Send diagnostic data to Log Analytics for Azure Virtual Desktop

Azure Virtual Desktop uses Azure Monitor for monitoring and alerts like many other Azure services. This lets admins identify issues through a single interface. The service creates activity logs for both user and administrative actions. Each activity log falls under the following categories:

Connections that don't reach Azure Virtual Desktop won't show up in diagnostics results because the diagnostics role service itself is part of Azure Virtual Desktop. Azure Virtual Desktop connection issues can happen when the user is experiencing network connectivity issues.

Azure Monitor lets you analyze Azure Virtual Desktop data and review virtual machine (VM) performance counters, all within the same tool. This article will tell you more about how to enable diagnostics for your Azure Virtual Desktop environment.

Prerequisites

Before you can use Azure Virtual Desktop with Log Analytics, you need:

• A Log Analytics workspace. For more information, see Create a Log Analytics workspace in Azure portal or Create a Log Analytics workspace with PowerShell. After you've created your workspace, follow the instructions in Connect Windows computers to Azure Monitor to get the following information:

  • The workspace ID
  • The primary key of your workspace

  You'll need this information later in the setup process.

• Access to specific URLs from your session hosts for diagnostics to work. For more information, see Required URLs for Azure Virtual Desktop where you'll see entries for Diagnostic output.

• Make sure to review permission management for Azure Monitor to enable data access for those who monitor and maintain your Azure Virtual Desktop environment. For more information, see Get started with roles, permissions, and security with Azure Monitor.

Push diagnostics data to your workspace

You can push diagnostics data from your Azure Virtual Desktop objects into the Log Analytics for your workspace. You can set up this feature right away when you first create your objects.

To set up Log Analytics for a new object:

1. Sign in to the Azure portal and go to Azure Virtual Desktop.

2. Navigate to the object (such as a host pool, application group, or workspace) that you want to capture logs and events for.

3. Select Diagnostic settings in the menu on the left side of the screen.

4. Select Add diagnostic setting in the menu that appears on the right side of the screen.

   The options shown in the Diagnostic Settings page will vary depending on what kind of object you're editing.

   For example, when you're enabling diagnostics for an application group, you'll see options to configure checkpoints, errors, and management. For workspaces, these categories configure a feed to track when users subscribe to the list of apps. To learn more about diagnostic settings see Create diagnostic setting to collect resource logs and metrics in Azure.

   Important

   Remember to enable diagnostics for each Azure Resource Manager object that you want to monitor. Data will be available for activities after diagnostics has been enabled. It might take a few hours after first set-up.

5. Enter a name for your settings configuration, then select Send to Log Analytics. The name you use shouldn't have spaces and should conform to Azure naming conventions. As part of the logs, you can select all the options that you want added to your Log Analytics, such as Checkpoint, Error, Management, and so on.

6. Select Save.

How to access Log Analytics

You can access Log Analytics workspaces on the Azure portal or Azure Monitor.

Access Log Analytics on a Log Analytics workspace

1. Sign in to the Azure portal.

2. Search for Log Analytics workspace.

3. Under Services, select Log Analytics workspaces.

4. From the list, select the workspace you configured for your Azure Virtual Desktop object.

5. Once in your workspace, select Logs. You can filter out your menu list with the Search function.

Access Log Analytics on Azure Monitor

1. Sign in to the Azure portal.

2. Search for and select Monitor.

3. Select Logs.

4. Follow the instructions in the logging page to set the scope of your query.

5. You are ready to query diagnostics. All diagnostics tables have a "WVD" prefix.

Cadence for sending diagnostic events

Diagnostic events are sent to Log Analytics when completed.

Log Analytics only reports in these intermediate states for connection activities:

• Started: when a user selects and connects to an app or desktop in the Remote Desktop client.
• Connected: when the user successfully connects to the VM where the app or desktop is hosted.
• Completed: when the user or server disconnects the session the activity took place in.

Example queries

Access example queries through the Azure Monitor Log Analytics UI:

1. Go to your Log Analytics workspace, and then select Logs. The example query UI is shown automatically.
2. Change the filter to Category.
3. Select Azure Virtual Desktop to review available queries.
4. Select Run to run the selected query.

Learn more about the sample query interface in Saved queries in Azure Monitor Log Analytics.

The following query list lets you review connection information or issues for a single user. You can run these queries in the Log Analytics query editor. For each query, replace userupn with the UPN of the user you want to look up.

To find all connections for a single user:

WVDConnections
|where UserName == "userupn"
|take 100
|sort by TimeGenerated asc, CorrelationId

To find the number of times a user connected per day:

WVDConnections
|where UserName == "userupn"
|take 100
|sort by TimeGenerated asc, CorrelationId
|summarize dcount(CorrelationId) by bin(TimeGenerated, 1d)

To find session duration by user:

let Events = WVDConnections | where UserName == "userupn" ;
Events
| where State == "Connected"
| project CorrelationId , UserName, ResourceAlias , StartTime=TimeGenerated
| join (Events
| where State == "Completed"
| project EndTime=TimeGenerated, CorrelationId)
on CorrelationId
| project Duration = EndTime - StartTime, ResourceAlias
| sort by Duration asc

To find errors for a specific user:

WVDErrors
| where UserName == "userupn"
|take 100

To find out whether a specific error occurred for other users:

WVDErrors
| where CodeSymbolic =="ErrorSymbolicCode"
| summarize count(UserName) by CodeSymbolic

Next steps

• Enable Insights to monitor Azure Virtual Desktop.
• To review common error scenarios that the diagnostics feature can identify for you, see Identify and diagnose issues.