It used to be a fling
Some features in VMware Horizon have their origin as a fling. Flings are small tools that get created by people that see gaps in functionality of a product, or think that there are better ways to combine certain products or product features. These are then posted at https://flings.vmware.com/ and downloadable for free. When these tools get popular, sometimes they get productized, just as happened with this one.
What does it do
The Logon Monitor does exactly what the title implies, it monitors what happens when a user logs on to the machine that the Logon Monitor service is running on. The tool is installed as a windows service during the Horizon agent installation, but set to manual by default. The Horizon agent is the component that is installed on the resource that you would want to make available through horizon, such as your Windows 10/11, Linux or Windows Server machines. This tool is available in the Horizon Agent for Windows only.
How to start
Setting the Startup Type of this service is the first step in being able to use it. The service needs to be in running state before a user logs on. There are many ways to make sure the service is enabled in your environment, here are a few examples. You can set the startup type to Automatic in your Golden Image manually:
or set it to Automatic using Microsoft PowerShell:
Set-Service -Name vmlm -StartupType Automatic
You could add this to an MDT task sequence provided by the VMware OS Optimization plugin as can be seen in the screenshot below. Remember, this task will need to be processed after the task that actually installs the Horizon Agent, otherwise the referenced service will not exist yet:
Logfiles
With the service enabled, the tool will generate a log file at the default location: %ProgramData%\VMware\VMware Logon Monitor\Data. The location can be configured, check the VMware Horizon documentation for configuration details.
Two logfiles will be generated: first one is the main vmlm.txt log, containing all the status messages for the service itself. This is used to check if the service is operating as intended. The second one is the session log, consisting of the machine name, user name, and date/time stamp. This is used to see what has been going on during logon, and how long it took. The summary at the end of the session logfile will look like this. In this example, the Shell Load Time is unusually high and warrants investigation:
****************** Session Summary (User: TESTING\plonius, Session: 1) *****************
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] CreateSession 2022-08-18T13:39:40:795 - 2022-08-18T13:39:41:981 (dur 1.19 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] GPClient 2022-08-18T13:39:41:925 - 2022-08-18T13:39:41:957 (dur 0.03 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] TermSrv 2022-08-18T13:39:41:957 - 2022-08-18T13:39:41:981 (dur 0.02 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] svservice 2022-08-18T13:39:41:885 - 2022-08-18T13:39:41:886 (dur 0.00 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] Login 2022-08-18T13:50:15:080 - 2022-08-18T13:50:20:987 (dur 5.91 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] GPClient 2022-08-18T13:50:17:775 - 2022-08-18T13:50:17:969 (dur 0.19 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] Profiles 2022-08-18T13:50:16:995 - 2022-08-18T13:50:17:318 (dur 0.32 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] Sens 2022-08-18T13:50:18:050 - 2022-08-18T13:50:18:058 (dur 0.01 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] SessionEnv 2022-08-18T13:50:16:994 - 2022-08-18T13:50:16:994 (dur 0.00 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] TermSrv 2022-08-18T13:50:17:970 - 2022-08-18T13:50:18:037 (dur 0.07 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] V4VEnd 2022-08-18T13:50:17:319 - 2022-08-18T13:50:17:319 (dur 0.00 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] V4VStart 2022-08-18T13:50:16:991 - 2022-08-18T13:50:16:991 (dur 0.00 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] VMwareUEM 2022-08-18T13:50:18:104 - 2022-08-18T13:50:20:987 (dur 2.88 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] WSNM 2022-08-18T13:50:16:992 - 2022-08-18T13:50:16:993 (dur 0.00 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] svservice 2022-08-18T13:50:15:081 - 2022-08-18T13:50:16:990 (dur 1.91 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] StartShell 2022-08-18T13:50:21:331 - 2022-08-18T13:50:21:412 (dur 0.08 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] GPClient 2022-08-18T13:50:21:373 - 2022-08-18T13:50:21:373 (dur 0.00 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] Sens 2022-08-18T13:50:21:373 - 2022-08-18T13:50:21:393 (dur 0.02 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] SessionEnv 2022-08-18T13:50:21:373 - 2022-08-18T13:50:21:373 (dur 0.00 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] TermSrv 2022-08-18T13:50:21:393 - 2022-08-18T13:50:21:412 (dur 0.02 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] V4VEnd 2022-08-18T13:50:21:412 - 2022-08-18T13:50:21:412 (dur 0.00 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] V4VStart 2022-08-18T13:50:21:373 - 2022-08-18T13:50:21:373 (dur 0.00 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] svservice 2022-08-18T13:50:21:331 - 2022-08-18T13:50:21:373 (dur 0.04 seconds)
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] Shell Load Time: 25.95 seconds
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] User Policy Time: 0ms
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] Group Policy Summary:
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] Async. Policies: 0
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] Sync. Policies: 3
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] Failed Policies: 0
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] Changed Policies: 0
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] Group Policy CSE Total Time: 328ms
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] CSE: 'Group Policy Registry' Duration: 172ms
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] CSE: 'Registry' Duration: 93ms
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] CSE: 'Scripts' Duration: 63ms
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] Free Disk Space Available To User: 0 GB
2022-08-18T13:50:47.282 INFO (04f8-208c-1) [9602] [Microsoft-Windows-Shell-Core] ****************************************************************************************
Helpdesk Tool
The Logon Monitor also integrates with the VMware Helpdesk tool, integrated in the Horizon Admin console. The Helpdesk tool is used by helpdesk or administrators to gather information about current sessions in the environment.
To create complete visibility, the Horizon Connection servers need to be configured to use the timingprofiler, since this is disabled by default. The command vdmadmin -I -timingProfiler -enable will have to be run on all Connection servers. More details about this can be found in the VMware Horizon documentation.
Why should I use this
The Logon Monitor gathers information about the users logon. You can use this to troubleshoot slow logons or monitor the status of your logon baseline. It also allows you to gain visibility in the Helpdesk tool, helping your IT staff find problems in an easier way. The details can clearly show you if there's a user policy doing something it isn't supposed to, folder redirection taking too long or tell you that the latest image build created something strange in the default user profile, as it is now suddenly much larger than before.
As I've seen from personal experience, there is hardly any strain to the system when enabled, as it only generates a simple text based logfile, and can rotate logs, as it only saves the 10 last ones by default. There are also options to configure the log to be sent to a remote system, or have it save a less amount of them. I can't think of any reason not to enable this when you need more information, so go enable it and get yourself more viable information about the logons in your Horizon environment!
Disclaimer
VMware recommends that you do not use this in production, just for test/dev environments. Both the logon monitor on the agent side and timing profiler on the connection server side add extra overhead to your environment that you should be made aware of.
References
Using the VMware Logon Monitor
Using Horizon Help Desk Tool in Horizon Console
VMware Logon Monitor service is stopped by default after View Agent installation