VMware Logon Monitor monitors Windows user logons and reports performance metrics intended to help administrators, support staff, and developers to troubleshoot slow logon performance.

Metrics include logon time, logon script time, CPU/memory usage, and network connection speed. Logon Monitor can also receive metrics from other VMware products to provide more information on the logon process.

Supported Platforms

Logon Monitor supports the same Windows platforms as the Horizon Agent.

Key Features

Logon Monitor provides the following features:

  • Installed as part of Horizon Agent. To start the service, see KB 57051.
  • Integrates with Horizon Help Desk Tool timing profiler. Logon-related metrics are aggregated and sent to the Horizon Agent events database. For information on how to enable the timing profiler, see Using Horizon Help Desk Tool in Horizon Console.
  • Enables customers to upload logs to a file server for easier access.
  • Integrates with other VMware products, such as App Volumes, Dynamic Environment Manager, and the Horizon Agent that send logon-related events to Logon Monitor. Logon Monitor logs the events as they occur to show the events in the logon flow and how long they are taking.
  • Monitors concurrent logons on the same machine.
  • Retrives legacy data. The Retrieve Legacy Data feature not work for a session that is connected after an upgrade to Horizon 2103 or later and is only available for a session that was connected in an earlier version before the upgrade.

Logs

Logon Monitor writes log files for service status messages and for a user session. By default, all log files are written to C:\ProgramData\VMware\VMware Logon Monitor\Logs.
  • Main Log: The main log file, vmlm.txt, contains all status messages for the vmlm service and session events that come in before and after monitoring the logon. Check this log to determine if the Logon Monitor is running correctly.
  • Session Log: The session log contains all events related to a user logon session. Events start in this log when the logon begins and only apply to a single user session. A summary written at the end of the log provides an overview of the most important metrics. Check this log to troubleshoot slow logons. When the logon is complete, no further events are written to the session log.

Logon Monitor Metrics

Logon Monitor computes metrics related to logon, group policy, user profile, and performance. These metrics provide administrators a detailed view of end user systems during logon time to help determine the root cause of performance bottlenecks.

Table 1. Logon Monitor Metrics
Metric Parameters Description
Logon time
  • Start
  • End
  • Total Time
Metrics include the time logon starts on the guest, logon is completed and the profile is loaded and the desktop is visible, and the total time spent processing logon on the guest. Excludes any time spent outside of the guest.
Session start to logon start time Total time Time from when Windows created a user session until logon began.
Profile sync time Total time Time Windows spent reconciling user profile during logon.
Shell load
  • Start
  • End
  • Total Time
Windows provides the start time of the user shell load. The end time is when the explorer window is created.
Logon to hive load time Total time Metrics provide total time from when the logon starts to when the user registry hive is loaded.
Windows folder redirection
  • Start
  • End
  • Total Time
Metrics related to the time Windows folder redirection starts and is fully applied, as well as the total time to enable Windows folder redirection. This time can be high for the first time folder redirection has been applied or if new files are being uploaded to the redirected share.
Group policy time
  • User group policy apply time
  • Machine group policy apply time
Metrics related to applying group policy to the guest include the time it took to apply user group policy and machine group policy.
Profile metrics
  • Profile type: local, roaming, temporary
  • Profile size: number of files, number of folders, total megabytes
Metrics related to the user profile indicate the type of user profile and whether it is stored on the local machine, on a central profile store, or deleted after logoff.

The profile size includes metrics on the number of files, the total number of folders, and the total size in MB of the user profile.

Profile size distribution
  • Number of Files Between 0 and 1MB
  • Number of Files Between 1MB and 10MB
  • Number of Files Between 10MB and 100MB
  • Number of Files Between 100MB and 1GB
  • Number of Files Between 1GB and 10GB
A count of the number of files in various size ranges in the user profile.
Processes started during logon
  • Name
  • Process ID
  • Parent process ID
  • Session ID
These values are logged for each process that starts from the time the session starts until the logon is complete.
Group policy logon script time Total time Metrics related to executing group policy logon scripts report total time spent executing group policy logon scripts.
Group policy power shell script time Total time Metrics related to executing group policy power shell scripts indicate time spent executing group policy power shell scripts.
Memory usage
  • Available bytes: min, max, avg
  • Committed bytes: min, max, avg
  • Paged Pool: min, max, avg
WMI metrics related to memory usage during logon. Samplings are takings until logon is complete. Disabled by default.
CPU usage
  • Idle CPU: min, max, avg
  • User CPU: min, max, avg
  • Kernel CPU: min, max, avg
WMI metrics related to CPU usage during logon. Samplings are taken until logon is complete. Disabled by default.
Are logon scripts synchronous? Reports whether group policy logon scripts are executed synchronously or asynchronously to the logon.
Network connection status
  • Dropped
  • Restored
Reports whether the network connection is alive or disconnected.
Group Policy Software Installation
  • Asynchronous: True/False
  • Error Code
  • Total Time
Metrics related to group policy software installation indicate whether the installations are synchronous or asynchronous to the logon, if the installations succeeded or failed, and the total time spent installing software using group policy.
Disk Usage For Profile Volume
  • Disc space available for user
  • Free disk space
  • Total disk space
Metrics related to the disk usage on the volume where the user profile is stored.
Domain Controller Discovery
  • Error code
  • Total time
Domain controller related metrics. Error code indicates if there is a failure reaching the domain controller.
Estimated network bandwidth Bandwidth Value collected from Event ID 5327.
Network connection details
  • Bandwidth
  • Slow link threshold
  • Slow link detected: True/False
Values collected from Event ID 5314.
Settings that can affect logon time
  • Computer\Administrative Templates\Logon\Always wait for network at computer startup and logon
  • Computer\Administrative Templates\Logon\Run these programs at user logon
  • Computer\Administrative Templates\User Profiles\Wait for roaming user profile
  • Computer\Administrative Templates\User Profiles\Set maximum wait time for network if a user has a roaming profile or remote home directory
  • Computer\Administrative Templates\Group Policy\Configure Logon Script Delay
  • User\Admin Templates\System\Logon\Run these programs at user logon
  • User\Admin Templates\System\User Profiles\Specify network directories to sync at logon, logoff time only
Metrics from Horizon Agent, App Volumes VMware products that interact with Logon Monitor report custom metrics in the Logon Monitor logs. These metrics can help determine if one of these products might be contributing in a negative way to the logon time.