Azure Troubleshooting Skill

General Guidance

Always use tool-based queries first to fetch logs, metrics, and diagnostic data.
Only fall back to Azure CLI for deeper or unsupported inspection.

Investigations should:

1. Use Log Analytics Kusto queries with proper scoping
2. Use Activity Logs to identify failures
3. Use metrics when diagnosing performance issues
4. Provide minimal, targeted remediation advice

---

Core Services Covered

Virtual Machines

Common issues:

• Boot failures
• OS/disk failures
• NIC/IP misconfiguration

Investigations:

• Inspect boot diagnostics logs
• Query Heartbeat table for VM status
• Check Activity Logs for failed start/stop operations

AKSS

Common issues:

• Pod scheduling failures
• Node pressure
• Image pull errors (ACR auth)
• Container crashes

Investigations:

• Query KubeEvents
• Query KubePodInventory
• Inspect ContainerLog

Azure Container Registry (ACR))

Common issues:

• Permission denied (RBAC)
• Token expiration

Investigations:

• Query Activity Logs for push/write or pull/read failures
• Check repository event logs

Storage Accountss

Common issues:

• Firewall-restricted access
• SAS token expiration
• Object not found

Investigations:

• Query StorageBlobLogs
• Validate configuration + permissions

Log Analytics

Best practices:

• Always filter by _ResourceId
• Narrow time range
• Query only the tables relevant to the service

---

Workflow

1. Identify target service
2. Query Log Analytics with scoped KQL
3. Query Activity Logs
4. Review metrics
5. Interpret patterns
6. Recommend targeted fixes