Azure Troubleshooting Skill: Read-Only Incident Investigation

Where this fits

Your pager goes off at 3 AM: a customer reports an Azure VM is unreachable, and the Resource Health alert shows "degraded." You need to determine whether the platform or your workload is at fault, and you have zero time to write ad-hoc scripts. The azure-troubleshooting skill steps in as a read-only investigator, guiding an agent through Azure CLI commands, Resource Health checks, Activity Log analysis, metrics, and resource logs—then compiles a fact-based report for your incident bridge.

Why agents benefit

• Enforces read-only discipline: The skill never mutates resources, so agents can run safely even during production incidents without risking further damage.
• Structured triage flow: It walks the agent from symptom to root cause—checking Resource Health first, then Activity Logs, metrics, and resource logs—preventing missed steps or circular investigations.
• Platform vs. workload cutover: It explicitly compares Azure platform health signals against your resource's telemetry, giving you the evidence to escalate to Microsoft or fix your own config.
• Multi-service coverage: Handles Azure Firewall, DNS, ExpressRoute, BGP, AKS, App Service, SQL, Cosmos DB, and Entra ID, so one skill covers most incident types.
• Report-ready output: The skill structures findings into a troubleshooting report with timestamps and evidence, saving you from manual transcription.

Practical scenarios

ExpressRoute BGP flapping

An agent uses the skill to pull BGP route table updates and Event Logs from the ExpressRoute circuit, cross-referencing with Azure status to confirm whether the flap is regional or specific to your VNet. It then suggests checking on-premises device logs—without ever touching your production config.

AKS node not ready

When a node shows NotReady, the skill guides the agent through az aks show, node resource health, and kubelet logs via Azure Monitor, isolating whether the issue is a VM-level problem or a Kubernetes control-plane misconfiguration.

App Service intermittent 500s

An agent investigates by pulling App Service metrics, HTTP server logs, and the platform's health events, then compares with recent deployment history from Activity Log to identify a correlation with a code push.

Add it to your agent workflow

Install the skill with the following command:

npx skills add aktsmm/Agent-Skills --skill azure-troubleshooting

Then invoke it with a clear problem statement. For example:

"Azure トラブルシューティング: subscription 1234-5678, resource ID /subscriptions/.../resourceGroups/prod-rg/providers/Microsoft.Compute/virtualMachines/web01, symptom: VM unreachable from internet, occurrence time: 2025-03-14T02:30Z, current user impact: 3 customers affected"

The agent will run the read-only investigation and return a structured report with evidence and a recommended next step.

Compare before adopting

Before making this a permanent part of your agent toolkit, compare these points:

• Quality signals: Check the skill's GitHub repo for recent commits, issue responses, and whether the author actively maintains it (currently 25 stars and a single author).
• Maintenance freshness: Azure CLI and APIs change monthly—verify the skill's commands still work with the latest Azure CLI version.
• Alternatives: Look at other incident-investigation skills that might cover your specific cloud stack or offer more granular metrics.
• Workflow fit: Test it on a non-critical incident first to see if the report format matches your team's incident management process.

Why it is worth tracking

This skill addresses a common pain point—standardizing Azure incident investigation—with a read-only, repeatable methodology. Its low star count suggests early adoption, but the structured approach and clear trigger keywords make it a strong candidate for teams that rely on Azure and want to reduce mean-time-to-resolution. For a deeper look, see the skill's page on OpenAgentSkill. Evaluate it when you need a reliable, non-destructive investigation path for your cloud incidents.