VM Inspector for Azure virtual machines (Preview)

The VM Inspector tool helps you troubleshoot issues related to the operating system (OS) that can affect a Windows or Linux virtual machine (VM). It's designed as a self-help diagnostic tool that lets customers, support agents, or third-party personnel who have privileged access collect logs and configuration files directly on the OS disk of an Azure VM. VM Inspector is a fast and secure way for an authorized user to retrieve well-known log files from a VM OS disk to diagnose Guest OS issues.

We recommend that you run VM Inspector and review the diagnostics data before you contact Microsoft Support.

Supported operating systems

VM Inspector is supported on the following operating systems:

Windows

• Windows Server 2022
• Windows Server 2019
• Windows Server 2016
• Windows Server 2012 R2
• Windows Server 2012
• Windows Server 2008 R2
• Windows Server 2008
• Windows 11
• Windows 10
• Windows 8.1
• Windows 8
• Windows 7

Linux

From Linux distributions endorsed on Azure:

• CentOS
• CoreOS
• Debian
• Flatcar Container Linux by Kinvolk
• Azure Linux
• OpenSUSE
• Oracle Linux Server
• Red Hat Enterprise Linux (RHEL)
• SUSE Linux Enterprise Server (SLES)
• Ubuntu

Supported regions

VM Inspector is supported for the following Azure regions:

• Australia East
• East US
• East US2
• North Europe
• SouthCental US
• SouthEast Asia
• UK South
• WestCentral US
• West Europe
• West US2

Unsupported scenarios

• Unmanaged OS disks and VMs
• Encrypted OS disks and VMs
• Ephemeral OS disks and VMs

How VM Inspector works

VM Inspector uses the Microsoft Compute Diagnostic resource provider, which is a back-end Microsoft service that collects the following items from your VM OS disk for diagnostics:

• Event logs
• Configurations
• Settings
• Registry keys

You start by granting access to VM Inspector and running a diagnostic against your selected VM. VM Inspector then makes a connection to the VM-managed disk in Azure blob storage. It uses a predefined manifest to do file collection on the OS disk. After the inspection is finished, the collected files are packed into a .zip file, and they're returned to your storage account for safe keeping.

After you run VM Inspector for the first time, you won't need to select the storage account again. VM Inspector will pin a given storage account at the subscription level with regional affinity. After the account is configured, all supported resource types that are within the same subscription and the same region will share the same storage account. Any changes to the storage configuration entry will affect all supported resource types within the same subscription and the same region.

For more information about Azure virtual machine architectures and OS disks, see the following table:

Get access to VM Inspector

To run VM Inspector for the first time on a virtual machine, get Owner-level access to either the subscription or the virtual machine so that VM Inspector is assigned the Disk Backup Reader role. This role lets VM Inspector do disk inspection of the managed OS disk on your VM. If you have Owner-level access, and you're running VM Inspector for the first time on your VM, you'll be prompted to automatically grant VM Inspector the Disk Backup Reader role.

If you have a lower-access role, such as Contributor, Reader, or User Access Administrator, you must manually update your access level to that of Owner on the VM to proceed.

After you have run VM Inspector once and granted the access needed for disk inspection, you no longer need to have Owner-level permissions. Instead, at the very least, any user must have the following role-based access control (RBAC) permissions assigned:

Access on the virtual machine

• "Microsoft.Compute/virtualMachines/read"
• "Microsoft.Compute/virtualMachines/write"
• "Microsoft.Compute/virtualMachines/redeploy/action"
• "Microsoft.Compute/virtualMachines/restart/action"
• "Microsoft.Compute/virtualMachines/deallocate/action"

The closest built-in role that can be used is Virtual Machine Contributor.

Access on the storage account

• "Microsoft.Storage/storageAccounts/read"
• "Microsoft.Storage/storageAccounts/write"
• "Microsoft.Storage/storageAccounts/listkeys/action"
• "Microsoft.Storage/storageAccounts/listServiceSas/action"

The closest built-in role that can be used is Storage Account Contributor.

For more information about roles, see the following table:

Run VM Inspector on your VM

VM Inspector is available to run for both Windows and Linux VMs. To run VM Inspector, follow these steps:

1. In the Azure portal, search for and select Virtual machines.

2. In the list of virtual machine names, select the VM on which you want to run VM Inspector.

3. In the menu pane for the virtual machine, select VM Inspector (Preview).

4. Select a storage account:

   • To use an existing single storage account to store reports from VM Inspector for more than one virtual machine, select an existing storage account from the list. After you run VM Inspector for the first time, this account will be the pinned storage account for all VMs in this region for this subscription. Make sure that users have access to this storage account before running VM Inspector.

   • To use a new storage account, select Create new, and configure the new storage account in the right-side panel.

     

     Note

     If the Create new option isn't available to select, this is because you don't have the correct level of access to run VM Inspector. You must have at least the Contributor role to run VM Inspector successfully.

5. Select the Run Inspector button or Browse Inspector Report button:

   1. To run a new diagnostic report, select the Run Inspector button.

      A notification is displayed as VM Inspector starts to run.

      Note

      If you can't select and run VM Inspector successfully in this step, refer to the "FAQ" section of this article.

      After the inspector runs, you see a notification that indicates that the inspection run finished. The inspector report will appear automatically in the blade view and will be uploaded to the Azure table in the specified storage account, as follows:

      • The Start Time that the VM Inspector report runs.

      • An output compressed (.zip) file named DiskInspection_yyyy-MM-dd time listed under Diagnostics Report that can be downloaded directly from the portal.

      • The Size of the report in MB.

      • The Action button, to download the report.

        

   2. To view existing reports in the selected diagnostics storage account, select the Browse Diagnostic Reports option.

      

6. Change a storage account (optional):

   To change a diagnostic storage account, select the Settings button on the toolbar, select the storage account, and then select OK. For more information, see the Change VM Inspector settings section.

Select an analysis scenario to run

The following analysis scenarios are available to run from the Azure portal. Choose an analysis to run based on the logs and issues that you're experiencing. For a link to the GitHub documentation of the full list of analysis logs and information, see Manifest Content.

Review the privacy policy and legal terms, and select the check box to acknowledge (required)

To run the diagnostics, you must agree to the legal terms and accept privacy policy.

Change the VM Inspector settings

Reopen the VM Inspector page to change a storage account to run a new VM Inspector report or to view an existing VM Inspector report that's stored in other storage accounts. Use the same storage account for multiple VMs that run VM Inspector. The old reports aren't deleted when you change the storage account. However, they'll no longer be displayed in the Inspector reports list view.

Manage and view the VM Inspector report

Each VM Inspector report might contain multiple files and logs for your troubleshooting. For more information, see the complete list of all the collected VM Inspector report data for Windows or Linux. To download and review the full diagnostics report, select the specific report, and then select Download report to download a .zip file that contains all the logs and files within the report.

To delete one or more VM Inspector reports, select Delete report.

Frequently Asked Questions (FAQ)

Q1. Where are the VM Inspector reports stored?

A1. All VM Inspector reports are stored in your own storage account. To view the storage account information, use the Setting button on the toolbar.

Q2. How do I submit the feedback for VM Inspector?

A2. To submit feedback, select the Feedback button on the toolbar, and then select the Smile or Frown icon, or provide extra feedback to us.

Q3. I ran VM Inspector. Why don't I see any error messages?

A3. If you don't see error messages when you run VM inspector, you don't have the minimum access level to run the tool. To get access, see the Get access to VM Inspector section.

Q4. Why do I have to provide consent to be able to run VM Inspector successfully?

A4. The disk doesn't have the Disk Backup Reader Access role to enable VM Inspector to run successfully. Select the check box for Consent to assign Disk Backup Reader access to Compute Recommendation Service to grant access to the service for Disk Backup Reader Access.

Q5. Does VM Inspector use Credential Scanner to redact any secrets from the logs?

A5. Yes. If you want to be excluded from the redaction, submit your request or reach out to vminspector@microsoft.com.

Resources

• VM Inspector error messages

Next steps

If you need more help with any of the content in this article, or if you have any feedback regarding this feature, contact the Azure experts at vminspector@microsoft.com.

Contact us for help

If you have questions or need help, create a support request, or ask Azure community support. You can also submit product feedback to Azure feedback community.