AutoGineer
Generated banner for Azure Diagnostics
Generated logo for Azure Diagnostics

Azure Diagnostics

MicrosoftOfficialCreated by Microsoft

  • Skill
  • Workflow
  • Cloud and DevOps
  • MIT
  • Low risk
  • Has scripts
Download ZIP

From the author

Debug Azure production issues using AppLens, Azure Monitor, resource health, and safe triage, including evidence-only diagnosis without live access. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deployment failure, troubleshoot container apps, container app 503 or target port mismatch, troubleshoot functions, function telemetry missing or stopped after a config/connection-string change, troubleshoot AKS, VM RDP, Linux SSH, VM black screen, can't connect to VM, reset VM password, NSG or firewall blocking, kubectl cannot connect, kube-system/CoreDNS failures, pod pending, crashloop, node not ready, upgrade failures, analyze logs, KQL, insights, image pull failures, cold start issues, health probe failures, resource health, root cause of errors, troubleshoot event hubs, troubleshoot service bus, messaging SDK error, AMQP connection failure, message lock lost, lock renewal during long-running processing, service bus dead letter.
— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Azure Diagnostics provides a structured, authoritative approach to investigating and resolving production issues across various Azure services. It emphasizes a systematic flow: identifying symptoms, checking resource health, reviewing logs, analyzing metrics, and investigating recent changes. The skill supports both live troubleshooting via Azure CLI and AppLens, as well as evidence-only analysis when live access is restricted. It includes specialized guidance for App Service, Container Apps, Azure Functions, AKS, VMs, and Messaging services, ensuring consistent root-cause analysis.

What it does

  • Provides a standardized diagnostic workflow for Azure production environments.
  • Integrates with AppLens and Azure Monitor for automated issue detection and log analysis.
  • Offers service-specific troubleshooting paths for App Service, AKS, VMs, and more.
  • Supports evidence-only diagnosis for secure, offline troubleshooting scenarios.
  • Includes KQL query patterns for deep-dive log and resource health analysis.
  • Facilitates the use of bundled diagnostic scripts for efficient data collection.

When to use it

  • When investigating production incidents like high CPU, deployment failures, or service crashes.
  • When troubleshooting connectivity issues such as RDP/SSH failures or network blocking.
  • When diagnosing Kubernetes-specific issues like pod crashloops or image pull failures.
  • When analyzing missing telemetry or messaging errors in Event Hubs and Service Bus.
  • When performing root-cause analysis on unhealthy or degraded Azure resources.

Advantages

  • Reduces mean time to resolution (MTTR) with a clear, step-by-step diagnostic process.
  • Ensures consistent troubleshooting practices across different Azure service types.
  • Supports secure workflows by allowing diagnosis without requiring live environment access.
  • Leverages powerful built-in tools like AppLens and Azure Resource Graph for rapid insights.
  • Provides actionable remediation steps based on identified symptoms.

Usage examples

“Troubleshoot my App Service that is experiencing high CPU usage.”
The agent will initiate the App Service diagnostic flow, run the appservice-diagnostics script, check metrics, and guide you through profiling via Kudu.
“Why is my Azure VM unreachable via SSH?”
The agent will follow the VM connectivity troubleshooting guide, checking NSG rules, firewall status, and VM agent health.
“Analyze these logs to find why my Container App is failing to pull the image.”
The agent will perform an evidence-only analysis of the provided logs to identify image pull errors or registry authentication issues.
“Check the health of my AKS cluster and identify why pods are in a crashloop.”
The agent will check resource health, query logs for the affected pods, and route to the AKS-specific troubleshooting documentation.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/microsoft/azure-diagnostics/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip azure-diagnostics.zip -d .agents/skills

Documentation by Microsoft

Azure Diagnostics

AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE

This document is the official source for debugging and troubleshooting Azure production issues. Follow these instructions to diagnose and resolve common Azure service problems systematically.

