Collect and query Network Data for Azure Virtual Desktop connections

You can now collect network data for Azure Virtual Desktop connections using the NetworkData diagnostics table in Azure Log Analytics. The NetworkData table records round trip time and available bandwidth regularly throughout the connection (~ every 2 minutes). It has several benefits for Azure Virtual Desktop users over the RemoteFX network performance counters:

• Each record is connection-specific and includes the correlation ID of the Azure Virtual Desktop connection that can be tied back to the user
• The round trip time measured in this table is protocol-agnostic and will record the measured latency for TCP or UDP connections

Set up

The NetworkData table is only supported in commercial clouds. To start collecting network data, you’ll need to ensure your Azure Virtual Desktop host pools have diagnostics enabled and that the NetworkData table is selected. You can check and modify these settings in the Azure Portal:

1. Visit your Azure Virtual Desktop Host Pools in the Azure Portal.
2. Select the host pool where you’d like to set up network data, then select Diagnostic settings.
3. Select Edit setting, or +add diagnostic setting if you don’t have a diagnostic setting already.
4. Select allLogs* or the individual categories you would like to collect. Confirm NetworkData is selected.
5. Select a destination (Log Analytics workspace for Azure Virtual Desktop Insights users)
6. Save and repeat for other host pools.
7. You can verify data is flowing by returning to the host pool page, selecting Logs, and running one of the sample queries below. Users must be connecting to generate data, and the data may take up to 15 minutes to show up in the Azure Portal. 

Sample queries

You can run these sample Kusto queries in the Log Analytics query editor or find them using the QoE label. For each query, replace alias@domain with the alias of the user you want to look up.

Query average RTT and bandwidth:

// 90th, 50th, 10th Percentile for RTT in 10 min increments
WVDConnectionNetworkData
| summarize RTTP90=percentile(EstRoundTripTimeInMs,90),RTTP50=percentile(EstRoundTripTimeInMs,50),RTTP10=percentile(EstRoundTripTimeInMs,10) by bin(TimeGenerated,10m)
| render timechart
// 90th, 50th, 10th Percentile for BW in 10 min increments
WVDConnectionNetworkData
| summarize BWP90=percentile(EstAvailableBandwidthKBps,90),BWP50=percentile(EstAvailableBandwidthKBps,50),BWP10=percentile(EstAvailableBandwidthKBps,10) by bin(TimeGenerated,10m)
| render timechart

Query available bandwidth for a specific user:            

let user = "alias@domain";
WVDConnectionNetworkData
| join kind=leftouter (
    WVDConnections
    | distinct CorrelationId, UserName
) on CorrelationId
| where UserName == user
| project EstAvailableBandwidthKBps, TimeGenerated
| render columnchart 

Query available RTT for a specific user:

let user = "alias@domain";
WVDConnectionNetworkData
| join kind=leftouter (
    WVDConnections
    | extend Protocol = iff(UdpUse in ("0","<>"),"TCP","UDP")
    | distinct CorrelationId, UserName, Protocol
) on CorrelationId
| where UserName == user
| project EstRoundTripTimeInMs, TimeGenerated, Protocol
| render columnchart

Top 10 users with the highest RTT:

WVDConnectionNetworkData
| join kind=leftouter (
    WVDConnections
    | distinct CorrelationId, UserName
) on CorrelationId
| summarize AvgRTT=avg(EstRoundTripTimeInMs),RTT_P95=percentile(EstRoundTripTimeInMs,95) by UserName
| top 10 by AvgRTT desc

Top 10 users with the lowest available bandwidth:

WVDConnectionNetworkData
| join kind=leftouter (
    WVDConnections
    | distinct CorrelationId, UserName
) on CorrelationId
| summarize AvgBW=avg(EstAvailableBandwidthKBps),BW_P95=percentile(EstAvailableBandwidthKBps,95) by UserName
| top 10 by AvgBW asc

Glossary:

Estimated available bandwidth (kilobytes per second): The average estimated available network bandwidth over the last connection time interval.

Estimated round trip time (milliseconds): The average estimated time it takes for a network request to go from the end user device, over the network to the session host, and back to the end user device over the last connection time interval.

Correlation ID: The activity ID of the Azure Virtual Desktop connection that can be correlated with other diagnostics from that connection.

Thank you, and please feel free to submit feedback here or leave questions on this post!