Azure Diagnostics

MicrosoftOfficialCreated by Microsoft

Skill
Workflow
Cloud and DevOps
MIT
Low risk
Has scripts

From the author

Debug Azure production issues using AppLens, Azure Monitor, resource health, and safe triage, including evidence-only diagnosis without live access. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deployment failure, troubleshoot container apps, container app 503 or target port mismatch, troubleshoot functions, function telemetry missing or stopped after a config/connection-string change, troubleshoot AKS, VM RDP, Linux SSH, VM black screen, can't connect to VM, reset VM password, NSG or firewall blocking, kubectl cannot connect, kube-system/CoreDNS failures, pod pending, crashloop, node not ready, upgrade failures, analyze logs, KQL, insights, image pull failures, cold start issues, health probe failures, resource health, root cause of errors, troubleshoot event hubs, troubleshoot service bus, messaging SDK error, AMQP connection failure, message lock lost, lock renewal during long-running processing, service bus dead letter.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Azure Diagnostics provides a structured, authoritative approach to investigating and resolving production issues across various Azure services. It emphasizes a systematic flow: identifying symptoms, checking resource health, reviewing logs, analyzing metrics, and investigating recent changes. The skill supports both live troubleshooting via Azure CLI and AppLens, as well as evidence-only analysis when live access is restricted. It includes specialized guidance for App Service, Container Apps, Azure Functions, AKS, VMs, and Messaging services, ensuring consistent root-cause analysis.

What it does

Provides a standardized diagnostic workflow for Azure production environments.
Integrates with AppLens and Azure Monitor for automated issue detection and log analysis.
Offers service-specific troubleshooting paths for App Service, AKS, VMs, and more.
Supports evidence-only diagnosis for secure, offline troubleshooting scenarios.
Includes KQL query patterns for deep-dive log and resource health analysis.
Facilitates the use of bundled diagnostic scripts for efficient data collection.

When to use it

When investigating production incidents like high CPU, deployment failures, or service crashes.
When troubleshooting connectivity issues such as RDP/SSH failures or network blocking.
When diagnosing Kubernetes-specific issues like pod crashloops or image pull failures.
When analyzing missing telemetry or messaging errors in Event Hubs and Service Bus.
When performing root-cause analysis on unhealthy or degraded Azure resources.

Advantages

Reduces mean time to resolution (MTTR) with a clear, step-by-step diagnostic process.
Ensures consistent troubleshooting practices across different Azure service types.
Supports secure workflows by allowing diagnosis without requiring live environment access.
Leverages powerful built-in tools like AppLens and Azure Resource Graph for rapid insights.
Provides actionable remediation steps based on identified symptoms.

Usage examples

“Troubleshoot my App Service that is experiencing high CPU usage.”: The agent will initiate the App Service diagnostic flow, run the appservice-diagnostics script, check metrics, and guide you through profiling via Kudu.
“Why is my Azure VM unreachable via SSH?”: The agent will follow the VM connectivity troubleshooting guide, checking NSG rules, firewall status, and VM agent health.
“Analyze these logs to find why my Container App is failing to pull the image.”: The agent will perform an evidence-only analysis of the provided logs to identify image pull errors or registry authentication issues.
“Check the health of my AKS cluster and identify why pods are in a crashloop.”: The agent will check resource health, query logs for the affected pods, and route to the AKS-specific troubleshooting documentation.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/azure-diagnostics/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip azure-diagnostics.zip -d .agents/skills

Documentation by Microsoft

Azure Diagnostics

AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE
This document is the official source for debugging and troubleshooting Azure production issues. Follow these instructions to diagnose and resolve common Azure service problems systematically.

