skills.rest
crystalzhangbai
crystalzhangbaiCOMMUNITY
Explore all skills by this author →
GitHub

vm-log-analyzer

Analyzes Azure VM guest OS logs, SAP HANA traces, and packet captures for root cause diagnosis.

Updated Aug 13, 2026
Search Tags:#troubleshooting#log analysis#sosreport#pcap#azure vm#bsod#sap hana
One-click install
npx skills add https://github.com/crystalzhangbai/TS-Agent-Azure --skill vm-log-analyzer-crystalzhangbai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vm-log-analyzer
Source: https://github.com/crystalzhangbai/TS-Agent-Azure/tree/main/bridge/skills/vm-log-analyzer
Command: npx skills add https://github.com/crystalzhangbai/TS-Agent-Azure --skill vm-log-analyzer-crystalzhangbai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pyshark, and includes scripts (resource) and references (resource) components.

What problem does it solve? Diagnosing why an Azure VM rebooted, failed to boot, lost SSH/RDP connectivity, or crashed requires reading scattered guest OS logs, event logs, SAP traces, and packet captures — a slow, error-prone manual process. This Skill applies a senior CSS engineer's mental model to pinpoint root causes from log evidence. ## Core Features & Use Cases - Multi-domain log analysis: Covers Linux syslog/dmesg/journal/waagent/cloud-init, Windows Event Logs/CBS/BSOD bugchecks, SAP HANA/NetWeaver/HSR/Pacemaker traces, and pcap/pcapng network captures. - Format detection and triage: Recognizes sosreport, supportconfig, Inspect IaaS Disk (IID) packages, serial console logs, and engineer pre-analysis files, then routes to the highest-signal log first. - Evidence-based RCA: Builds UTC timelines, correlates events across OS/middleware/app layers, and distinguishes guest-side vs platform-side root causes with verbatim log citations. - Use Case: A customer reports their Linux VM rebooted unexpectedly. Provide the case folder path; the Skill detects the IID package and console log, anchors the reboot timestamp, finds hv_utils: Shutdown request received, and determines whether the shutdown was customer-initiated or platform-driven. ## Quick Start Analyze the logs in my case folder to find out why my Azure VM rebooted unexpectedly yesterday around 14:00 UTC.

Frequently Asked Questions about vm-log-analyzer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find why my Azure VM rebooted unexpectedly?▼

Check the guest logs around the reboot timestamp: on Linux look for hv_utils shutdown requests or kernel panics in /var/log/messages; on Windows check System.evtx for Event 41 (Kernel-Power), Event 6008, and Event 1074. Then confirm guest-side vs platform-side cause before concluding.

How to analyze Windows evtx event logs from an Azure VM?▼

Evtx files are binary and must be converted first using Get-WinEvent -Path with an Id or time filter, or wevtutil epl to export XML. Never scan Security.evtx unfiltered since it defaults to 1 GB and can take 5-10 minutes or run out of memory.

What is an Inspect IaaS Disk (IID) package and how do I read it?▼

IID is an offline snapshot of the VM's OS disk collected via Azure Support Center, containing device_0 with etc/, var/log/ (Linux) or Windows/ and WindowsAzure/ (Windows). Read results.txt top 30 lines first for distro and mount status, and treat most FAILED lines as expected template misses.

Can this analyze pcap packet captures and SAP HANA traces?▼

Yes, it handles pcap/pcapng captures using tshark or pyshark to detect TCP RST, retransmissions, TLS alerts, and DNS failures, plus SAP NetWeaver dev_w traces, HANA nameserver/indexserver traces, HSR replication breaks, and Pacemaker/Corosync fencing events.

Why does log analysis of sosreport fail to find /var/log files?▼

Sosreport uses relative paths without a leading slash, so logs live at var/log/... and config at etc/... inside the extracted directory. Also, var/log/messages in IID packages often exceeds 100 MB, so grep first instead of viewing the whole file.

When should I not use guest log analysis for VM issues?▼

Do not use it for log collection how-to questions, platform-side Kusto queries, or cases with no logs attached. Guest logs alone cannot prove a platform-initiated shutdown; that requires confirming against platform telemetry like ServiceHealing data.

Related Skills

Explore More Software Engineering Skills→
partme-aipartme-ai
610

cloud-azure-vm

Guide Azure Virtual Machine creation, configuration, networking, and management.

Official
Intermediate
jgezelscorpjgezelscorp

azure-kusto

Execute KQL queries against Azure Data Explorer for log analytics.

Community
Advanced
ErtejeonlineErtejeonline

sdk-reference

Look up Even Hub SDK API signatures, types, interfaces, enums, and event models for G2 glasses.

Community
Intermediate
markarnoldutahmarkarnoldutah

azure-resource-health-diagnose

Analyze Azure resource health and diagnose issues from logs and telemetry.

Community
Advanced