Meaning of GatewayRegion_s field in in WVDActivityV1_CL table in log analytics

%3CLINGO-SUB%20id%3D%22lingo-sub-1677551%22%20slang%3D%22en-US%22%3EMeaning%20of%20GatewayRegion_s%20field%20in%20in%20WVDActivityV1_CL%20table%20in%20log%20analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1677551%22%20slang%3D%22en-US%22%3E%3CP%3EI%20am%20trying%20to%20troubleshoot%20some%20disconnect%20issues%20with%20a%20customer%20in%20the%20Western%20Europe%20region.%20I%20used%20the%20following%20query%20to%20list%20all%20the%20connections%20(it's%20not%20the%20ARM%20release%20of%20WVD)%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3EWVDActivityV1_CL%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20Type_s%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22Connection%22%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ejoin%3C%2FSPAN%3E%3CSPAN%3E%20kind%3Dleftouter%20(%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%E2%80%AF%E2%80%AF%E2%80%AF%20WVDErrorV1_CL%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%E2%80%AF%E2%80%AF%E2%80%AF%20%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Esummarize%3C%2FSPAN%3E%3CSPAN%3E%20Errors%20%3D%20makelist(pack(%3C%2FSPAN%3E%3CSPAN%3E'Time'%3C%2FSPAN%3E%3CSPAN%3E%2C%20Time_t%2C%20%3C%2FSPAN%3E%3CSPAN%3E'Code'%3C%2FSPAN%3E%3CSPAN%3E%2C%20ErrorCode_s%20%2C%20%3C%2FSPAN%3E%3CSPAN%3E'CodeSymbolic'%3C%2FSPAN%3E%3CSPAN%3E%2C%20ErrorCodeSymbolic_s%2C%20%3C%2FSPAN%3E%3CSPAN%3E'Message'%3C%2FSPAN%3E%3CSPAN%3E%2C%20ErrorMessage_s%2C%20%3C%2FSPAN%3E%3CSPAN%3E'ReportedBy'%3C%2FSPAN%3E%3CSPAN%3E%2C%20ReportedBy_s%20%2C%20%3C%2FSPAN%3E%3CSPAN%3E'Internal'%3C%2FSPAN%3E%3CSPAN%3E%2C%20ErrorInternal_s%20))%20%3C%2FSPAN%3E%3CSPAN%3Eby%3C%2FSPAN%3E%3CSPAN%3E%20ActivityId_g%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%E2%80%AF%E2%80%AF%E2%80%AF%20%3CSPAN%3E)%20%3C%2FSPAN%3E%3CSPAN%3Eon%3C%2FSPAN%3E%20%3CSPAN%3E%24%3C%2FSPAN%3E%3CSPAN%3Eleft.Id_g%E2%80%AF%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%24%3C%2FSPAN%3E%3CSPAN%3Eright.ActivityId_g%3C%2FSPAN%3E%E2%80%AF%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ejoin%3C%2FSPAN%3E%3CSPAN%3E%E2%80%AF%20kind%3Dleftouter%20(%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AFWVDCheckpointV1_CL%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%E2%80%AF%E2%80%AF%E2%80%AF%20%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Esummarize%3C%2FSPAN%3E%3CSPAN%3E%20Checkpoints%20%3D%20makelist(pack(%3C%2FSPAN%3E%3CSPAN%3E'Time'%3C%2FSPAN%3E%3CSPAN%3E%2C%20Time_t%2C%20%3C%2FSPAN%3E%3CSPAN%3E'ReportedBy'%3C%2FSPAN%3E%3CSPAN%3E%2C%20ReportedBy_s%2C%20%3C%2FSPAN%3E%3CSPAN%3E'Name'%3C%2FSPAN%3E%3CSPAN%3E%2C%20Name_s%2C%20%3C%2FSPAN%3E%3CSPAN%3E'Parameters'%3C%2FSPAN%3E%3CSPAN%3E%2C%20Parameters_s)%20)%20%3C%2FSPAN%3E%3CSPAN%3Eby%3C%2FSPAN%3E%3CSPAN%3E%20ActivityId_g%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%E2%80%AF%E2%80%AF%E2%80%AF%20%3CSPAN%3E)%20%3C%2FSPAN%3E%3CSPAN%3Eon%3C%2FSPAN%3E%20%3CSPAN%3E%24%3C%2FSPAN%3E%3CSPAN%3Eleft.Id_g%E2%80%AF%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%24%3C%2FSPAN%3E%3CSPAN%3Eright.ActivityId_g%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%3C%2FSPAN%3E%3CSPAN%3Eproject-away%3C%2FSPAN%3E%3CSPAN%3E%20ActivityId_g%2C%20ActivityId_g1%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EWhat%20strikes%20me%20as%20odd%20is%20that%20the%20%3CSTRONG%3EGatewayRegion%3C%2FSTRONG%3E%20fields%20shows%20values%20from%20all%20over%20Europe%20and%20not%20just%20the%20WEU%20gateway%20that%20would%20be%20logically%20be%20the%20closest%20one%20(customer%20is%20in%20the%20Belgium%2FAntwerp%20region%20and%20WEU%20is%20The%20Netherlands%2FAmsterdam).