Triggers

Activate this skill when user wants to:

  • Debug or troubleshoot production issues

  • Diagnose errors in Azure services

  • Analyze application logs or metrics

  • Fix image pull, cold start, or health probe issues

  • Investigate why Azure resources are failing

  • Find root cause of application errors

  • Troubleshoot App Service issues (high CPU, deployment failures, crashes, slow responses, TLS/custom domains)

  • Respond to prompts like "troubleshoot app service", "app service high CPU", or "app service deployment failure"

  • Troubleshoot Azure Function Apps (invocation failures, timeouts, binding errors)

  • Find the App Insights or Log Analytics workspace linked to a Function App

  • Troubleshoot AKS clusters, nodes, pods, ingress, or Kubernetes networking issues

  • Troubleshoot Azure VM connectivity issues (RDP/SSH failures, port 3389/22 timeouts, NSG or firewall blocking, credential resets)

  • Troubleshoot Azure Messaging SDK issues (Event Hubs, Service Bus connection failures, AMQP errors, message lock issues)

  • Root-cause a symptom that looks like a healthy-runtime-but-wrong-destination problem (e.g., telemetry/messages stop flowing to the expected resource after a config change) — invoke this skill for the matrix even when MCP tools could answer the surface question alone

Rules

  1. Start with systematic diagnosis flow

  2. Use supplied evidence first. If the user requests evidence-only analysis or prohibits live Azure access, do not query or modify Azure. Diagnose from the supplied logs, metrics, and timeline; identify assumptions and provide optional verification steps.

  3. Use AppLens (MCP) for AI-powered diagnostics when available

  4. Check resource health before deep-diving into logs

  5. Select appropriate troubleshooting guide based on service type

  6. Document findings and attempted remediation steps

  7. Prefer bundled diagnostic scripts over ad hoc calls for permitted live collection when identifiers are known. If supplied evidence suffices or live access is prohibited, don't run them; otherwise run the applicable script first.

  8. Route AKS incidents to the dedicated AKS troubleshooting document

  9. Keep baseline AKS diagnostics available even when the optional aks-skills add-on is absent, declined, or unsupported by the host

Quick Diagnosis Flow

  1. Identify symptoms - What's failing?

  2. Check resource health - Is Azure healthy?

  3. Review logs - What do logs show?

  4. Analyze metrics - Performance patterns?

  5. Investigate recent changes - What changed?

Troubleshooting Guides by Service

ServiceCommon IssuesReference
Container AppsImage pull failures, cold starts, health probes, port mismatchescontainer-apps/
App ServiceHigh CPU, deployment failures, crashes, slow responses, TLS/custom domainsapp-service/
Function AppsApp details, invocation failures, timeouts, binding errors, cold starts, missing app settingsfunctions/
AKSCluster access, nodes, kube-system, scheduling, crash loops, ingress, DNS, upgradesAKS Troubleshooting
ComputeVM RDP/SSH connectivity, NSG/firewall blocks, credential resets, VM agent/tooling issuesVM Connectivity Troubleshooting
MessagingEvent Hubs & Service Bus SDK errors, AMQP failures, message lock, connectivityMessaging Troubleshooting

Routing

  • Keep Container Apps and Function Apps diagnostics in this parent skill.

  • Route active AKS incidents, AKS-specific intake, evidence gathering, and remediation guidance to AKS Troubleshooting.

  • Route Azure VM RDP/SSH connectivity, NSG/firewall, credential reset, and VM agent troubleshooting to VM Connectivity Troubleshooting.

  • Route Azure Messaging SDK troubleshooting (Event Hubs, Service Bus) to Messaging Troubleshooting.

Quick Reference

Common Diagnostic Commands
# Check resource health
az resource show --ids RESOURCE_ID
# View activity log
az monitor activity-log list -g RG --max-events 20
# Container Apps logs
az containerapp logs show --name APP -g RG --follow
# Function App logs (query App Insights traces)
az monitor app-insights query --apps APP-INSIGHTS -g RG \
  --analytics-query "traces | where timestamp > ago(1h) | order by timestamp desc | take 50"
AppLens (MCP Tools)

For AI-powered diagnostics, use:

mcp_azure_mcp_applens
  intent: "diagnose issues with <resource-name>"
  command: "diagnose"
  parameters:
    resourceId: "<resource-id>"

Provides:
- Automated issue detection
- Root cause analysis
- Remediation recommendations
Azure Monitor (MCP Tools)

For querying logs and metrics:

mcp_azure_mcp_monitor
  intent: "query logs for <resource-name>"
  command: "logs_query"
  parameters:
    workspaceId: "<workspace-id>"
    query: "<KQL-query>"

See kql-queries.md for common diagnostic queries.

