Note
Azure Diagnostics is the component used to collect performance counters and other statistics from Azure Virtual Machines, Virtual Machine Scale Sets, Service Fabric, and Cloud Services. This page is only relevant if you are using one of these services.
Azure Diagnostics is used with other Microsoft diagnostics products like Azure Monitor, Application Insights, and Log Analytics.
This schema defines the possible values you can use to initialize diagnostic configuration settings when the diagnostics monitor starts.
Download the public configuration file schema definition by executing the following PowerShell command:
(Get-AzureServiceAvailableExtension -ExtensionName 'PaaSDiagnostics' -ProviderNamespace 'Microsoft.Azure.Diagnostics').PublicConfigurationSchema | Out-File –Encoding utf8 -FilePath 'C:\temp\WadConfig.xsd'
For more information about using Azure Diagnostics, see Enabling Diagnostics in Azure Cloud Services.
Example of the diagnostics configuration file
The following example shows a typical diagnostics configuration file:
<?xml version="1.0" encoding="utf-8"?>
<PublicConfig xmlns="http://schemas.microsoft.com/ServiceHosting/2010/10/DiagnosticsConfiguration">
<WadCfg>
<DiagnosticMonitorConfiguration overallQuotaInMB="10000">
<PerformanceCounters scheduledTransferPeriod="PT1M">
<PerformanceCounterConfiguration counterSpecifier="\Processor(_Total)\% Processor Time" sampleRate="PT1M" unit="percent" />
</PerformanceCounters>
<Directories scheduledTransferPeriod="PT5M">
<IISLogs containerName="iislogs" />
<FailedRequestLogs containerName="iisfailed" />
<DataSources>
<DirectoryConfiguration containerName="mynewprocess">
<Absolute path="C:\MyNewProcess" expandEnvironment="false" />
</DirectoryConfiguration>
<DirectoryConfiguration containerName="badapp">
<Absolute path="%SYSTEMDRIVE%\BadApp" expandEnvironment="true" />
</DirectoryConfiguration>
<DirectoryConfiguration containerName="goodapp">
<LocalResource name="Skippy" relativePath="..\PeanutButter"/>
</DirectoryConfiguration>
</DataSources>
</Directories>
<EtwProviders>
<EtwEventSourceProviderConfiguration provider="MyProviderClass" scheduledTransferPeriod="PT5M">
<Event id="0"/>
<Event id="1" eventDestination="errorTable"/>
<DefaultEvents />
</EtwEventSourceProviderConfiguration>
<EtwManifestProviderConfiguration provider="5974b00b-84c2-44bc-9e58-3a2451b4e3ad" scheduledTransferLogLevelFilter="Information" scheduledTransferPeriod="PT2M">
<Event id="0"/>
<DefaultEvents eventDestination="defaultTable"/>
</EtwManifestProviderConfiguration>
</EtwProviders>
<WindowsEventLog scheduledTransferPeriod="PT5M">
<DataSource name="System!*[System[Provider[@Name='Microsoft Antimalware']]]"/>
<DataSource name="System!*[System[Provider[@Name='NTFS'] and (EventID=55)]]" />
<DataSource name="System!*[System[Provider[@Name='disk'] and (EventID=7 or EventID=52 or EventID=55)]]" />
</WindowsEventLog>
<CrashDumps containerName="wad-crashdumps" directoryQuotaPercentage="30" dumpType="Mini">
<CrashDumpConfiguration processName="mynewprocess.exe" />
<CrashDumpConfiguration processName="badapp.exe"/>
</CrashDumps>
</DiagnosticMonitorConfiguration>
</WadCfg>
</PublicConfig>
Diagnostics Configuration Namespace
The XML namespace for the diagnostics configuration file is:
http://schemas.microsoft.com/ServiceHosting/2010/10/DiagnosticsConfiguration
PublicConfig Element
Top-level element of the diagnostics configuration file. The following table describes the elements of the configuration file.
