Azure VM Inspector: Guest OS Evidence for Troubleshooting

Yes, Azure VM Inspector collects guest OS evidence to help troubleshoot Azure VMs. It captures a snapshot of the guest OS configuration, running processes, and recent event logs without requiring an agent to be installed on the VM. This article explains how VM Inspector works, what evidence it gathers, and how to use it effectively.

What Is Azure VM Inspector?

Azure VM Inspector is a diagnostic tool built into the Azure portal that collects a point-in-time snapshot of a VM’s guest OS state. It is available for both Windows and Linux VMs and does not require installing any extra software on the VM. The tool is designed to help you troubleshoot issues like boot failures, configuration errors, and performance problems by giving you a detailed view of what the OS looked like at the moment of inspection.

VM Inspector is part of the broader Azure troubleshooting suite, but it is distinct from other tools like Boot Diagnostics or Serial Console. While those tools focus on the boot process or console output, VM Inspector digs into the OS itself—registry keys, services, drivers, event logs, and more. It is especially useful when a VM is unresponsive or failing to start, because it can capture evidence even when the VM is not fully operational.

How VM Inspector Collects Guest OS Evidence

When you run VM Inspector, Azure performs a series of read-only operations against the VM’s OS disk. The tool does not execute any code on the VM; instead, it attaches the OS disk to a hidden, temporary VM in the same region and mounts it read-only. This allows the inspector to access the file system and registry hives without altering the original disk.

The collection process typically takes a few minutes, depending on the size of the disk and the amount of data. After the snapshot is captured, the temporary VM is deleted, and the original disk is returned to its state. The evidence is then presented in a structured report in the Azure portal, which you can download as a ZIP file for further analysis.

What Evidence Does VM Inspector Collect?

The exact set of data collected varies by operating system, but generally includes:

• System and application event logs (Windows) or syslog entries (Linux)
• Registry hives on Windows, including SYSTEM, SOFTWARE, and SAM
• Services and drivers configuration and status
• Network configuration (IP addresses, DNS settings, firewall rules)
• Running processes and startup commands (Linux)
• Disk and partition information
• Recent error messages and crash dumps if present

For Windows VMs, the inspector also collects the contents of the C:\Windows\Minidump folder if it exists, which can contain memory dumps from blue screen errors. For Linux VMs, it gathers the output of commands like dmesg and journalctl to capture kernel messages and system logs.

When to Use VM Inspector vs. Other Azure Tools

VM Inspector is not the first tool you should reach for in every situation. Here is a quick comparison to help you choose:

• Boot Diagnostics – Use when the VM fails to boot and you need to see the boot screen or UEFI output. It captures screenshots and serial logs.
• Serial Console – Use when you need interactive access to the VM before the OS is fully loaded, such as to run recovery commands.
• VM Inspector – Use when the VM is running but misbehaving, or when you need a deep dive into the OS configuration without logging in. It is also useful when you cannot RDP or SSH into the VM.

In practice, many troubleshooting workflows start with Boot Diagnostics to see if the VM is reaching the OS, then move to VM Inspector to examine the OS state if boot succeeds but the VM is unstable.

How to Run VM Inspector on a VM

Running VM Inspector is straightforward:

1. Open the Azure portal and navigate to your VM.
2. In the left menu, under Help, select VM Inspector.
3. Click Run Inspector and choose a storage account where the report will be saved. If you don’t have one, you can create it on the fly.
4. Wait for the inspection to complete. This can take 5–15 minutes depending on the VM size and disk load.
5. Once done, you’ll see a summary of findings, and you can download the full report as a ZIP file.

The report contains a folder structure with text files and XML files that you can open in any text editor or log analyzer. There is no built-in viewer for the raw files, so you’ll need to parse them manually or use a tool like Log Parser.

Common Problems and Limitations

VM Inspector is powerful, but it has a few limitations you should know about:

• It is read-only – You cannot use it to change anything on the VM. It only collects evidence.
• It does not collect memory dumps – Only the minidump folder on Windows is captured, not full memory contents.
• It may miss transient issues – Because it is a snapshot, it won’t capture problems that occur only during a specific event.
• It requires a storage account – The report is saved to a blob container, so you need an existing storage account or permission to create one.
• It is not available for all VM sizes – Some very small or specialized VM sizes may not support the temporary VM attachment.

If the inspection fails, common causes include the VM being in a deallocated state, the OS disk being encrypted with a key you don’t have access to, or the storage account being in a different region than the VM.

Frequently Asked Questions

Does VM Inspector require an agent to be installed on the VM?
No, VM Inspector does not install any software on the VM. It works by attaching the OS disk to a temporary VM in the background, so it works even if the VM is completely unresponsive.

Can I run VM Inspector on a VM that is not booting?
Yes, you can run it on a VM that is in a failed or stopped state, as long as the OS disk is available. The inspector will still collect the evidence from the disk, which can help diagnose why it won’t boot.

How long does the inspection take?
Typically 5 to 15 minutes, depending on the size of the OS disk and the amount of data. Larger disks with more logs take longer.

Is VM Inspector free to use?
The tool itself is free, but you will incur standard storage costs for the report saved to your storage account. The temporary VM used for inspection is also billed at the standard rate for the few minutes it runs.

Can I use VM Inspector on Linux VMs?
Yes, VM Inspector supports both Windows and Linux VMs. The evidence collected is different for each OS, but the process is the same.

What if the inspection fails?
Check that the VM is not deallocated, that the storage account is in the same region, and that you have permissions to read the OS disk. If the issue persists, you can try using Boot Diagnostics or Serial Console as alternatives.

Related

• Turn Old TV Into Smart TV: Step-by-Step
• Evaluate Office Campus Before Lease
• Propose Documentation Fixes from Code Changes