Merge pull request #15088 from ManikaDhiman/md-collect-logs-portal

Collect log via the Azure portal

Author: v-ccolin

azure-stack/hci/manage/collect-logs.md

@@ -1,52 +1,87 @@
 ---
-title: Collect diagnostic logs for Azure Stack HCI
-description: How to collect diagnostic logs and share them with Microsoft.
+title: Collect diagnostic logs for Azure Stack HCI (preview)
+description: Learn how to collect diagnostic logs and share them with Microsoft (preview).
 author: alkohli
 ms.author: alkohli
 ms.topic: how-to
 ms.service: azure-stack-hci
-ms.date: 03/19/2024
+ms.date: 10/28/2024
 ---
 
-# Collect diagnostic logs for Azure Stack HCI
+# Collect diagnostic logs for Azure Stack HCI (preview)
 
 [!INCLUDE [applies-to](../../includes/hci-applies-to-23h2.md)]
 
-This article describes how to collect diagnostic logs and send them to Microsoft to help identify and fix any issues with your Azure Stack HCI solution.
+This article describes how to collect diagnostic logs for Azure Stack HCI and send them to Microsoft via the Azure portal or PowerShell. These diagnostic logs help identify and fix any issues with your Azure Stack HCI solution.
 
-## On-demand log collection
+[!INCLUDE [important](../../includes/hci-preview.md)]
 
-On-demand log collection involves manually collecting and sending diagnostic logs to Microsoft using the `Send-DiagnosticData` cmdlet from any node within the Azure Stack HCI cluster. When you run this cmdlet, the logs are temporarily copied locally. This copy is parsed, sent to Microsoft, and then deleted from your system. Microsoft retains this diagnostic data for up to 30 days and handles it as per the [standard privacy practices](https://privacy.microsoft.com/).
+## About on-demand log collection
+
+On-demand log collection refers to the process of manually gathering and sending diagnostic logs to Microsoft. These logs are stored in the Kusto database, where Microsoft Support can access them to help resolve your reported issues. The collected diagnostic data is retained for up to 30 days and is managed according to Microsoft’s [standard privacy practices](https://privacy.microsoft.com/).
 
 ### When to use on-demand log collection
 
-Here are the scenarios in which you can perform on-demand log collection:
+You can perform on-demand log collection in the following scenarios:
 
-- Microsoft Support requests for logs based on an open case.
-- Logs are collected when a cluster is connected and registered.
-- Logs are collected when the Observability components are operational and installed.
-- Logs are collected when a cluster is only partly registered.
-- Logs are collected for issues not related to registration failures.
+- When Microsoft Support requests logs for an open case
+- When a cluster is connected and registered
+- When observability components are operational and installed
+- When a cluster is only partially registered
+- For issues unrelated to registration failures
 
-To explore additional log collection methods in Azure Stack HCI and understand when to use them, see [Diagnostics](../concepts/observability.md#diagnostics).
+For more information on other log collection methods in Azure Stack HCI and their appropriate use cases, see [Diagnostics](../concepts/observability.md#diagnostics).
 
 ## Prerequisites
 
 Before you collect on-demand logs, you must complete the following prerequisites:
 
-- You must have access to an Azure Stack HCI cluster.
-- You must have access to Azure.
+- You must have access to an Azure Stack HCI cluster that is deployed and registered.
 - You must have installed the `AzureEdgeTelemetryAndDiagnostics` extension to collect telemetry and diagnostics information from your Azure Stack HCI system. For information about the extension, see [Azure Stack HCI telemetry and diagnostics extension overview](../concepts/telemetry-and-diagnostics-overview.md).
 
