Azure Diagnostics Skill 安全审计

34351. Start with systematic diagnosis flow362. Use AppLens (MCP) for AI-powered diagnostics when available373. Check resource health before deep-diving into logs384. Select appropriate troubleshooting guide based on service type395. Document findings and attempted remediation steps406. Route AKS incidents to the dedicated AKS troubleshooting document

82section "1. Cluster provisioning state"83run "cluster provisioning state" \84    az aks show -g "$RESOURCE_GROUP" -n "$CLUSTER" ${AZ_SUB_ARGS[@]+"${AZ_SUB_ARGS[@]}"} \85        --query "{name:name, provisioningState:provisioningState, powerState:powerState.code, k8sVersion:currentKubernetesVersion, fqdn:fqdn}" \86        -o table8788# 2. Node pool summary ---------------------------------------------------------89section "2. Node pool summary"90run "node pool summary" \91    az aks nodepool list -g "$RESOURCE_GROUP" --cluster-name "$CLUSTER" ${AZ_SUB_ARGS[@]+"${AZ_SUB_ARGS[@]}"} \92        --query "[].{name:name, mode:mode, count:count, vmSize:vmSize, state:provisioningState, powerState:powerState.code, k8sVersion:orchestratorVersion}" \93        -o table9495# 3. Recent Azure activity -----------------------------------------------------96section "3. Recent Azure activity (last 20 events)"97run "recent activity log" \98    az monitor activity-log list -g "$RESOURCE_GROUP" ${AZ_SUB_ARGS[@]+"${AZ_SUB_ARGS[@]}"} \99        --max-events 20 \100        --query "[].{time:eventTimestamp, operation:operationName.value, status:status.value, resource:resourceId}" \101        -o table102

102103# 4. Node readiness ------------------------------------------------------------104section "4. Node readiness"105run "node readiness" kubectl get nodes -o wide106107# 5. Unhealthy pods ------------------------------------------------------------108# Filter on the READY and STATUS columns (not just pod phase) so container-level109# failures such as CrashLoopBackOff / ImagePullBackOff — which stay in phase110# "Running" — are caught. Terminal pods (Completed/Succeeded) are excluded so111# finished jobs are not falsely flagged.112section "5. Unhealthy pods (CrashLoopBackOff, not Ready, restarting, or bad status)"113ALL_PODS="$(kubectl get pods -A -o wide 2>/dev/null)"114if [ -z "$ALL_PODS" ]; then

134135# 6. kube-system health --------------------------------------------------------136section "6. kube-system health"137run "kube-system pods" kubectl get pods -n kube-system -o wide138139# 7. Recent warning events -----------------------------------------------------140section "7. Recent warning events (last 40, sorted by time)"141run "warning events" bash -c \142    "set -o pipefail; kubectl get events -A --field-selector=type=Warning --sort-by=.lastTimestamp 2>/dev/null | tail -n 40"143144# 8. Namespace pod overview (optional) ----------------------------------------145if [ -n "$NAMESPACE" ]; then146    section "8. Pods in namespace '$NAMESPACE'"147    run "pods in namespace $NAMESPACE" kubectl get pods -n "$NAMESPACE" -o wide148fi

6869echo "--- Recent Deployments (last 3) ---"70az webapp deployment list -n "$APP" -g "$RG" "${SUB_ARGS[@]}" \71    --query "[:3].{id:id, status:status, time:end_time}" -o table || echo "(failed to list deployments)"72echo ""7374echo "--- App Settings (names only) ---"75az webapp config appsettings list -n "$APP" -g "$RG" "${SUB_ARGS[@]}" \76    --query "[].name" -o tsv || echo "(failed to list app settings)"77echo ""7879echo "--- Custom Domains ---"80az webapp config hostname list -g "$RG" --webapp-name "$APP" "${SUB_ARGS[@]}" -o table || echo "(failed to list custom domains)"81echo ""

6667echo "--- Registry Config ---"68az containerapp show --name "$APP" -g "$RG" "${SUB_ARGS[@]}" \69    --query "properties.configuration.registries" || echo "(failed to read registry config)"70echo ""7172echo "--- Ingress Config ---"73az containerapp show --name "$APP" -g "$RG" "${SUB_ARGS[@]}" \74    --query "properties.configuration.ingress" || echo "(failed to read ingress config)"75echo ""7677echo "--- Recent Logs (last 20 lines) ---"78az containerapp logs show --name "$APP" -g "$RG" "${SUB_ARGS[@]}" --tail 20 || echo "(failed to read logs)"79echo ""

111112## Guardrails113114- default to read-only diagnostics115- do not restart, delete, cordon, drain, scale, upgrade, or reconfigure resources unless the user explicitly asks for remediation116- do not conclude root cause without quoting the evidence that supports it117

2829## Guardrails3031- Default to read-only diagnostics; quote evidence before concluding root cause.32- Do not run extension-backed commands (`az vm user update`, `az vm user reset-ssh`, `az vm user reset-remote-desktop`, `az vm run-command invoke`) until [Pre-Flight Safety Checks](references/cannot-connect-to-vm.md#pre-flight-safety-checks) pass.33- Do not restart, redeploy, deallocate, or delete unless the user explicitly approves remediation.34- If multiple issues appear, fix network-layer blockers before agent-dependent fixes.35