| Element Name | Description |
|---|---|
| WadCfg | Required. Configuration settings for the telemetry data to be collected. |
| StorageAccount | The name of the Azure Storage account to store the data in. This may also be specified as a parameter when executing the Set-AzureServiceDiagnosticsExtension cmdlet. |
| LocalResourceDirectory | The directory on the virtual machine to be used by the Monitoring Agent to store event data. If not set, the default directory is used: For a Worker/web role: C:\Resources\<guid>\directory\<guid>.<RoleName.DiagnosticStore\For a Virtual Machine: C:\WindowsAzure\Logs\Plugins\Microsoft.Azure.Diagnostics.IaaSDiagnostics\<WADVersion>\WAD<WADVersion>Required attributes are: - path - The directory on the system to be used by Azure Diagnostics. - expandEnvironment - Controls whether environment variables are expanded in the path name. |
WadCFG Element
Defines configuration settings for the telemetry data to be collected. The following table describes child elements:
| Element name | Description |
|---|---|
| DiagnosticMonitorConfiguration | Required. Optional attributes are: - overallQuotaInMB - The maximum amount of local disk space that may be consumed by the various types of diagnostic data collected by Azure Diagnostics. The default setting is 5120MB. - useProxyServer - Configure Azure Diagnostics to use the proxy server settings as set in IE settings. |
| CrashDumps | Enable collection of crash dumps. Optional attributes are: - containerName - The name of the blob container in your Azure Storage account to be used to store crash dumps. - crashDumpType - Configures Azure Diagnostics to collect Mini or Full crash dumps. - directoryQuotaPercentage- Configures the percentage of overallQuotaInMB to be reserved for crash dumps on the VM. |
| DiagnosticInfrastructureLogs | Enable collection of logs generated by Azure Diagnostics. The diagnostic infrastructure logs are useful for troubleshooting the diagnostics system itself. Optional attributes are: - scheduledTransferLogLevelFilter - Configures the minimum severity level of the logs collected. - scheduledTransferPeriod - The interval between scheduled transfers to storage rounded up to the nearest minute. The value is an XML “Duration Data Type.” |
| Directories | Enables the collection of the contents of a directory, IIS failed access request logs and/or IIS logs. Optional attribute: scheduledTransferPeriod - The interval between scheduled transfers to storage rounded up to the nearest minute. The value is an XML “Duration Data Type.” |
| EtwProviders | Configures collection of ETW events from EventSource and/or ETW Manifest based providers. |
| Metrics | This element enables you to generate a performance counter table that is optimized for fast queries. Each performance counter that is defined in the PerformanceCounters element is stored in the Metrics table in addition to the Performance Counter table. Required attribute: resourceId - This is the resource ID of the Virtual Machine you are deploying Azure Diagnostics to. Get the resourceID from the Azure portal. Select Browse -> Resource Groups -> |
| PerformanceCounters | Enables the collection of performance counters. Optional attribute: scheduledTransferPeriod - The interval between scheduled transfers to storage rounded up to the nearest minute. Value is an XML “Duration Data Type”. |
| WindowsEventLog | Enables the collection of Windows Event Logs. Optional attribute: scheduledTransferPeriod - The interval between scheduled transfers to storage rounded up to the nearest minute. Value is an XML “Duration Data Type”. |
CrashDumps Element
Enables collection of crash dumps. The following table describes child elements:
| Element Name | Description |
|---|---|
| CrashDumpConfiguration | Required. Required attribute: processName - The name of the process you want Azure Diagnostics to collect a crash dump for. |
| crashDumpType | Configures Azure Diagnostics to collect mini or full crash dumps. |
| directoryQuotaPercentage | Configures the percentage of overallQuotaInMB to be reserved for crash dumps on the VM. |
Directories Element
Enables the collection of the contents of a directory, IIS failed access request logs and/or IIS logs. The following table describes child elements:
| Element Name | Description |
|---|---|
| DataSources | A list of directories to monitor. |
| FailedRequestLogs | Including this element in the configuration enables collection of logs about failed requests to an IIS site or application. You must also enable tracing options under system.WebServer in Web.config. |