-## Perform on-demand log collection via PowerShell
+## Collect logs for Azure Stack HCI
+
+You can perform on-demand log collection using any of the following methods:
+
+- **(Recommended) The Azure portal**. Use this method when you want to collect and send logs at the cluster level.
+
+- **PowerShell**. Use this method if you want to collect logs based on specific parameters. You have the option to save logs to an SMB share, send supplementary logs, or send logs for specific roles only.
+
+Keep in mind the following information before you start log collection:
+
+- The time required for log collection depends on the time range you specify. The longer the time range, the more time it'll take for log collection. Therefore, we recommend limiting the time range to only the logs you need.
+- Log collections longer than 24 hours aren't supported.
+- Attempting multiple log collections simultaneously will result in a failure.
+
+### [Azure portal (recommended)](#tab/azureportal)
+
+Follow these steps to collect diagnostic logs for your Azure Stack HCI cluster via the Azure portal:
+
+1. In [the Azure portal](https://portal.azure.com/), go to the Azure Stack HCI cluster resource.
+
+1. In the left pane, under **Settings**, select **Diagnostics and Remote Support**.
+
+1. To collect and send logs now, select **Send logs**.
+
+   :::image type="content" source="./media/collect-logs/diagnostics-tab.png" alt-text="Screenshot shows the Send logs button." lightbox="./media/collect-logs/diagnostics-tab.png" :::
+
+1. In the **Send diagnostic logs to Microsoft** pane, select the **Log start time** and **Log end time**, and then select the **Collect and upload logs** button.
+
+   :::image type="content" source="./media/collect-logs/send-logs-pane.png" alt-text="Screenshot shows the Send logs pane." lightbox="./media/collect-logs/send-logs-pane.png" :::
+
+   You get a notification that it can take up to 30 minutes to collect diagnostic logs.
 
-You can perform on-demand log collection using PowerShell, the recommended method, or Windows Admin Center in the Azure portal, as described later in this article.
+1. The **Log activity** table shows the status of log collections. For more details on a specific log collection, select the link under **Time collected** and review the details in the **Log detail** pane. If you encounter an issue and need help from Microsoft Support, they might request the **Correlation ID** to locate the logs.
 
-Run the `Send-DiagnosticData` cmdlet from any node on your Azure Stack HCI cluster to perform on-demand log collection.
+   :::image type="content" source="./media/collect-logs/log-details-pane.png" alt-text="Screenshot shows the Log details pane." lightbox="./media/collect-logs/log-details-pane.png" :::
 
-Here are some important points to consider:
+## [PowerShell](#tab/powershell)
 
-- The completion time of the `Send-DiagnosticData` cmdlet varies depending on factors, such as the roles for which logs are being collected, time duration specified, and the number of nodes in your Azure Stack HCI environment.
+To use PowerShell for log collection, run the `Send-DiagnosticData` cmdlet from any node within the Azure Stack HCI cluster. This cmdlet temporarily copies the logs locally. The copied logs are parsed, sent to Microsoft, and then deleted from your system.
+
+Here are some important points to consider when collecting logs using PowerShell:
+
+- The completion time of the `Send-DiagnosticData` cmdlet varies depending on factors, such as the roles for which logs are being collected, the time duration specified, and the number of nodes in your Azure Stack HCI environment.
 - If you don't specify any parameters, the `Send-DiagnosticData` cmdlet collects data from all nodes for the previous one-hour duration.
 
 Here's the syntax of `Send-DiagnosticData`:
@@ -123,15 +158,15 @@ PS C:\Users\docsuser>
 
 ### Get a history of log collection
 
-You can get a history of all the log collections that you have performed. This history helps you learn about the kinds of log collections, the sizes of log collections, the times when logs were collected, and the methods of log collection.
+You can get a history of all the log collections that you've performed. This history helps you learn about the kinds of log collections, the sizes of log collections, the times when logs were collected, and the methods of log collection.
 
