Skip to content

AVD Connection-Failure Alert

A short Log Analytics (KQL) query, wired into a scheduled alert rule, that catches Azure Virtual Desktop session failures the moment the session hosts log them — and emails the AVD admins with the host pool, machine and user already extracted. Read-only observability.

View on GitHub

Read-only

This is a Log Analytics scheduled query alert, not a script that runs against your tenant. It reads the WVDErrors table and fires an email via an action group. It changes nothing in the AVD environment.

1 · The query

// AVD connection-failure detector — for a Log Analytics scheduled alert rule.
// Fires on the two errors that mean sessions are being blocked:
//   ERROR_SHARING_VIOLATION              (profile/file sharing contention, e.g. FSLogix)
//   ConnectionFailedNoHealthyRdshAvailable (no healthy session host to place the user)
// Alert condition: table rows > 0 (raise to de-noise)  ·  Severity: Critical  ·  Action group: email the AVD admins.
// Read-only: it queries WVDErrors; it changes nothing.
WVDErrors
| where CodeSymbolic contains "ERROR_SHARING_VIOLATION"
    or Message contains "ERROR_SHARING_VIOLATION"          // Win32 code 32 can land in Message, not CodeSymbolic
    or CodeSymbolic contains "ConnectionFailedNoHealthyRdshAvailable"
| extend MachineName  = extract("'(.*?)'", 1, Message)             // machine name from the message text
| extend HostPoolName = extract("hostpools/(.*)", 1, _ResourceId)  // host pool from the resource id
| project TimeGenerated, HostPoolName, MachineName, UserName, CodeSymbolic

2 · The alert rule

Wire the query into an Azure Monitor scheduled query alert: scope it to your AVD Log Analytics workspace, condition table rows > 0 (raise to de-noise), evaluate every few minutes, severity Critical, and point it at an action group that emails your AVD admin list. Confirm AVD diagnostic settings are sending the Errors category to the workspace first, or WVDErrors won't exist to query.