Triggers

Activate this skill when user wants to:

Debug or troubleshoot production issues
Diagnose errors in Azure services
Analyze application logs or metrics
Fix image pull, cold start, or health probe issues
Investigate why Azure resources are failing
Find root cause of application errors
Troubleshoot App Service issues (high CPU, deployment failures, crashes, slow responses, TLS/custom domains)
Respond to prompts like "troubleshoot app service", "app service high CPU", or "app service deployment failure"
Troubleshoot Azure Function Apps (invocation failures, timeouts, binding errors)
Find the App Insights or Log Analytics workspace linked to a Function App
Troubleshoot AKS clusters, nodes, pods, ingress, or Kubernetes networking issues
Troubleshoot Azure VM connectivity issues (RDP/SSH failures, port 3389/22 timeouts, NSG or firewall blocking, credential resets)
Troubleshoot Azure Messaging SDK issues (Event Hubs, Service Bus connection failures, AMQP errors, message lock issues)
Root-cause a symptom that looks like a healthy-runtime-but-wrong-destination problem (e.g., telemetry/messages stop flowing to the expected resource after a config change) — invoke this skill for the matrix even when MCP tools could answer the surface question alone

Rules

Start with systematic diagnosis flow
Use supplied evidence first. If the user requests evidence-only analysis or prohibits live Azure access, do not query or modify Azure. Diagnose from the supplied logs, metrics, and timeline; identify assumptions and provide optional verification steps.
Use AppLens (MCP) for AI-powered diagnostics when available
Check resource health before deep-diving into logs
Select appropriate troubleshooting guide based on service type
Document findings and attempted remediation steps
Prefer bundled diagnostic scripts over ad hoc calls for permitted live collection when identifiers are known. If supplied evidence suffices or live access is prohibited, don't run them; otherwise run the applicable script first.
Route AKS incidents to the dedicated AKS troubleshooting document
Keep baseline AKS diagnostics available even when the optional aks-skills add-on is absent, declined, or unsupported by the host

Quick Diagnosis Flow

Identify symptoms - What's failing?
Check resource health - Is Azure healthy?
Review logs - What do logs show?
Analyze metrics - Performance patterns?
Investigate recent changes - What changed?

Troubleshooting Guides by Service

Service	Common Issues	Reference
Container Apps	Image pull failures, cold starts, health probes, port mismatches	container-apps/
App Service	High CPU, deployment failures, crashes, slow responses, TLS/custom domains	app-service/
Function Apps	App details, invocation failures, timeouts, binding errors, cold starts, missing app settings	functions/
AKS	Cluster access, nodes, `kube-system`, scheduling, crash loops, ingress, DNS, upgrades	AKS Troubleshooting
Compute	VM RDP/SSH connectivity, NSG/firewall blocks, credential resets, VM agent/tooling issues	VM Connectivity Troubleshooting
Messaging	Event Hubs & Service Bus SDK errors, AMQP failures, message lock, connectivity	Messaging Troubleshooting

Routing

Keep Container Apps and Function Apps diagnostics in this parent skill.
Route active AKS incidents, AKS-specific intake, evidence gathering, and remediation guidance to AKS Troubleshooting.
Route Azure VM RDP/SSH connectivity, NSG/firewall, credential reset, and VM agent troubleshooting to VM Connectivity Troubleshooting.
Route Azure Messaging SDK troubleshooting (Event Hubs, Service Bus) to Messaging Troubleshooting.

Quick Reference

Common Diagnostic Commands

# Check resource health
az resource show --ids RESOURCE_ID
# View activity log
az monitor activity-log list -g RG --max-events 20
# Container Apps logs
az containerapp logs show --name APP -g RG --follow
# Function App logs (query App Insights traces)
az monitor app-insights query --apps APP-INSIGHTS -g RG \
  --analytics-query "traces | where timestamp > ago(1h) | order by timestamp desc | take 50"

AppLens (MCP Tools)

For AI-powered diagnostics, use:

mcp_azure_mcp_applens
  intent: "diagnose issues with <resource-name>"
  command: "diagnose"
  parameters:
    resourceId: "<resource-id>"

Provides:
- Automated issue detection
- Root cause analysis
- Remediation recommendations

Azure Monitor (MCP Tools)

For querying logs and metrics:

mcp_azure_mcp_monitor
  intent: "query logs for <resource-name>"
  command: "logs_query"
  parameters:
    workspaceId: "<workspace-id>"
    query: "<KQL-query>"

See kql-queries.md for common diagnostic queries.

