Monitoring Migration: Citrix Director to AVD Insights¶

// Current active sessions
WVDConnections
| where TimeGenerated > ago(1h)
| where State == "Connected"
| summarize ActiveSessions = dcount(CorrelationId) by SessionHostName
| order by ActiveSessions desc

// Logon duration breakdown
WVDCheckpoints
| where TimeGenerated > ago(24h)
| where Name in ("LoadProfile", "ShellReady", "GroupPolicyProcessing", "OnConnectionComplete")
| extend Duration = todouble(Parameters.DurationMs)
| summarize AvgDuration = avg(Duration) by Name
| order by AvgDuration desc

// Detailed per-user logon times
WVDConnections
| where TimeGenerated > ago(24h)
| where State == "Connected"
| project UserName, SessionHostName, TimeGenerated,
    ProfileLoadTime = todouble(custom_dimensions.ProfileLoadTimeMs),
    GPOTime = todouble(custom_dimensions.GPOProcessingTimeMs),
    TotalLogonTime = todouble(custom_dimensions.TotalLogonTimeMs)
| order by TotalLogonTime desc

// Connection failures in the last 24 hours
WVDErrors
| where TimeGenerated > ago(24h)
| where ServiceError == true
| summarize ErrorCount = count() by CodeSymbolic, Message
| order by ErrorCount desc

// User-specific connection issues
WVDConnections
| where TimeGenerated > ago(24h)
| where State == "Failed"
| project TimeGenerated, UserName, SessionHostName,
    ErrorCode = custom_dimensions.ErrorCode,
    ErrorMessage = custom_dimensions.ErrorMessage
| order by TimeGenerated desc

// Session host availability
WVDAgentHealthStatus
| where TimeGenerated > ago(1h)
| summarize arg_max(TimeGenerated, *) by SessionHostName
| project SessionHostName, LastHeartBeat = TimeGenerated,
    HealthStatus = iff(TimeGenerated > ago(5m), "Healthy", "Unhealthy"),
    ActiveSessions, AllowNewSessions
| order by HealthStatus asc

// CPU and memory utilization per host
Perf
| where TimeGenerated > ago(1h)
| where ObjectName == "Processor Information" and CounterName == "% Processor Time" and InstanceName == "_Total"
| summarize AvgCPU = avg(CounterValue) by Computer
| join kind=inner (
    Perf
    | where TimeGenerated > ago(1h)
    | where ObjectName == "Memory" and CounterName == "Available Mbytes"
    | summarize AvgMemAvail = avg(CounterValue) by Computer
) on Computer
| project Computer, AvgCPU, AvgMemAvailMB = AvgMemAvail
| order by AvgCPU desc

// RDP connection quality metrics
WVDConnectionNetworkData
| where TimeGenerated > ago(1h)
| summarize
    AvgRTT = avg(EstRoundTripTimeInMs),
    MaxRTT = max(EstRoundTripTimeInMs),
    AvgBandwidth = avg(EstAvailableBandwidthKBps)
  by SessionHostName, UserName
| order by AvgRTT desc

// Identify users with poor connection quality
WVDConnectionNetworkData
| where TimeGenerated > ago(24h)
| where EstRoundTripTimeInMs > 150  // >150ms indicates poor experience
| summarize PoorQualitySamples = count(), AvgRTT = avg(EstRoundTripTimeInMs)
  by UserName
| order by PoorQualitySamples desc

// FSLogix profile load events
Event
| where TimeGenerated > ago(24h)
| where Source == "FSLogix-Apps/Operational"
| where EventID == 25  // Profile loaded
| extend ProfileLoadTime = extract("Profile loaded in (\\d+) ms", 1, RenderedDescription)
| project TimeGenerated, Computer, UserName = extract("User: (.+?)\\s", 1, RenderedDescription),
    ProfileLoadTimeMs = toint(ProfileLoadTime)
| order by ProfileLoadTimeMs desc

// FSLogix errors
Event
| where TimeGenerated > ago(24h)
| where Source == "FSLogix-Apps/Operational"
| where EventLevelName == "Error"
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc

// User input delay (responsiveness metric)
Perf
| where TimeGenerated > ago(1h)
| where ObjectName == "User Input Delay per Session"
    and CounterName == "Max Input Delay"
| summarize AvgInputDelay = avg(CounterValue), MaxInputDelay = max(CounterValue) by Computer
| where MaxInputDelay > 100  // >100ms is noticeable
| order by MaxInputDelay desc