azure-troubleshoot

timbuchinger's avatarfrom timbuchinger

Troubleshoot Azure using tool-first access, falling back to Azure CLI when necessary. Focus on Virtual Machines, AKS, Azure Container Registry, Storage Accounts, and Log Analytics.

⭐0stars🔀0forks📁View on GitHub🕐Updated Dec 28, 2025
[Incident Response]

When & Why to Use This Skill

The Azure Troubleshooting skill is a specialized diagnostic tool designed to accelerate the resolution of cloud infrastructure issues. By prioritizing tool-based queries and Kusto (KQL) analysis over manual CLI commands, it provides deep visibility into Virtual Machines, Azure Kubernetes Service (AKS), Container Registry, and Storage Accounts, ensuring minimal downtime through targeted remediation advice and automated log analysis.

Use Cases

  • Diagnosing AKS Cluster Failures: Rapidly identify pod scheduling issues, image pull errors, or container crashes by querying KubeEvents and KubePodInventory.
  • Virtual Machine Recovery: Troubleshoot boot failures and NIC misconfigurations by inspecting diagnostic logs and querying the Heartbeat table for status updates.
  • Storage Access Debugging: Resolve 'Permission Denied' or 'Object Not Found' errors in Azure Storage by analyzing StorageBlobLogs and validating SAS token configurations.
  • ACR Authentication Troubleshooting: Investigate failed container image push/pull operations by auditing Activity Logs for RBAC or token expiration issues.
  • Performance Bottleneck Analysis: Use scoped KQL queries in Log Analytics to identify resource constraints and performance trends across core Azure services.
nameazure-troubleshoot
description"Troubleshoot Azure using tool-first access, falling back to Azure CLI when necessary. Focus on Virtual Machines, AKS, Azure Container Registry, Storage Accounts, and Log Analytics."

Azure Troubleshooting Skill

General Guidance

Always use tool-based queries first to fetch logs, metrics, and diagnostic data.
Only fall back to Azure CLI for deeper or unsupported inspection.

Investigations should:

  1. Use Log Analytics Kusto queries with proper scoping
  2. Use Activity Logs to identify failures
  3. Use metrics when diagnosing performance issues
  4. Provide minimal, targeted remediation advice

Core Services Covered

Virtual Machines

Common issues:

  • Boot failures
  • OS/disk failures
  • NIC/IP misconfiguration

Investigations:

  • Inspect boot diagnostics logs
  • Query Heartbeat table for VM status
  • Check Activity Logs for failed start/stop operations

AKSS

Common issues:

  • Pod scheduling failures
  • Node pressure
  • Image pull errors (ACR auth)
  • Container crashes

Investigations:

  • Query KubeEvents
  • Query KubePodInventory
  • Inspect ContainerLog

Azure Container Registry (ACR))

Common issues:

  • Permission denied (RBAC)
  • Token expiration

Investigations:

  • Query Activity Logs for push/write or pull/read failures
  • Check repository event logs

Storage Accountss

Common issues:

  • Firewall-restricted access
  • SAS token expiration
  • Object not found

Investigations:

  • Query StorageBlobLogs
  • Validate configuration + permissions

Log Analytics

Best practices:

  • Always filter by _ResourceId
  • Narrow time range
  • Query only the tables relevant to the service

Workflow

  1. Identify target service
  2. Query Log Analytics with scoped KQL
  3. Query Activity Logs
  4. Review metrics
  5. Interpret patterns
  6. Recommend targeted fixes