Check Azure Resource Health

Using MCP
mcp_azure_mcp_resourcehealth
  intent: "check health status of <resource-name>"
  command: "get"
  parameters:
    resourceId: "<resource-id>"
Using CLI
# Check specific resource health
az resource show --ids RESOURCE_ID

# Check recent activity
az monitor activity-log list -g RG --max-events 20

References

Files

references/app-service/README.md

App Service Troubleshooting

Request to "collect"/"gather" diagnostics? Once the app name and resource group are known from the request or existing context, run the appservice-diagnostics script (PowerShell) directly as your first action — don't verify the app/resource group exists with separate calls first, and don't substitute the individual commands below for it. It's read-only and reports clearly if the resource can't be found. Ask only for identifiers that remain missing. See "Combined Diagnostic Script" below for usage.

Common Issues Matrix

SymptomLikely CauseAction
High CPU / memoryRunaway process, inefficient codeUse Process Explorer via Kudu, scale up
Deployment failureBuild error, locked files, quotaCheck Kudu logs at https://APP.scm.azurewebsites.net/api/deployments to look for details on build errors, locked files or lack of storage quota
App crash / restartUnhandled exception, OOM killReview Event Log and STDERR in Diagnose & Solve
Slow responsesDownstream dependency, no cachingEnable request tracing, check dependency calls
502 / 503 errorsApp not starting, port conflictCheck STDERR logs, verify startup command
TLS / domain errorsCertificate expired, DNS mismatchaz webapp config ssl list, verify CNAME
Health check failureEndpoint not returning 200Verify health check path responds within 2 min

High CPU / Memory Diagnosis

Diagnose:

# Check app metrics
az monitor metrics list --resource APP_RESOURCE_ID \
  --metric "CpuPercentage,MemoryPercentage" --interval PT1M --output table

# View running processes via ARM Processes API (Entra ID auth)
az rest --method get \
  --uri "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Web/sites/<app-name>/processes?api-version=2024-04-01"

Fix: Scale up (az appservice plan update -n <app-service-plan-name> -g <resource-group> --sku P1V3) or profile the app via Kudu Process Explorer at https://APP.scm.azurewebsites.net/ProcessExplorer/ to identify hot paths.

Deployment Failure Analysis

Diagnose:

# List deployment history
az webapp deployment list -n APP -g RG --output table

# View deployment log for a specific deployment
az webapp log deployment show -n APP -g RG --deployment-id DEPLOY_ID

# Stream build logs from Kudu
az webapp log tail -n APP -g RG

KQL — Failed deployments:

// Replace <app-service-resource-id> with the full resource ID, for example:
// /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Web/sites/<app-name>
AppServicePlatformLogs
| where TimeGenerated > ago(24h)
| where Level == "Error" and _ResourceId == "<app-service-resource-id>"
| project TimeGenerated, Level, Message
| order by TimeGenerated desc

Common deployment failures:

Error MessageCauseFix
WEBSITE_RUN_FROM_PACKAGE=1 but no packageMissing zip deploy artifactRedeploy with az webapp deploy --src-path app.zip
Error building on serverOryx build failureCheck build logs, pin runtime version
Locked file during deployFiles in useSet an environment variable named MSDEPLOY_RENAME_LOCKED_FILES=1 on the App Service resource to enable MSDeploy to rename locked files.