Check Azure Resource Health

Using MCP

mcp_azure_mcp_resourcehealth
  intent: "check health status of <resource-name>"
  command: "get"
  parameters:
    resourceId: "<resource-id>"

Using CLI

# Check specific resource health
az resource show --ids RESOURCE_ID

# Check recent activity
az monitor activity-log list -g RG --max-events 20

References

Files

ATTRIBUTION.mdAdded by AutoGineer983 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md7.3 KiB
references/app-service/README.md7.8 KiB
references/azure-resource-graph.md2.8 KiB
references/container-apps/README.md3.5 KiB
references/functions/README.md3.9 KiB
references/functions/durable.md7.6 KiB
references/functions/triggers.md8.3 KiB
references/kql-queries.md1.3 KiB
scripts/aks-baseline.ps1Script7.4 KiB
scripts/aks-baseline.shScript7.0 KiB
scripts/appservice-diagnostics.ps1Script2.7 KiB
scripts/appservice-diagnostics.shScript3.3 KiB
scripts/containerapp-diagnostics.ps1Script2.5 KiB
scripts/containerapp-diagnostics.shScript3.1 KiB
scripts/pod-evidence.ps1Script6.6 KiB
scripts/pod-evidence.shScript7.1 KiB
scripts/run-ig.ps1Script5.6 KiB
scripts/run-ig.shScript6.5 KiB
scripts/test-messaging-connectivity.ps1Script6.3 KiB
scripts/test-messaging-connectivity.shScript6.8 KiB
troubleshooting/aks/aks-troubleshooting.md9.2 KiB
troubleshooting/aks/general-diagnostics.md2.0 KiB
troubleshooting/aks/load-balancer-and-ingress.md3.6 KiB
troubleshooting/aks/network-policy.md832 B
troubleshooting/aks/networking.md5.5 KiB
troubleshooting/aks/node-issues.md4.7 KiB
troubleshooting/aks/optional-aks-operations.md2.3 KiB
troubleshooting/aks/pod-failures.md7.6 KiB
troubleshooting/aks/references/aks-mcp.md2.3 KiB
troubleshooting/aks/references/command-flows.md4.1 KiB
troubleshooting/aks/references/inspektor-gadget.md7.6 KiB
troubleshooting/aks/references/structured-input-modes.md1.5 KiB
troubleshooting/aks/spot-and-zone-issues.md2.5 KiB
troubleshooting/aks/upgrade-operations.md2.2 KiB
troubleshooting/compute/references/cannot-connect-to-vm.md3.1 KiB
troubleshooting/compute/references/credential-auth-errors.md2.3 KiB
troubleshooting/compute/references/firewall-blocking.md2.3 KiB
troubleshooting/compute/references/network-connectivity.md2.5 KiB
troubleshooting/compute/references/rdp-connectivity.md2.7 KiB
troubleshooting/compute/references/rdp-service-config.md3.2 KiB
troubleshooting/compute/references/ssh-connectivity.md2.9 KiB
troubleshooting/compute/references/vm-agent-not-responding.md3.6 KiB
troubleshooting/compute/vm-troubleshooting.md3.3 KiB
troubleshooting/messaging/README.md1.6 KiB
troubleshooting/messaging/auth-best-practices.md6.1 KiB
troubleshooting/messaging/azure-eventhubs-dotnet.md3.5 KiB
troubleshooting/messaging/azure-eventhubs-java.md3.2 KiB
troubleshooting/messaging/azure-eventhubs-js.md2.7 KiB
troubleshooting/messaging/azure-eventhubs-py.md4.3 KiB
troubleshooting/messaging/azure-servicebus-dotnet.md2.5 KiB
troubleshooting/messaging/azure-servicebus-java.md2.2 KiB
troubleshooting/messaging/azure-servicebus-js.md2.4 KiB
troubleshooting/messaging/azure-servicebus-py.md2.3 KiB
troubleshooting/messaging/service-troubleshooting.md5.1 KiB

references/functions/triggers.md

Trigger & Binding Troubleshooting

Diagnostics for HTTP, Timer, Queue, Blob, Service Bus, Cosmos DB, and Flex Consumption.