| IISLogs | Including this element in the configuration enables the collection of IIS logs: containerName - The name of the blob container in your Azure Storage account to be used to store the IIS logs. |
DataSources Element
A list of directories to monitor. The following table describes child elements:
| Element Name | Description |
|---|---|
| DirectoryConfiguration | Required. Required attribute: containerName - The name of the blob container in your Azure Storage account to be used to store the log files. |
DirectoryConfiguration Element
DirectoryConfiguration may include either the Absolute or LocalResource element but not both. The following table describes child elements:
| Element Name | Description |
|---|---|
| Absolute | The absolute path to the directory to monitor. The following attributes are required: - Path - The absolute path to the directory to monitor. - expandEnvironment - Configures whether environment variables in Path are expanded. |
| LocalResource | The path relative to a local resource to monitor. Required attributes are: - Name - The local resource that contains the directory to monitor - relativePath - The path relative to Name that contains the directory to monitor |
EtwProviders Element
Configures collection of ETW events from EventSource and/or ETW Manifest based providers. The following table describes child elements:
| Element Name | Description |
|---|---|
| EtwEventSourceProviderConfiguration | Configures collection of events generated from EventSource Class. Required attribute: provider - The class name of the EventSource event. Optional attributes are: - scheduledTransferLogLevelFilter - The minimum severity level to transfer to your storage account. - scheduledTransferPeriod - The interval between scheduled transfers to storage rounded up to the nearest minute. Value is an XML Duration Data Type. |
| EtwManifestProviderConfiguration | Required attribute: provider - The GUID of the event provider Optional attributes are: - scheduledTransferLogLevelFilter - The minimum severity level to transfer to your storage account. - scheduledTransferPeriod - The interval between scheduled transfers to storage rounded up to the nearest minute. Value is an XML Duration Data Type. |
EtwEventSourceProviderConfiguration Element
Configures collection of events generated from EventSource Class. The following table describes child elements:
| Element Name | Description |
|---|---|
| DefaultEvents | Optional attribute: eventDestination - The name of the table to store the events in |
| Event | Required attribute: id - The id of the event. Optional attribute: eventDestination - The name of the table to store the events in |
EtwManifestProviderConfiguration Element
The following table describes child elements:
| Element Name | Description |
|---|---|
| DefaultEvents | Optional attribute: eventDestination - The name of the table to store the events in |
| Event | Required attribute: id - The id of the event. Optional attribute: eventDestination - The name of the table to store the events in |
Metrics Element
Enables you to generate a performance counter table that is optimized for fast queries. The following table describes child elements:
| Element Name | Description |
|---|---|
| MetricAggregation | Required attribute: scheduledTransferPeriod - The interval between scheduled transfers to storage rounded up to the nearest minute. Value is an XML Duration Data Type. |
PerformanceCounters Element
Enables the collection of performance counters. The following table describes child elements:
| Element Name | Description |
|---|---|
| PerformanceCounterConfiguration | The following attributes are required: - counterSpecifier - The name of the performance counter. For example, \Processor(_Total)\% Processor Time. To get a list of performance counters on your host run the command typeperf.- sampleRate - How often the counter should be sampled. Optional attribute: unit - The unit of measure of the counter. |
PerformanceCounterConfiguration Element
The following table describes child elements:
| Element Name | Description |
|---|---|
| annotation | Required attribute: displayName - The display name for the counter Optional attribute: locale - The locale to use when displaying the counter name |
WindowsEventLog Element
The following table describes child elements:
| Element Name | Description |
|---|---|
| DataSource | The Windows Event logs to collect. Required attribute: name - The XPath query describing the windows events to be collected. For example: Application!*[System[(Level >= 3)]], System!*[System[(Level <=3)]], System!*[System[Provider[@Name='Microsoft Antimalware']]], Security!*[System[(Level >= 3]]To collect all events, specify “*”. |
