Azure Virtual Machines

Azure Virtual Machine Diagnostics

Diagnostics for Azure Virtual Machines provides real‑time insight into the health and performance of your VMs. It captures metrics, logs, and crash dumps to help you troubleshoot issues faster.

Table of Contents ▼

Overview

The Diagnostics extension runs inside the VM and streams performance counters, event logs, and custom logs to an Azure Storage account or Log Analytics workspace.

Prerequisites

Azure subscription with Contributor rights on the target resource group.
Azure Storage account (or Log Analytics workspace) to store diagnostics data.
VM running a supported OS (Windows Server 2016+, Ubuntu 18.04+, etc.).

Enable Diagnostics Extension

You can enable the extension via Azure Portal, Azure CLI, or PowerShell. Below is an Azure CLI example:

az vm extension set \
  --publisher Microsoft.Azure.Diagnostics \
  --name LinuxDiagnostic \
  --resource-group MyResourceGroup \
  --vm-name MyLinuxVM \
  --settings '{"storageAccount":"mydiagstorage"}'

Configuration Settings

Configure the extension using a JSON settings file. The most common sections are metrics, logs, and performanceCounters.

Collecting Data

Once enabled, the extension uploads data according to the schedule defined in the config. To view the data:

Navigate to the Azure Storage account → Containers → diagnostics-<vmname>.
Or open Log Analytics and run queries against the Heartbeat and Perf tables.

Best Practices

Store diagnostics data in a dedicated storage account to isolate costs.
Enable only the necessary performance counters to reduce overhead.
Set retention policies in Log Analytics to manage data lifecycle.
Use Azure Monitor alerts based on diagnostic metrics for proactive monitoring.

Sample Configuration File

{
  "storageAccount": "mydiagstorage",
  "storageAccountKey": "REDACTED",
  "metrics": {
    "resourceId": "/subscriptions/xxxx/resourceGroups/MyRG/providers/Microsoft.Compute/virtualMachines/MyVM",
    "interval": "PT1M",
    "performanceCounters": [
      {
        "counterSpecifier": "\\Processor(_Total)\\% Processor Time",
        "sampleRate": "PT1M",
        "unit": "Percent"
      },
      {
        "counterSpecifier": "\\Memory\\Available Mbytes",
        "sampleRate": "PT1M",
        "unit": "Megabytes"
      }
    ]
  },
  "logs": {
    "syslog": {
      "facilityNames": ["auth","authpriv","daemon"],
      "logLevel": "INFO",
      "schedule": { "frequency": "PT5M" }
    }
  }
}

FAQ

How often does the extension upload data?

Upload frequency is defined in the schedule.frequency property. Common values are PT1M (1 minute) or PT5M (5 minutes).

Can I disable diagnostics for a specific VM?

Yes. Remove the extension using az vm extension delete or disable it from the Azure Portal.

Microsoft Docs