the log analytics workspace in diagnostic settings.

In Host pools

Click on the host pool to open its configurations.

Click Diagnostic settings, and click +Add diagnostic setting.

Select all the logs, tick Send to Log Analytics and select your log analytics workspace from the drop-down list.

Application Groups

Redo the above steps on all the application groups

Select the Application group – diagnostic settings – Add Diagnostic settings, select all the logs and log analytics workspace


Redo the above steps on all the application groups

Select the Workspace – diagnostic settings – Add Diagnostic settings, select all the logs and log analytics workspace


Configuring Azure Monitor

You need to enable each WVD VM host in Azure monitor to get advanced monitoring data. This will install log analytics agents on each WVD host. You can collect performance, events, and other relevant data into the Azure log analytics workspace.

Log in to the Azure portal and search for Monitor to access Azure monitoring. In the Virtual machines, tab open Not monitored blade.

Click Enable on WVD VM’s

After agent installation, you can see these VM’s in the Monitoring blade.


Configuring performance counters

Next, you need to configure an advanced performance counter to monitor the VM’s, which are monitored through Log analytics.

  1. Select the Log analytics workspace and click Advanced settings

  2. Click Data – Windows Performance counters and add the following performance counters.

    Add batch by batch to avoid maximum event exceeds the message.

    Batch Collection 1

    Terminal Services Session(*)\% Processor Time

    Terminal Services(*)\Active Sessions

    Terminal Services(*)\Inactive Sessions

    Terminal Services(*)\Total Sessions

    LogicalDisk(*)\% Free Space

    LogicalDisk(*)\Avg. Disk sec/Read

    LogicalDisk(*)\Avg. Disk sec/Write

    LogicalDisk(*)\Current Disk Queue Length

    LogicalDisk(*)\Disk Reads/sec

    LogicalDisk(*)\Disk Transfers/sec

    LogicalDisk(*)\Disk Writes/sec

    LogicalDisk(*)\Free Megabytes

    Processor(_Total)\% Processor Time

    Memory(*)\% Committed Bytes In Use

    Network Adapter(*)\Bytes Received/sec

    Network Adapter(*)\Bytes Sent/sec

    Process(*)\% Processor Time

    Process(*)\% User Time

    Process(*)\IO Read Operations/sec

    Batch Collection 2

    Process(*)\IO Write Operations/sec

    Process(*)\Thread Count

    Process(*)\Working Set

    RemoteFX Graphics(*)\Average Encoding Time

    RemoteFX Graphics(*)\Frames Skipped/Second - Insufficient Client Resources

    RemoteFX Graphics(*)\Frames Skipped/Second - Insufficient Network Resources

    RemoteFX Graphics(*)\Frames Skipped/Second - Insufficient Server Resources

    RemoteFX Network(*)\Current TCP Bandwidth

    RemoteFX Network(*)\Current TCP RTT

    RemoteFX Network(*)\Current UDP Bandwidth

    RemoteFX Network(*)\Current UDP RTT

    PhysicalDisk(*)\Avg. Disk Bytes/Read

    PhysicalDisk(*)\Avg. Disk Bytes/Write

    PhysicalDisk(*)\Avg. Disk sec/Write

    PhysicalDisk(*)\Avg. Disk sec/Read

    PhysicalDisk(*)\Avg. Disk Bytes/Transfer

    PhysicalDisk(*)\Avg. Disk sec/Transfer


  3. Set sample interval to 60 seconds to avoid unnecessary data gathering