HTTP Trigger

Symptom	Cause	Fix
404 on known route	Route template mismatch or function not indexed	Check `route` in `function.json`/attribute; confirm the function loaded via `az functionapp function list`
500 on every request	Unhandled exception in the function	Query `exceptions` in App Insights for the stack trace
408 / timeout	Execution timeout or gateway idle timeout	`functionTimeout` controls execution, but HTTP responses still have a 230-second platform limit. For long work, return 202 with a status endpoint or use Durable HTTP APIs
401/403 unexpected	Function-level auth key mismatch, or Easy Auth intercepting the route	Verify `authLevel`; check `az webapp auth show` if App Service Authentication is enabled

requests
| where toint(resultCode) >= 400
| order by timestamp desc
| take 50

Timer Trigger

Symptom	Cause	Fix
Timer never fires	Invalid NCRONTAB expression	Validate the schedule with an NCRONTAB parser; check `TZ`/`WEBSITE_TIME_ZONE` if the schedule assumes a non-UTC zone
Timer fires twice	`runOnStartup` adds invocations as hosts start, or another app/slot runs the schedule	Set `runOnStartup` to `false` in production and inventory deployments. Normal scale-out isn't the cause: a blob lease allows one scheduled invocation per app
Timer never fires or runs late	Host storage is unavailable, the app is stopped/disabled, or the host ID collides with another app using the same storage	Check `AzureWebJobsStorage`, host storage permissions, `AzureFunctionsWebHost__hostid`, and `Host.Triggers.Timer` traces. Always On applies only to Dedicated plans; Consumption and Flex timers are designed to wake from zero
Missed-run catch-up not happening	Schedule monitoring is disabled	Set `useMonitor` to `true` when catch-up is required. It defaults to `true` for intervals of at least one minute and `false` for more frequent schedules

Queue Trigger

Symptom	Cause	Fix
Message never processed	Poison message after `maxDequeueCount` (default 5) retries	Message moved to `<queue>-poison`; inspect it to find the root cause
Duplicate processing	Host stopped after side effects but before message deletion, or another consumer read the queue	The Functions host renews visibility during an invocation; `visibilityTimeout` controls retry delay after failure. Check host restarts and make side effects idempotent
Function stops triggering	Storage authentication fails	Re-check `AzureWebJobsStorage` and `Host.Listener` traces for `StorageException`

# Peek poison messages
az storage message peek --queue-name "<queue>-poison" --account-name <account> --num-messages 32

After fixing the root cause, verify before bulk-replaying:

Review prior attempts' downstream state/logs and establish a safe, idempotent replay path before re-enqueuing any message.
Re-enqueue one representative poison message (not the whole batch) and confirm it completes successfully without duplicate side effects.
Confirm its dequeueCount stays at 1 (no further retries) and the function's App Insights requests entry shows success == true.
Watch the <queue>-poison queue depth over the next few minutes/hours to confirm it stops growing for that failure signature before replaying the remaining messages in a bounded batch.

Blob Trigger

Symptom	Cause	Fix
Trigger delayed by minutes	Blob-trigger polling (non-Event Grid path) scans the container on a timer	Switch to the Event Grid-based blob trigger (`source: "EventGrid"`) for near-real-time triggering
Trigger never fires for a version	A receipt already exists for that blob path and ETag	Overwriting the blob creates a new ETag and should trigger. To reprocess the same version, delete only its matching receipt after confirming duplicate side effects are safe
Trigger fires for the wrong container	`path` pattern too broad or missing container scoping	Tighten the `path` binding expression (e.g. `samples-workitems/{name}`)

Service Bus Trigger

Symptom	Cause	Fix
Message stuck retrying	`MaxDeliveryCount` exceeded, moved to dead-letter	Inspect the dead-letter sub-queue for the underlying exception
`MessageLockLostException`	Execution exceeds lock renewal, or high prefetch lets locks age before processing	For single-message triggers, reduce work/prefetch or increase `maxAutoLockRenewalDuration` (default 5 minutes). It doesn't apply to batches; batch processing must finish within the entity's lock duration. Use manual renewal only with `autoCompleteMessages: false` and exposed message actions
No messages arriving	SAS key rotated, or namespace network rules block the Functions host	Verify the connection app setting; check namespace firewall/VNet rules if not using a private endpoint

# View dead-letter message contents
# Azure CLI does not support peeking Service Bus dead-letter message bodies directly.
# Use one of the following instead:
#   - Service Bus Explorer in the Azure portal (namespace -> Queues -> <queue> -> Dead-letter)
#   - An Azure Service Bus SDK (.NET, Java, Python, or JavaScript) with a receiver scoped
#     to "<queue>/$DeadLetterQueue", using a peek or receive operation.

