Updated text

Author: ronmiab

azure-local/manage/disconnected-operations-on-demand-logs.md

@@ -8,53 +8,53 @@ ms.date: 08/06/2025
 ai-usage: ai-assisted
 ---
 
-# Collect logs on demand with Azure Local disconnected operations PowerShell module
+# Collect logs on demand with the Azure Local disconnected operations PowerShell module
 
 ::: moniker range=">=azloc-2506"
 
-This article explains how to collect logs on demand for Azure Local disconnected operations using the PowerShell module. Learn how to provide logs for troubleshooting and support when Azure Local operates in disconnected mode.
+This article explains how to collect logs on demand for Azure Local disconnected operations by using the PowerShell module. You learn how to provide logs for troubleshooting and support when Azure Local operates in disconnected mode.
 
 [!INCLUDE [IMPORTANT](../includes/disconnected-operations-preview.md)]
 
 ## Overview
 
-Log collection is essential for diagnosing and troubleshooting issues in Azure Local disconnected operations. Use this feature to provide logs to Microsoft support. The logs collected include information about the Azure Local disconnected operations environment, such as the management endpoint, integrated runtime, and other components. Note, during the process of collecting logs, you might encounter errors due to various environmental and tooling limitations.
+Log collection is essential for diagnosing and troubleshooting issues in Azure Local disconnected operations. Use this feature to give logs to Microsoft support. The logs include information about the Azure Local disconnected operations environment, like the management endpoint, integrated runtime, and other components. During log collection, you might see errors because of different environmental or tooling limitations.
 
 ## Supported scenarios
 
 The following on-demand scenarios are supported for log collection:
 
 | Scenarios for log collection             | How to collect logs                    |
 |------------------------------------------|----------------------------------------|
-| [Use on-demand direct log collection](#log-collection-when-connected-to-azure-with-an-accessible-management-endpoint) when an on-premises device with Azure Local disconnected operations is connected to Azure and the management endpoint for disconnected operations is accessible. | Trigger log collection with cmdlet `Invoke-ApplianceLogCollection`.<br></br>**Prerequisite**: Setup observability configuration using the cmdlet: `Set-ApplianceObservabilityConfiguration`. |
-| [Use on-demand indirect log collection](#log-collection-for-a-disconnected-environment-with-an-accessible-management-endpoint) when an on-premises device using Azure Local disconnected operations doesn't have a connection to Azure, but the management endpoint for disconnected operations is accessible. | Trigger log collection with cmdlet `Invoke-ApplianceLogCollectionAndSaveToShareFolder`.<br></br> After the `Invoke-ApplianceLogCollectionAndSaveToShareFolder` step, use the `Send-DiagnosticData` cmdlet to upload the copied data logs from the file share to Microsoft.  |
-| [Use on-demand fallback log collection](#log-collection-when-the-management-endpoint-is-inaccessible) when the management endpoint for disconnected operations isn't accessible or the integrated runtime disconnected operations with Azure Local virtual machine (VM) is down. | Logs are collected after shutting down the disconnected operations with Azure Local VM, mounting and unlocking virtual hard disks (VHDs) and copying logs using the `Copy-DiagnosticData` cmdlet from mounted VHDs into a local, user-defined location.<br></br> Use the `Send-DiagnosticData` cmdlet to manually send diagnostic data to Microsoft. |
+| [Use on-demand direct log collection](#log-collection-when-connected-to-azure-with-an-accessible-management-endpoint) when an on-premises device with Azure Local disconnected operations is connected to Azure and the management endpoint for disconnected operations is accessible. | Trigger log collection with the `Invoke-ApplianceLogCollection` cmdlet.<br></br>**Prerequisite**: Set up observability configuration using the `Set-ApplianceObservabilityConfiguration` cmdlet. |
+| [Use on-demand indirect log collection](#log-collection-for-a-disconnected-environment-with-an-accessible-management-endpoint) when an on-premises device using Azure Local disconnected operations doesn't have a connection to Azure, but the management endpoint for disconnected operations is accessible. | Trigger log collection with the `Invoke-ApplianceLogCollectionAndSaveToShareFolder` cmdlet.<br></br> After you run the `Invoke-ApplianceLogCollectionAndSaveToShareFolder` cmdlet, use the `Send-DiagnosticData` cmdlet to upload the copied data logs from the file share to Microsoft. |
+| [Use on-demand fallback log collection](#log-collection-when-the-management-endpoint-is-inaccessible) when the management endpoint for disconnected operations isn't accessible or the integrated runtime disconnected operations with Azure Local virtual machine (VM) is down. | Collect logs after you shut down the disconnected operations with the Azure Local VM, mount and unlock virtual hard disks (VHDs), and copy logs by using the `Copy-DiagnosticData` cmdlet from mounted VHDs into a local, user-defined location.<br></br> Use the `Send-DiagnosticData` cmdlet to manually send diagnostic data to Microsoft. |
 