%20A%20short%20query%20shows%20this%20spread%3A%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CTABLE%20width%3D%22269%22%3E%3CTBODY%3E%3CTR%3E%3CTD%20width%3D%2292%22%3EUKS%3C%2FTD%3E%3CTD%20width%3D%22177%22%3E23%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%3EGWC%3C%2FTD%3E%3CTD%3E21%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%3EFRC%3C%2FTD%3E%3CTD%3E17%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%3EWEU%3C%2FTD%3E%3CTD%3E16%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%3EUKW%3C%2FTD%3E%3CTD%3E14%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%3ENEU%3C%2FTD%3E%3CTD%3E6%3C%2FTD%3E%3C%2FTR%3E%3C%2FTBODY%3E%3C%2FTABLE%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3ESuprisingly%20most%20of%20the%20connections%20travel%20via%20the%20UK%20South%20Gateway%20if%20I%20am%20understanding%20this%20correctly.%20I%20checked%20the%20same%20query%20with%20several%20different%20customers%20and%20they%20all%20show%20this%20spread.%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3EI%20believe%20I%20have%20a%20solid%20grasp%20on%20how%20the%20RDGateway%20is%20selected%3B%20it%20depends%20on%20the%20DNS%20server%20used%20that%20actually%20makes%20the%20call%20to%20the%20Azure%20Traffic%20Manager%20but%20that%20wouldn't%20explain%20this%20result%20since%20most%20of%20the%20enduser%20either%20use%20the%20internet%20from%20the%20same%20office%20or%20probably%20use%20the%20automatic%20DNS%20server%20of%20one%20of%20our%20few%20ISP's.%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3EAm%20I%20misunderstanding%20the%20meaning%20of%20GatewayRegion%20field%20in%20this%20context%3F%20I've%20also%20noticed%20that%20for%20the%20new%20ARM%20release%20this%20value%20is%20always%20empty%20so%20I%20couldn't%20double%20check%20there%2C%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3EThanks!%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1750112%22%20slang%3D%22en-US%22%3ERe%3A%20Meaning%20of%20GatewayRegion_s%20field%20in%20in%20WVDActivityV1_CL%20table%20in%20log%20analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1750112%22%20slang%3D%22en-US%22%3EThansk%20for%20your%20feedback!%20Good%20observation!%20This%20is%20expected.%20WVD%20gateways%20are%20distributed%20geographically%20in%20multiple%20Azure%20regions.%20Our%20attempt%20is%20to%20load-balance%20the%20traffic%20across%20nearby%20regions%20as%20to%20offer%20the%20best%20performance%20and%20experience%20for%20all%20users%20of%20WVD.%20Towards%20that%2C%20we%20make%20use%20of%20Azure%20FrontDoor%20with%20latency%20based%20traffic%20routing%20(%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Ffrontdoor%2Ffront-door-routing-methods%23lowest-latencies-based-traffic-routing%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Ffrontdoor%2Ffront-door-routing-methods%23lowest-latencies-based-traffic-routing%3C%2FA%3E)%20and%20route%20users%20to%20gateways%20that%20are%20in%20the%20relative%20vicinity%20(not%20necessarily%20the%20one%20closest%20to%20them)%20without%20any%20negative%20impact%20on%20their%20user%20experience.%3C%2FLINGO-BODY%3E
New Contributor

