Updated text

Author: ronmiab

azure-local/manage/disconnected-operations-fallback.md

@@ -160,16 +160,6 @@ The autogenerated output folder, **CopyLogs_20240501T1525097418**, has the copie
 - **RobocopyLog.log**: Records the copying of all file types except Windows Event files.
 - **wevtutil**: A tool used to copy Windows events. This activity is logged in the **WEvtUtilLog.log** file.
 
-Here are examples of the **LogsToExport** folder structures:
-
-Overall file structure:
-
-[![Screenshot of the copy diagnostics overall file structure.](./media/disconnected-operations/fallback-log/overall-file-structure.png)](media/disconnected-operations/fallback-log/overall-file-structure.png#lightbox)
-
-Azure Local VM running disconnected nested file structure:  
-
-[![Screenshot of the Azure Local VM running disconnected nested file structure.](./media/disconnected-operations/fallback-log/nested-file-structure.png)](media/disconnected-operations/fallback-log/nested-file-structure.png#lightbox)
-
 ### Send-DiagnosticData  
 
 After you collect logs into a directory, either by using the `Copy-DiagnosticData` cmdlet or by copying them manually, send them to Microsoft with the standalone pipeline. This pipeline Arc-enables the host (the machine running the cmdlet) to perform the operation, targets all the logs in the file location you provide, and sends them for ingestion to Microsoft. If log ingestion fails, the cmdlet tries up to three times and then outputs the results of the send activity when it's complete.
@@ -245,13 +235,8 @@ Log parsing engine results can be found under:
 G:\CopyLogs_20241218T1622391740\SendLogs_20241218T1625348996\ObsScheduledTaskTranscripts  
 ```
 
-Here's an example of the file structure for the send logs:
-
-[![Screenshot of the file structure for the send logs.](./media/disconnected-operations/fallback-log/send-logs-file-structure.png)](media/disconnected-operations/fallback-log/send-logs-file-structure.png#lightbox)
-
-The send logs file structure has all the logs and installation files from the standalone observability pipeline, including the **GMACache logs** and pipeline install and uninstall logs.
-
 ## Related content
+
 - [Collect logs on-demand with Azure Local disconnected operations (preview)](disconnected-operations-on-demand-logs.md)
 - [Disconnected operations with Azure Local Overview](disconnected-operations-overview.md)
 

azure-local/manage/disconnected-operations-on-demand-logs.md

@@ -481,6 +481,40 @@ For more information, see [Use appliance fallback log collection](disconnected-o
 
 - `Invoke-ApplianceLogCollectionAndSaveToShareFolder`: you need to specify the account in the format: Domain\Username, if you omit the domain or use an incorrect username, the copy operation to the share will fail with an access-denied error.
 
+## When to use on-demand log collection
+
+Use on-demand direct log collection when an on-premises device running Azure Local temporarily has connectivity to Azure.
+
+- Improper Execution of Send-DiagnosticData.
+  - Log collection fails when customers attempt to run Send-DiagnosticData or copy diagnostic data from:
+    - Nodes that are not part of the Azure Local host infrastructure.
+    - External machines (e.g., personal laptops) that do not host the required appliance VMs (such as IRVM) on the same Hyper-V host.
+
+- Misuse of the Observability Tool.
+  - The Standalone Observability Tool must be:
+    - Run on a Windows Server.
+    - Configured with additional manual steps if executed in unsupported environments.
+
+### Indirect or Fallback Log Collection (Disconnected Mode)
+
+Use indirect log collection methods when direct upload is not possible:
+
+- Run the following commands on the seed node:
+  - `Invoke-ApplianceLogCollectionAndSaveToShareFolder`
+  - `Copy-DiagnosticData`
+
+- Ensure that:
+  - The share folder is accessible.
+  - Troubleshooting instructions are provided for common failures (e.g., permission issues, missing dependencies).
+
+### Uploading Logs to Microsoft Support
+
+To upload collected logs to Microsoft:
+
+- Use the Send-DiagnosticData command from the Azure Local Disconnected Operations PowerShell module.
+- Important: This command must not be run on Azure Local host nodes, as those are managed by the ALDO control plane.
+- Instead, run it from a Windows machine with Azure connectivity—ideally the customer’s laptop or desktop.
+
 ## Related content
 
 - Learn how and when to use [Use appliance fallback log collection](disconnected-operations-fallback.md).