Cosmos DB Trigger

Symptom	Cause	Fix
Independent apps receive only part of the feed	Apps share a lease container and prefix, so they load-balance one logical processor	Give each independent workflow a unique `leaseContainerPrefix`, or use a dedicated lease container
No changes delivered	Lease container missing, or `createLeaseContainerIfNotExists` is false without a pre-created container	Verify the lease container exists; grant the identity/connection write access to it
Missing/default fields or deserialization failure	Bound model doesn't match document shape, casing, or schema version	`StartFromBeginning` only controls initial feed position and is ignored after checkpoints exist. Compare the document with the bound type, then inspect it through a supported raw JSON type (`JsonElement`, `string`, or `JObject`)
Feed replays from the start unexpectedly	New lease container, or `StartFromBeginning: true` with no existing leases	Expected on first deployment; set `StartFromBeginning: false` (default) after backfill. It only affects lease creation with no prior checkpoint

For a manually created lease container, use partition key /id. The trigger identity needs read/write access to lease items. Multiple triggers can share that container only when each uses a unique leaseContainerPrefix.

Flex Consumption Specifics

Symptom	Cause	Fix
Cold start despite "always ready" expectation	No always-ready instance for the function's scale group	Configure `http`, `durable`, `blob`, or `function:<FUNCTION_NAME>` with `az functionapp scale config always-ready set`
Can't reach a VNet-integrated resource	VNet integration not configured, or NSG/route table blocking egress	Confirm subnet delegation and outbound rules; enable VNet route-all if all egress must go through the VNet
Deployment succeeds but scaling is capped	Maximum instance count or the regional subscription memory quota is exhausted	Inspect `az functionapp scale config show -g RG -n APP`; check Usage + quotas for the subscription and region
Binding fails after dependency changes	Mixed Functions programming models or incompatible binding-extension versions	Use one programming model and align its binding packages. .NET isolated apps use `Microsoft.Azure.Functions.Worker.Extensions.*`; non-.NET apps using extension bundles should not also install the same binding extensions manually

Integration Testing Trigger Failure Paths

Assert the failure path, not just the happy path:

Queue: force failure; confirm the message reaches <queue>-poison after maxDequeueCount.
Service Bus: exceed lock renewal; confirm retries don't duplicate side effects.
Cosmos DB: omit a required field; assert a clear deserialization error.
HTTP: verify long work returns 202 instead of waiting past the gateway limit.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs a command-line tool

Security

What our scanner noticed· Low risk

Instructions that use the network
Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/skills · .github/plugins/azure-skills/skills/azure-diagnostics · commit 0696600

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from .github/plugins/azure-skills/LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-09

Also distributed in

microsoft/azure-skills

AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-diagnostics.zip

From the author

AutoGineer summary

What it does

When to use it

Advantages

Usage examples

Install

Documentation by Microsoft

Azure Diagnostics

Triggers

Rules

Quick Diagnosis Flow

Troubleshooting Guides by Service

Routing

Quick Reference

Common Diagnostic Commands

AppLens (MCP Tools)

Azure Monitor (MCP Tools)

Check Azure Resource Health

Using MCP

Using CLI

References

Files

references/functions/triggers.md

Trigger & Binding Troubleshooting

HTTP Trigger

Timer Trigger

Queue Trigger

Blob Trigger

Service Bus Trigger

Cosmos DB Trigger

Flex Consumption Specifics

Integration Testing Trigger Failure Paths

Requirements and compatibility

Security

Attribution and licence

Related skills

Observability And Instrumentation

Spark Memory Thermal Ops

Gke Alert Configuration

Application Performance Observability Engineer

Distributed Debugging Devops Troubleshooter

Distributed Tracing

Download ZIP