The probe documentation provided a short and limited explanation between Session and Total
Session: total calculated time from start connect to disconnect from ICA server.
Total: total time to complete all activities of the monitoring profile.
QOS_ICA_TOTAL is just how long that profile took where as QOS_ICA_SESSION is the complete session time from connect to disconnect.
It is expected QOS_ICA_SESSION will be longer.
QOS_ICA_TOTAL time is the addition of time taken by all QOS (Connect, Logon, Application Setup, Logoff Delay, Logoff) except QOS_ICA_SESSION.
Whereas QOS_ICA_SESSION time calculated from Profile starting till the end of profile.
"Ica_response_poll.exe" generates for every profile (every cycle) and kills after disconnect, so time taken from starting of the exe till the exe kill is the session time. All the QOS except QOS_ICA_SESSION sent from "Ica_response_poll.exe" only. QOS_ICA_TOTAL time = QOS_ICA_CONNECT + QOS_ICA_LOGON + QOS_ICA_MACRO + QOS_ICA_LOGOFF + QOS_ICA_PING + QOS_ICA_APPLICATION + Logoff Delay time.
QOS_ICA_SESSION time = It is always greater than QOS_ICA_TOTAL time because it includes "Ica_response_poll.exe" launching and closing time.