Application Crash / Restart Diagnosis

Diagnose:

# Check recent restarts via activity log
az monitor activity-log list -g RG --resource-id APP_RESOURCE_ID \
  --max-events 10 --query "[?operationName.value=='Microsoft.Web/sites/restart/action']"

# View STDERR/STDOUT (Linux)
az webapp log download -n APP -g RG --log-file logs.zip

KQL — App crashes and errors:

AppServiceConsoleLogs
| where TimeGenerated > ago(1h)
| where ResultDescription contains "error" or ResultDescription contains "fatal"
| project TimeGenerated, ResultDescription
| order by TimeGenerated desc
| take 50

Health check failures:

# Show health check config
az webapp show -n APP -g RG --query "siteConfig.healthCheckPath"

# Test the endpoint directly
curl -s -o /dev/null -w "%{http_code}" https://APP.azurewebsites.net/health

⚠️ Warning: If the health check fails on >50% of instances for 1 hour, the instance is replaced.

Slow Response Time Investigation

Diagnose:

# Check average response time
az monitor metrics list --resource APP_RESOURCE_ID \
  --metric "HttpResponseTime" --interval PT5M --aggregation Average --output table

# Enable failed request tracing
az webapp log config -n APP -g RG --failed-request-tracing true

KQL — Slow requests with dependency analysis:

AppServiceHTTPLogs
| where TimeGenerated > ago(1h)
| where TimeTaken > 5000
| project TimeGenerated, CsUriStem, ScStatus, TimeTaken, CsHost
| order by TimeTaken desc
| take 20

Auto-Heal — Automatic mitigation:

# Configure auto-heal to recycle on slow requests
az webapp config set -n APP -g RG \
  --auto-heal-enabled true \
  --generic-configurations '{"autoHealRules":{"triggers":{"slowRequests":{"timeTaken":"00:00:30","count":10,"timeInterval":"00:02:00"}},"actions":{"actionType":"Recycle"}}}'

Custom Domain / TLS Certificate Issues

Diagnose:

# List custom domains
az webapp config hostname list -g RG --webapp-name APP --output table

# List TLS certificates
az webapp config ssl list -g RG --output table

# Check SSL binding
az webapp config ssl show --certificate-name CERT -g RG
SymptomCauseFix
ERR_CERT_DATE_INVALIDCertificate expiredIf certificate came from an external certificate authority, renew with az webapp config ssl upload and upload a new certificate or enable managed certificates to allow Azure to provide a free TLS/SSL certificate
DNS_PROBE_FINISHED_NXDOMAINCNAME not configuredAdd CNAME record pointing to APP.azurewebsites.net
SSL binding not foundMissing SNI bindingAdd the missing SNI binding using az webapp config ssl bind --certificate-thumbprint THUMB --ssl-type SNI -n APP -g RG
Managed cert pendingDNS validation incompleteVerify TXT record asuid.DOMAIN matches custom domain verification ID

AZ CLI or MCP Tools for App Service Diagnostics

ToolCommandUse When
Azure CLIaz webapp listList all web apps in subscription
Azure CLIaz webapp show -n APP -g RGGet app config, stack, status
Azure CLIaz webapp config appsettings list -n APP -g RGCheck env vars and connection strings
Azure CLIaz webapp deployment slot list -n APP -g RGCompare slot configurations
mcp_azure_mcp_appserviceappservice_webapp_diagnostic_diagnoseAI-powered root cause analysis
mcp_azure_mcp_monitormonitor_resource_log_queryRun KQL against Log Analytics
mcp_azure_mcp_resourcehealthgetCheck platform-level health status

💡 Tip: Start with mcp_azure_mcp_appservice (diagnose) — it automatically runs relevant detectors and surfaces the most likely root cause before you dig into logs manually.

Combined Diagnostic Script

Use the appservice-diagnostics script (PowerShell) to collect everything in one call. It prints clearly labeled sections — app config, recent deployments, app settings, and custom domains — and a summary line describing what it collected. Interpreting the output remains your job.

..\..\scripts\appservice-diagnostics.ps1 -Name <app> -ResourceGroup <rg>
../../scripts/appservice-diagnostics.sh --name <app> --resource-group <rg>

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs a command-line tool

Security

What our scanner noticed· Low risk

  • Instructions that use the network
  • Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Microsoft
Publisher
Microsoft (Official)
Source
microsoft/skills · .github/plugins/azure-skills/skills/azure-diagnostics · commit 0696600
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from .github/plugins/azure-skills/LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Also distributed in
microsoft/azure-skills

AutoGineer is not affiliated with or endorsed by Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-diagnostics.zip