VDI Experience NQL capabilities

New NQL capabilities

Desktop Virtualization uses the following tables that are specific to VDI:

• vdi_session

• vdi_events

These tables provide insights into virtual desktop sessions and their associated events, enabling users to monitor performance and user interactions more effectively. The vdi_sessions table captures key metrics related to individual sessions, while the vdi_events table records significant events during those sessions.

Additionally, the vdi_sessions and vdi_events tables are associated with the Devices and Users tables, allowing access to all related data. These additions promote improved analysis and troubleshooting within virtual desktop environments.

See the NQL data model for more details about the tables.

Increasing data resolution

When querying VDI event data with NQL, you can enhance the resolution of your results for the past 48 hours to 30-second intervals, allowing you to gain deeper insight into system behavior. This enables more accurate tracking of anomalies and system performance trends.

See the Retrieving high-resolution data for Desktop Virtualization page to understand how to increase the data resolution to 30-second intervals.

NQL examples

This list of query examples is designed to help you perform successful investigations in the Nexthink web interface. Go through the investigations listed below and pick the one most similar to the investigation you’re trying to complete. Copy the query and adjust it to your use case.

See the start and end of VDI sessions.

session.lifecycle_events
| where type in [login, connect, disconnect, logout]

Determine the maximum number of concurrent sessions over the past 30 days.

This NQL query references the "old" session table.

session.events during past 30d
| where (device.hardware.type == virtual and protocol in [rdp, citrix_ica, vmware_blast, vmware_pcoip])
| summarize c1 = session_uid.count() by 15min
| sort c1 desc
| limit 1

Identifies endpoints using VDI.

session.events
| where device.hardware.type == virtual
| where device.license_type == endpoint
| summarize no_of_devices = device.count() by event.protocol, device.hardware.type
| list event.protocol, device.hardware.type, no_of_devices

Identify endpoints using servers to deliver Virtual Desktops or Virtual Apps from an on-premises virtualization solution.

session.events
| where event.protocol in [Citrix_ICA, VMWare_Blast, VMWare_PCOIP, Amazon_PCOIP]
| where device.license_type in [server]
| summarize no_of_devices = device.count() by event.protocol, device.license_type
| list event.protocol, no_of_devices, device.license_type

Identify devices using endpoint or server licenses for VDI Technologies with different scenarios, including server licenses. In particular, for customers with multisession VDI, primarily MS AVD.

session.events
| where event.protocol in [RDP, Citrix_ICA, VMWare_Blast, VMWare_PCOIP, Amazon_PCOIP]
| where device.license_type in [server]
| where device.hardware.type == virtual
| where device.operating_system.name in ["Windows 10*" , "Windows 11*" ]
| summarize no_of_devices = device.count() by event.protocol
| list event.protocol, no_of_devices

NQL table reference

This section shows the vdi_sessions and vdi_events tables, and a comparison of available metrics for each endpoint agent and configuration:

• Collector with VDI parameter enabled

• Collector with VDI parameter disabled

• Stand-alone VDI Clien Extension only

See the Collector installation documentation to learn which endpoint agent and configuration is applicable to your infrastructure.

vdi_sessions metrics

The following table outlines the new metrics available in the vdi_sessions table. These metrics provide detailed insights into virtual desktop sessions. The availability of some of the client related information might be dependent on the presence of either a Nexthink Collector that has the VDI Extension enabled or a Nexthink Standalone VDI Extension being installed on the remote client device.

The table shows the available fields for each endpoint agent with the respective configuration. For details about the fields, see the NQL data model.