 ## Azure Local disconnected when the appliance VM isn't connected to Azure
 
-In disconnected Azure Local environments, you collect logs from the control plane (appliance) and host nodes, then manually upload them with a standalone tool.
+In disconnected Azure Local environments, collect logs from the control plane (appliance) and host nodes, then manually upload them with a standalone tool.
 
-The following diagram shows the key components for log collection in Azure Local disconnected when the appliance VM isn't connected to Azure:
+The following diagram shows key components for log collection in Azure Local disconnected environments when the appliance VM isn't connected to Azure:
 
-:::image type="content" source="./media/disconnected-operations/on-demand-logs/on-demand-components.png" alt-text="Screenshot showing the key components for on-demand log collection in Azure Local disconnected operations." lightbox=" ./media/disconnected-operations/on-demand-logs/on-demand-components.png":::
+:::image type="content" source="./media/disconnected-operations/on-demand-logs/on-demand-components.png" alt-text="Diagram that shows key components for on-demand log collection in Azure Local disconnected operations." lightbox=" ./media/disconnected-operations/on-demand-logs/on-demand-components.png":::
 
 To collect logs from the control plane, follow these steps:
 
-1. Collect control plane logs. Run the following command on a system with access to the appliance VM (usually the same Hyper-V host):
+1. Collect control plane logs. Run this command on a system that can access the appliance VM (usually the same Hyper-V host):
 
 ```powershell
 Invoke-ApplianceLogCollectionAndSaveToShareFolder
 ```
 
-This command gathers logs from the appliance VM and saves them to a specified shared folder.
+This command gathers logs from the appliance VM and saves them to the specified shared folder.
 
-1. Collect host node logs. On each Azure Local host node, run:
+1. Collect host node logs. On each Azure Local host node, run this command:
 
 ```powershell
 Send-DiagnosticData -SaveToPath <shared folder path>
 ```
 
-This command collects logs specific to the node, including system and cluster-level diagnostics.
+This command collects logs specific to the node, including system and cluster level diagnostics.
 
 For more information on the Send-DiagnosticData command, see [Fallback log collection](disconnected-operations-fallback.md).
 
@@ -67,23 +67,23 @@ For more information on the Send-DiagnosticData command, see [Fallback log colle
 
 ## Azure Local disconnected when the appliance VM is connected to Azure
 
-When the appliance VM is connected to Azure, upload host node logs the same way as in the Azure Local disconnected scenario. For control plane logs, send them directly using `Invoke-ApplianceLogCollection`; you don't need to save them locally first.
+When the appliance VM is connected to Azure, upload host node logs the same way as in the Azure Local disconnected scenario. For control plane logs, send them directly by using `Invoke-ApplianceLogCollection`. You don't need to save them locally first.
 
