App for PCoIP Real-Time Monitoring across your Organisation

Now, this is very cool! If you have been following my blog you probably noticed a previous article where I explain how to use a tool called Splunk to collect, index, search & analyse PCoIP log files across the entire organisation. On that same article I mentioned that I soon would be publishing a App for Splunk. I have been working with the Splunk team (Thanks to Brett Matthews, Tat-wee Kan and Daniel Miller) to create this app and it is now ready for use and distribution.

This app that you are about to download will allow you to monitor passively or in real-time all PCoIP traffic from your VMware View environment independent of how many concurrent users – anything between 1 and thousands of desktops. Yes, I said Real-Time!

If you already have some type of network monitoring in place, great, that is good practice and you should do it. However that will not give you anything near the amount of information you are about to collect and analyse.

Then you will say, yeah but I already have a zillion of log files to go trough – I don’t want one more. And I say – there are no logs to go through if you don’t want to, and everything will be displayed in a nice and neat dashboard interface that was created specifically for PCoIP.

Amongst the values you will be able to graph and trace are: RTO, Plateau, Limit, Latency, Loss, Variance and even CODECS in use. Yet, it is possible to segment by time, date, virtual desktop, or watch it all in real time.

These numbers will let you know how exactly PCoIP is performing in your network and how the users are perceiving their experience. I’ll soon write an article on how you understand and analyse each one of those values, but now enough talking and let me demonstrate what I am providing here.

Below is the dashboard or main screen where you can follow the PCoIP perceived packet losses with the Minimum, Average, and Maximum values. The dashboard is also tracing and graphing the Packet Loss across all virtual desktops. If you want to select a specific desktop or pool of desktops just type Source=”desktop_name*” in the formula field on top of the dashboard.

Additionally, the dashboard is graphing the Plateau Distribution, the Average and the RTO distribution over time. (Didn’t fit on screen so you can’t read properly).

image image

We also created a set of pre-configured queries to make easier to search for common event but you may configure you own queries. If you want to see all the events just select “VMware – PCoIP Event Listing”. On the right side where you see a drop-down menu with “All time” you can select pre-defined periods such as the last 15 minutes.


The picture below demonstrates the RTO distribution over time and the tool allows you to drill down into events, sessions and fields. It’s really flexible and you know what – It’s FREE for database indexes under 500Mb.


Once you download and install the Splunk server package (download here) you will need to download the App from my blog (click here to download). To install the app just unpack and copy the folder and files to your Splunk_home/etc/apps directory.

You are now ready to process PCoIP log files. If you are still unsure how to find the log files or how to read them read on my previous article How to troubleshoot PCoIP performance. The App comes with few log files pre-loaded (log into Splunk_home/etc/apps/vmware_pcoip/logs) and you will need to download few more logs from your virtual desktops if you want to see what’s happening in your environment.

If you prefer to automate the log file download from your virtual desktops (I guess this is the nirvana scenario) then you will need to configure Splunk server as a Receiver and install the Splunk ForwarderLight in your virtual desktops. I would recommend installing the Forwarder in your ParentVM and recompose the whole lot, if possible. It’s very light and will not add overhead to your VDI environment.


For instructions on how to implement Receiver and Forward refer to the Splunk Administration Manual.

This is an initial dashboard and I already have some ideas of what I should change and implement for a next release. But if you decide to invest some time and create your own dashboard or change this one, please share with us.

I told you this one would be Cool! My Christmas gift to all View administrators 🙂

Some more screenshots of possible graphs:




1 ping

Skip to comment form

    • Phil Blades on 12/14/2010 at 1:06 am

    Cool it is – thanks for sharing, great for splunksters (and I can recommend splunk as well).

    • Thanks on 12/14/2010 at 8:54 pm

    Great Work!

    Is this usable for Version 4.0.x of VMware View also, or only for the new 4.5 ?


  1. VMware View 4.0 supports PCoIP logging in the same manner 4.5 does. You may use the Splunk app for View 4.0

    • Leena on 03/20/2011 at 12:00 pm

    this is cool! i am going to link to this post! thank you very much!

    • Gunnar on 07/12/2011 at 6:55 am

    One thing to keep in mind is in each version change, 4.0, 4.5, 4.6… and into the future. We change/improve how the logs are formatted. So there is a chance this tool may not work as well between different versions. Just something to keep your eye out for.

    Gunnar Berger

  2. Hi Andre,

    your Splunk app is definitive great work – but since the View Agent now integrates WMI counters it would be great to have a new set of queries for it. The main problem is that the WMI counters are mainly cumulative :(. In the moment i dont have a clue how to get a query done which translate them to something “per second” or “per minute” or percent.

  3. @Mario Grunert
    Thanks for pointing out. As soon I have some spare time I will look into it.

    • Paul Friemel on 05/02/2012 at 8:57 am

    This is a really cool app. I have a question though, and a little background is in order. I installed the app on a test server and copies some log files into the log folder. Cool, the data shows up and I’m able to view the graphs. Next, I deploy some universal forwarders on virtual desktops and tell it to forward the pcoip_server*.txt files to the pcoip index in the vmware_pcoip sourcetype. Well, the data is not showing up since I created the pcoip index and the app is only looking at the main index. How do I change the default index for the app, so that the data from my desktops shows up?

  4. @Paul Friemel
    Honestly, it’s been so long since I published this article that I don’t remember anymore how I implemented the solution. I am sorry.


    • Johan Nieuwhoff on 05/30/2012 at 2:46 am

    You can also use a powershell script to pull the log files to a local folder.
    1. create a csv file with the computers names listed.
    2. run this script:
    $computers = Get-Content -Path “C:\temp\vmware logs\computers.csv”
    foreach($computer in $computers)
    Get-Childitem -path “\\$computer\c$\Documents and Settings\All Users\Application Data\VMware\VDM\logs\pcoip_server_2012_05*” -recurse -filter *.txt | foreach-object {
    Foreach-Object { copy-item -Path $_.fullname -Destination C:\Temp\pcoiplogs }

    • VMware View 5 PCoIP Session Statistics (WMI) - | on 11/23/2012 at 11:56 pm

    […] VMware View 5 PCoIP Session Statistics (WMI)   By Davoud Teimouri | November 24, 2012 – 11:26 am | Uncategorized Download PDFVMware View 5.0 exposes Teradici’s PCoIP session statistics through the WMI interface. Before View 5.0 the only mechanism to identify bandwidth usage and allocation was trough the log files. The log files are still a good source and there are few good applications that will consolidate log files and demonstrate the broad PCoIP utilization and network conditions in your organization. Please refer to App for PCoIP Real-Time Monitoring across your Organisation. […]

Comments have been disabled.