Monitoring, Diagnostics, and KQL Queries¶

Use this page to validate observability coverage across AVD control-plane resources and Azure Local session-host workloads.

1) Diagnostic categories by resource¶

Resource	Recommended categories	Destination
Host Pool	`Management`, `Error`, `Checkpoint`	Log Analytics
Application Group	`Management`, `Error`	Log Analytics
Workspace	`Management`, `Error`	Log Analytics
Key Vault	`AuditEvent`	Log Analytics
Azure Activity	Subscription activity logs	Log Analytics

2) Common Log Analytics tables¶

Table	Purpose
`WVDConnections`	Session connection and reconnection events
`WVDErrors`	Service and agent-side AVD errors
`WVDAgentHealthStatus`	Session host agent state and freshness
`WVDCheckpoints`	Broker/session workflow checkpoints
`Heartbeat`	VM liveness and MMA/AMA heartbeat
`AzureDiagnostics`	Unified diagnostics for configured Azure resources
`SecurityEvent`	Security events from Windows session hosts

3) Health and availability queries¶

Agent health by host pool¶

WVDAgentHealthStatus
| where TimeGenerated > ago(1h)
| summarize LastSeen=max(TimeGenerated), Hosts=dcount(SessionHostName) by HostPoolName
| order by LastSeen asc

Session host heartbeat freshness¶

Heartbeat
| where TimeGenerated > ago(15m)
| summarize LastHeartbeat=max(TimeGenerated) by Computer
| extend MinutesSinceHeartbeat = datetime_diff('minute', now(), LastHeartbeat)
| order by MinutesSinceHeartbeat desc

Error summary by symbol¶

WVDErrors
| where TimeGenerated > ago(24h)
| summarize Errors=count() by CodeSymbolic, ServiceError
| order by Errors desc

4) User experience queries¶

Connection trends (hourly)¶

WVDConnections
| where TimeGenerated > ago(7d)
| summarize Connections=count(), Users=dcount(UserName) by HostPoolName, bin(TimeGenerated, 1h)
| order by TimeGenerated asc

Top reconnect users¶

WVDConnections
| where TimeGenerated > ago(24h)
| summarize Connections=count() by UserName, HostPoolName
| order by Connections desc
| take 25

5) FSLogix and profile reliability queries¶

FSLogix warnings/errors from Windows events¶

Event
| where TimeGenerated > ago(24h)
| where Source == 'frxsvc'
| summarize Events=count() by EventLevelName, Computer
| order by Events desc

Profile attach error trend¶

Event
| where TimeGenerated > ago(7d)
| where Source == 'frxsvc' and EventLevelName in ('Error','Warning')
| summarize Count=count() by bin(TimeGenerated, 1h), Computer
| order by TimeGenerated asc

6) Cost sampling queries¶

Ingestion estimate by table (last 24h)¶

Usage
| where TimeGenerated > ago(24h)
| summarize GB=sum(Quantity) / 1000 by DataType
| order by GB desc

Daily ingestion trend¶

Usage
| where TimeGenerated > ago(30d)
| summarize GB=sum(Quantity) / 1000 by bin(TimeGenerated, 1d)
| order by TimeGenerated asc

7) Alerting recommendations¶

Agent health staleness over 10 minutes.
Error rate spike over rolling baseline.
Heartbeat missing for critical session-host groups.
Log Analytics ingestion anomaly (sharp day-over-day increase).

8) Operational run frequency¶

Hourly: host heartbeat and active error checks.
Daily: connection trend and ingestion checks.
Weekly: host-pool balancing and user-density review.

References¶

Azure Monitor: https://learn.microsoft.com/azure/azure-monitor/
Azure Monitor diagnostic settings: https://learn.microsoft.com/azure/azure-monitor/essentials/diagnostic-settings
AVD diagnostic categories: https://learn.microsoft.com/azure/virtual-desktop/diagnostics-log-analytics
Log Analytics query language (KQL): https://learn.microsoft.com/azure/azure-monitor/logs/log-analytics-overview