Field	Nexthink Collector on endpoint	Nexthink VDI Client Extension on endpoint	Nothing installed on endpoint
agent_version	✓	✓	✓
desktop_pool	✓	✓	✓
disk_image	✓	✓	✓
first_seen	✓	✓	✓
id	✓	✓	✓
initial_program	✓	✓	✓
last_client.app_version	Only available for Citrix when the Client Extension is not enabled during the installation of the Collector.	✓	Only available for Citrix, when neither the Collector or the Client Extension is installed.
last_client.device.collector.uid	✓	-	-
last_client.device.name	✓	✓	Only available when using a client application and not a web client.
last_client.device.operating_system.platform	✓	✓	✓
last_client.device.uid	✓	-	-
last_client.plugin_version	Only when Client Extension is enabled.	✓	-
last_interaction_time	✓	✓	✓
last_seen	✓	✓	✓
logon_server	✓	✓	✓
name	✓	✓	✓
region	✓	✓	✓
remote_protocol	✓	✓	✓
session_type	✓	✓	✓
state	✓	✓	✓
transport_protocol	✓	✓	✓
uid	✓	✓	✓
virtualization_type	✓	✓	✓

vdi_events metrics

The following table outlines the new metrics available in the vdi_events table, which provides detailed insights into events and performance characteristics within virtual desktop sessions.

The table shows the available fields for each endpoint agent with the respective configuration. For details about the fields, see the NQL data model.