I am trying to troubleshoot some disconnect issues with a customer in the Western Europe region. I used the following query to list all the connections (it's not the ARM release of WVD):

 

WVDActivityV1_CL
| where Type_s == "Connection"
| join kind=leftouter (
    WVDErrorV1_CL
    | summarize Errors = makelist(pack('Time', Time_t, 'Code', ErrorCode_s , 'CodeSymbolic', ErrorCodeSymbolic_s, 'Message', ErrorMessage_s, 'ReportedBy', ReportedBy_s , 'Internal', ErrorInternal_s )) by ActivityId_g
    ) on $left.Id_g  == $right.ActivityId_g 
| join  kind=leftouter (
    WVDCheckpointV1_CL
    | summarize Checkpoints = makelist(pack('Time', Time_t, 'ReportedBy', ReportedBy_s, 'Name', Name_s, 'Parameters', Parameters_s) ) by ActivityId_g
    ) on $left.Id_g  == $right.ActivityId_g
|project-away ActivityId_g, ActivityId_g1
 
What strikes me as odd is that the GatewayRegion fields shows values from all over Europe and not just the WEU gateway that would be logically be the closest one (customer is in the Belgium/Antwerp region and WEU is The Netherlands/Amsterdam). A short query shows this spread:
UKS23
GWC21
FRC17
WEU16
UKW14
NEU6
 
Suprisingly most of the connections travel via the UK South Gateway if I am understanding this correctly. I checked the same query with several different customers and they all show this spread.
 
I believe I have a solid grasp on how the RDGateway is selected; it depends on the DNS server used that actually makes the call to the Azure Traffic Manager but that wouldn't explain this result since most of the enduser either use the internet from the same office or probably use the automatic DNS server of one of our few ISP's.
 
Am I misunderstanding the meaning of GatewayRegion field in this context? I've also noticed that for the new ARM release this value is always empty so I couldn't double check there,
 
Thanks!
 
 
 
2 Replies
Thansk for your feedback! Good observation! This is expected. WVD gateways are distributed geographically in multiple Azure regions. Our attempt is to load-balance the traffic across nearby regions as to offer the best performance and experience for all users of WVD. Towards that, we make use of Azure FrontDoor with latency based traffic routing (https://docs.microsoft.com/en-us/azure/frontdoor/front-door-routing-methods#lowest-latencies-based-t...) and route users to gateways that are in the relative vicinity (not necessarily the one closest to them) without any negative impact on their user experience.

@Soo Kuan Teo 

Thank you for the reply! That would explain the results.

So my understanding of how the gateway is chosen does seem to be a bit off (I based this on a blog post about this topic somewhere). 

I assumed that running an nslookup of rdgateway.wvd.microsoft.com would correctly show the gateway that would be used if I was to start a WVD session.  For example at the moment is shows me:

 

Name: waws-prod-am2-f32c0796.cloudapp.net
Address: 51.136.28.200
Aliases: rdgateway.wvd.microsoft.com
rdgateway-prod-geo.trafficmanager.net
mrs-weur1c100-rdgateway-prod.wvd-ase-weur1c100-prod.p.azurewebsites.net
waws-prod-am2-f32c0796.sip.p.azurewebsites.windows.net

 

But running a capture with Wireshark does indeed show DNS entries such as afd-rdgateway-r1.wvd.microsoft.com which does imply that a Frontdoor service is at work.  

 

Thanks again for the explanation.