LogZilla

Overview

Azure Virtual Desktop (AVD) is a desktop and app virtualization service running on Azure. AVD session hosts generate events for health monitoring, connection tracking, and agent status through the Microsoft.RDInfra infrastructure components.

App Function

Parse AVD events from Microsoft.RDInfra.* programs
Extract health check status including FSLogix profile container health
Categorize events by component (HeartbeatService, SessionController, etc.)
Provide dashboard for monitoring AVD session host health
Alert on failed health checks and FSLogix issues

Vendor Documentation

Device Configuration

Configure LogZilla Windows Agent on AVD session hosts:

Install LogZilla Windows Agent on each session host
Enable RemoteDesktopServices event log forwarding
Configure the agent to send events to the LogZilla server

Verification

Generate activity on the session host, then verify events appear in LogZilla with program names starting with Microsoft.RDInfra.

Incoming Log Format

AVD events arrive via the LogZilla Windows Agent with program names following this pattern:

text
Microsoft.RDInfra.<Component>.<Subcomponent>

Component - RDAgent, Messaging, Diagnostics
Subcomponent - Service.HeartbeatService, ConnectionTrackingService, etc.

Health check events contain embedded JSON with check results.

Parsed Metadata Fields

Tag Name	Example	Description
`Vendor`	`Microsoft`	Vendor name
`Product`	`Azure Virtual Desktop`	Product identifier
`Event Class`	`System`	Cross-vendor classification
`Event Type`	`Service`	Event type from taxonomy
`AVD Component`	`Service.HeartbeatService`	RDInfra subcomponent path
`AVD Event Type`	`Health Check`	AVD-specific event category
`AVD Health Status`	`Healthy`	Overall health status
`AVD Failed Checks`	`FSLogix, DomainJoin`	Failed health check names
`FSLogix Status`	`Healthy`	FSLogix profile health
`FSLogix Profile Status`	`Enabled`	Profile registry status
`Criticality`	`High`	Event priority level

Log Examples

Health Check - All Healthy

text
HeartbeatService sending to broker [{"HealthCheckName":0,"HealthCheckResult":1,
"AdditionalFailureDetails":{"Message":"SessionHost healthy: is joined to domain
example.com","ErrorCode":0}}]

Health Check - FSLogix Failed

text
HeartbeatService sending to broker [{"HealthCheckName":2,"HealthCheckResult":0,
"AdditionalFailureDetails":{"Message":"FSLogix healthy=false
ProfileRegistryStatus=Disabled","ErrorCode":1}}]

Heartbeat Ping

text
0: Heartbeat service sending out ping...

Triggers

Trigger	Description
`AVD: FSLogix Health Check Failed`	FSLogix profile container failure
`AVD: Session Host Health Check Failed`	Any health check failure
`AVD: Domain Join or Trust Issue`	Domain-related failures
`AVD: SxS Stack Degraded`	Side-by-side stack issues