Field	Nexthink Collector on endpoint	Nexthink VDI Client Extension on endpoint	Nothing installed on endpoint
bucket_duration	✓	✓	✓
client.app_version	Only available for Citrix when the Client Extension is not enabled during the installation of the Collector.	✓	Only available for Citrix when neither the Collector or the Client Extension is installed.
client.cpu.normalized_usage	Only when Client Extension is enabled.	✓	-
client.device.collector.uid	✓	-	-
client.device.name	✓	✓	Only available when using a client application and not a web client.
client.device.operating_system.platform	✓	✓	✓
client.device.uid	✓	-	-
client.network.active_network_adapter	Only when Client Extension is enabled.	✓	-
client.network.incoming_errors	Only when Client Extension is enabled.	✓	-
client.network.incoming_packets	Only when Client Extension is enabled.	✓	-
client.network.incoming_throughput	Only when Client Extension is enabled.	✓	-
client.network.ip_address	Only when Client Extension is enabled.	✓	-
client.network.outgoing_errors	Only when Client Extension is enabled.	✓	-
client.network.outgoing_packets	Only when Client Extension is enabled.	✓	-
client.network.outgoing_throughput	Only when Client Extension is enabled.	✓	-
client.network.wan_latency	Only when Client Extension is enabled and ping host is set for the Collector running in the VM.	Requires the ping host to be set for the Collector running in the VM.	-
client.network.wifi_signal_strength	Only when Client Extension is enabled.	✓	-
client.network.wifi_transmission_rate	Only when Client Extension is enabled.	✓	-
client.network.wired_link_speed	Only when Client Extension is enabled.	✓	-
client.plugin_version	Only when Client Extension is enabled.	✓	-
context.location.country	✓	✓	✓
context.location.site	✓	✓	✓
context.location.state	✓	✓	✓
context.location.type	✓	✓	✓
context.organization.entity	✓	✓	✓
context.vdi_client.location.country	✓	-	-
context.vdi_client.location.site	✓	-	-
context.vdi_client.location.state	✓	-	-
context.vdi_client.location.type	✓	-	-
context.vdi_client.organization.entity	✓	-	-
end_time	✓	✓	✓
framerate	✓	✓	✓
health.duration_with_average_client_processor	Only when Client Extension is enabled.	✓	-
health.duration_with_average_network	✓	✓	✓
health.duration_with_average_responsiveness	✓	✓	✓
health.duration_with_average_session	✓	✓	✓
health.duration_with_average_vm_memory	✓	✓	✓
health.duration_with_average_vm_processor	✓	✓	✓
health.duration_with_average_vm_storage	✓	✓	✓
health.duration_with_bad_client_processor	✓	✓	✓
health.duration_with_bad_network	✓	✓	✓
health.duration_with_bad_responsiveness	✓	✓	✓
health.duration_with_bad_session	✓	✓	✓
health.duration_with_bad_vm_memory	✓	✓	✓
health.duration_with_bad_vm_processor	✓	✓	✓
health.duration_with_bad_vm_storage	✓	✓	✓
health.duration_with_good_client_processor	✓	✓	✓
health.duration_with_good_network	✓	✓	✓
health.duration_with_good_responsiveness	✓	✓	✓
health.duration_with_good_session	✓	✓	✓
health.duration_with_good_vm_memory	✓	✓	✓
health.duration_with_good_vm_processor	✓	✓	✓
health.duration_with_good_vm_storage	✓	✓	✓
ica.input_bandwidth_available	✓	✓	✓
ica.input_bandwidth_used	✓	✓	✓
ica.input_session_bandwidth	✓	✓	✓
ica.input_session_linespeed	✓	✓	✓
ica.latency	✓	✓	✓
ica.output_bandwidth_available	✓	✓	✓
ica.output_bandwidth_used	✓	✓	✓
ica.output_session_bandwidth	✓	✓	✓
ica.output_session_linespeed	✓	✓	✓
idle_duration	✓	✓	✓
network_rtt	✓	✓	✓
rdp.frame_quality	✓	✓	✓
rdp.frames_skipped_client	✓	✓	✓
rdp.frames_skipped_network	✓	✓	✓
rdp.frames_skipped_server	✓	✓	✓
rdp.tcp_bandwidth	✓	✓	✓
rdp.tcp_receive_rate	✓	✓	✓
rdp.tcp_send_rate	✓	✓	✓
rdp.udp_bandwidth	✓	✓	✓
rdp.udp_receive_rate	✓	✓	✓
rdp.udp_send_rate	✓	✓	✓
resolution	✓	✓	✓
start_time	✓	✓	✓
state	✓	✓	✓
transport_protocol	✓	✓	✓
user_input_delay	✓ ⚠️ Not collected on Windows 10 and Server OS before 2022	✓ ⚠️ Not collected on Windows 10 and Server OS before 2022	✓ ⚠️ Not collected on Windows 10 and Server OS before 2022
vm.agent_version	✓	✓	✓
vm.cpu.context_switches	✓	✓	✓
vm.cpu.interrupt_usage	✓	✓	✓
vm.cpu.normalized_queue_length	✓	✓	✓
vm.cpu.normalized_usage	✓	✓	✓
vm.cpu.usage	✓	✓	✓
vm.memory.available	✓	✓	✓
vm.memory.cached	✓	✓	✓
vm.memory.installed	✓	✓	✓
vm.memory.non_paged_pool	✓	✓	✓
vm.memory.paged_pool	✓	✓	✓
vm.memory.pages_output_throughput	✓	✓	✓
vm.memory.paging_file_size	✓	✓	✓
vm.memory.usage	✓	✓	✓
vm.memory.used	✓	✓	✓
vm.network.incoming_throughput	✓	✓	✓
vm.network.outgoing_throughput	✓	✓	✓
vm.system_disk.duration_with_average_queue_length	✓	✓	✓
vm.system_disk.duration_with_average_read_latency	✓	✓	✓
vm.system_disk.duration_with_average_write_latency	✓	✓	✓
vm.system_disk.duration_with_bad_queue_length	✓	✓	✓
vm.system_disk.duration_with_bad_read_latency	✓	✓	✓
vm.system_disk.duration_with_bad_write_latency	✓	✓	✓
vm.system_disk.duration_with_good_queue_length	✓	✓	✓
vm.system_disk.duration_with_good_read_latency	✓	✓	✓
vm.system_disk.duration_with_good_write_latency	✓	✓	✓
vm.system_disk.name	✓	✓	✓
vm.system_disk.queue_length	✓	✓	✓
vm.system_disk.read_iops	✓	✓	✓
vm.system_disk.read_latency	✓	✓	✓
vm.system_disk.read_throughput	✓	✓	✓
vm.system_disk.write_iops	✓	✓	✓
vm.system_disk.write_latency	✓	✓	✓
vm.system_disk.write_throughput	✓	✓	✓
vm.system_volume.capacity	✓	✓	✓
vm.system_volume.free	✓	✓	✓
vm.system_volume.usage	✓	✓	✓