 The following diagram shows the key components for log collection in Azure Local disconnected when the appliance VM is connected to Azure:
 
-:::image type="content" source="./media/disconnected-operations/on-demand-logs-2/on-demand-components.png" alt-text="Screenshot showing the key components for on-demand log collection in Azure Local disconnected operations." lightbox=" ./media/disconnected-operations/on-demand-logs/on-demand-components-2.png":::
+:::image type="content" source="./media/disconnected-operations/on-demand-logs-2/on-demand-components.png" alt-text="Diagram that shows the key components for on-demand log collection in Azure Local disconnected operations." lightbox=" ./media/disconnected-operations/on-demand-logs/on-demand-components-2.png":::
 
-Here's what you need to perform log collection in a connected disconnected operations scenario.
+Here's what you need to do log collection in a connected disconnected operations scenario.
 
 1. Use [Deploy disconnected operations for Azure Local (Preview)](disconnected-operations-deploy.md) to set up the following Azure resources:
 
     - A resource group in Azure for the appliance.
-    - A Service Principal (SPN) with contributor rights on the resource group.
+    - A service principal (SPN) with contributor rights on the resource group.
     - Copy the `AppId` and `Password` from the output. Use them as **ServicePrincipalId** and **ServicePrincipalSecret** during observability setup.
 
-1. Install the operations module if it's not installed. Use the `Import-Module` cmdlet and modify the path to match your folder structure.
+1. Install the operations module if it's not installed. Use the `Import-Module` cmdlet and change the path to match your folder structure.
 
-    ```azurecli
+    ```Powershell
     Import-Module "<disconnected operations module folder path>\Azure.Local.DisconnectedOperations.psd1" -Force
     ```
 
@@ -112,15 +112,15 @@ Here's what you need to perform log collection in a connected disconnected opera
     - Identify the management client certificate used to authenticate with the Azure Local disconnected operations management endpoint.
     - Set up the management endpoint client context. Run this script:
 
-    ```azurecli
+    ```powershell
     $certPasswordPlainText = "***"
     $certPassword = ConvertTo-SecureString $certPasswordPlainText -AsPlainText -Force
     $context = Set-DisconnectedOperationsClientContext -ManagementEndpointClientCertificatePath "<Management Endpoint Client Cert Path>" -ManagementEndpointClientCertificatePassword $certPassword -ManagementEndpointIpAddress "<Management Endpoint IP address>"
     ```
 
 1. Retrieve BitLocker keys:
   
-    ```azurecli
+    ```powershell
     $recoveryKeys = Get-ApplianceBitlockerRecoveryKeys $context # context can be omitted if context is set.
     $recoveryKeys
     ```
@@ -485,17 +485,17 @@ For more information, see [Use appliance fallback log collection](disconnected-o
 
 Use on-demand direct log collection when an on-premises device running Azure Local temporarily has connectivity to Azure.
 
-- Improper Execution of Send-DiagnosticData.
-  - Log collection fails when customers attempt to run Send-DiagnosticData or copy diagnostic data from:
+- Improper Execution of `Send-DiagnosticData`.
+  - Log collection fails when customers attempt to run `Send-DiagnosticData` or `Copy-DiagnosticData` from:
     - Nodes that are not part of the Azure Local host infrastructure.
-    - External machines (e.g., personal laptops) that do not host the required appliance VMs (such as IRVM) on the same Hyper-V host.
+    - External machines (e.g., personal laptops) that don't host the required appliance VMs on the same Hyper-V host.
 
 - Misuse of the Observability Tool.
   - The Standalone Observability Tool must be:
     - Run on a Windows Server.
     - Configured with additional manual steps if executed in unsupported environments.
 
-### Indirect or Fallback Log Collection (Disconnected Mode)
+### Indirect or fallback log collection (disconnected mode)
 
 Use indirect log collection methods when direct upload is not possible:
 
@@ -507,7 +507,7 @@ Use indirect log collection methods when direct upload is not possible:
   - The share folder is accessible.
   - Troubleshooting instructions are provided for common failures (e.g., permission issues, missing dependencies).
 
-### Uploading Logs to Microsoft Support
+### Uploading logs to Microsoft Support
 
 To upload collected logs to Microsoft: