What is Azure Diagnostics extension

The Azure Diagnostics extension is an agent within Azure that enables the collection of diagnostic data on a deployed application. You can use the diagnostics extension from a number of different sources. Currently supported are Azure Cloud Service (classic) Web and Worker Roles, Virtual Machines, Virtual Machine scale sets, and Service Fabric. Other Azure services have different diagnostics methods. See Overview of monitoring in Azure.

Linux Agent

A Linux version of the extension is available for Virtual Machines running Linux. The statistics collected and behavior vary from the Windows version.

Data you can collect

The Azure Diagnostics extension can collect the following types of data:

Data Source Description
Performance counter metrics Operating System and custom performance counters
Application logs Trace messages written by your application
Windows Event logs Information sent to the Windows event logging system
.NET EventSource logs Code writing events using the .NET EventSource class
IIS Logs Information about IIS web sites
Manifest based ETW logs Event Tracing for Windows events generated by any process.(1)
Crash dumps (logs) Information about the state of the process if an application crashes
Custom error logs Logs created by your application or service
Azure Diagnostic infrastructure logs Information about Azure Diagnostics itself

(1) To get a list of ETW providers, run c:\Windows\System32\logman.exe query providers in a console window on the machine you'd like to gather information from.

Data storage

The extension stores its data in an Azure Storage account that you specify.

You can also send it to Application Insights.

Another option is to stream it to Event Hub, which then allows you to send it to non-Azure monitoring services.

You also have the choice of sending your data to Azure Monitor metrics time-series database. At this time, this sink is only applicable to Performance Counters. It enables you to send performance counters in as custom metrics. This feature is in Preview. The Azure Monitor sink supports:

  • Retrieving all performance counters sent to Azure Monitor via the Azure Monitor metrics APIs.
  • Alerting on all performance counters sent to Azure Monitor via the metric alerts in Azure Monitor
  • Treating wildcard operator in performance counters as the "Instance" dimension on your metric. For example if you collected the "LogicalDisk(*)/DiskWrites/sec" counter you would be able to filter and split on the "Instance" dimension to plot or alert on the Disk Writes/sec for each Logical Disk on the VM (for example, C:)

To learn more on how to configure this sink, refer to the Azure diagnostics schema documentation.


Each of the options above may incur costs. Be sure to research them to avoid unexpected bills. Application Insights, Event hub, and Azure Storage have separate costs associated with ingestion and the time stored. In particular, Azure Storage will hold any data forever so you may want to purge older data after a certain time period to keep your costs down.

Versioning and configuration schema

See Azure Diagnostics Version History and Schema.

Next steps

Choose which service you're trying to collect diagnostics on and use the following articles to get started. Use the general Azure diagnostics links for reference for specific tasks.

Cloud Services using Azure Diagnostics

For more advanced topics, see

Virtual Machines

For more advanced topics, see

Service Fabric

Get started at Monitor a Service Fabric application. Many other Service Fabric diagnostics articles are available in the navigation tree on the left once you get to this article.

General articles