 To get a history of log collections for the last 90 days, enter:
 
 ```powershell
 Get-LogCollectionHistory  
 ```
 
-Here's a sample output of the `Get-LogCollectionHistory` cmdlet. Note that the `datetime` parameters are in the UTC timezone.
+Here's a sample output of the `Get-LogCollectionHistory` cmdlet. The `datetime` parameters are in the UTC timezone.
 
 ```output
 PS C:\CloudDeployment\logs> Get-LogCollectionHistory
@@ -190,34 +225,11 @@ Follow these steps to save logs to a local share:
    Send-DiagnosticData -SaveToPath <path to share> -ShareCredential $shareCredential
    ```
 
-If you have outbound connectivity from the SMB share where you saved the logs, you can run the following command to send the logs to Microsoft:
-
-```powershell
-Send-DiagnosticData NoLogCollection -SupplementaryLogs <path-to-share> -ShareCredentail $shareCredential
-```
-
-## Provide required information in a support case
-
-If you encounter an issue and need help from Microsoft Support, they might ask for specific information to locate your logs.
-
-You can obtain this information from either the output of the `Send-DiagnosticData` cmdlet or directly from the problematic page in the Azure portal.
-
-### Provide information from the `Send-DiagnosticData` output
+   If you have outbound connectivity from the SMB share where you saved the logs, you can run the following command to send the logs to Microsoft:
 
-When you use `Send-DiagnosticData` to collect logs, it also provides key details in its output that you need to share with Microsoft Support. After you collect logs, they're sent to the Kusto database. Microsoft Support can then use the information provided to locate your logs in Kusto and help you in resolving the reported issue.
-
-When requested, share the following information with Microsoft Support. Get this information from the `Send-DiagnosticData` output.
-
-- `AEORegion`: The location where your device is registered.
-- `AEODeviceARMResourceUri`: A unique identifier to locate the resource, for example: `/subscriptions/<subscription GUID>/resourceGroups/<Name of Resource group>/providers/Microsoft.AzureStackHCI/clusters/<Name of Cluster>`.
-- `AEOClusterNodeArcResourceUri`: A unique identifier to locate the ARC resource, for example: `/subscriptions/<subscription GUID>/resourceGroups/<Name of Resource group>/providers/Microsoft.HybridCompute/Machines/<machine name>`.
-- `CorrelationId`: A unique identifier to locate the logs.
-
-### Provide information from the Azure portal page where issue occurs
-
-On the problematic page in the Azure portal, press CTRL+ALT+A to download a diagnostic file with the following information: session ID and the URL. In most cases, this information is sufficient to get Microsoft Support started on troubleshooting.
-
-If you're on any of the Azure Stack HCI blades where you're experiencing issues, the current URI has the resource ID needed to debug the service.
+   ```powershell
+   Send-DiagnosticData NoLogCollection -SupplementaryLogs <path-to-share> -ShareCredentail $shareCredential
+   ```
 
 ## `Send-DiagnosticData` command reference
 
@@ -267,7 +279,7 @@ All
 
 ### CollectSddc
 
-Determines whether to include or exclude software-defined data center (SDDC) logs. By default, SDDC logs are included. Set it to $false if you want to exclude them. For more information about using SDDC diagnostic tools, see [Collect diagnostic data for clusters](./collect-diagnostic-data.md).
+This parameter helps determine whether to include or exclude software-defined data center (SDDC) logs. By default, SDDC logs are included. Set it to $false if you want to exclude them. For more information about using SDDC diagnostic tools, see [Collect diagnostic data for clusters](./collect-diagnostic-data.md).
 
 **Syntax**
 
@@ -326,7 +338,7 @@ Send-DiagnosticData –SaveToPath <output path>
 Send-DiagnosticData –SaveToPath <share path>
 ```
 
-If you’re using a share path that is not mapped, you must also use the `-ShareCredential` parameter.
+If you’re using a share path that isn't mapped, you must also use the `-ShareCredential` parameter.
 
 ```powershell
 Send-DiagnosticData –SaveToPath <share path> -ShareCredential <credentials for share path>
@@ -383,13 +395,13 @@ The SupplementaryLogs parameter allows you to send ad-hoc logs to Microsoft.
 
 You can use it in the following ways:
 
-With `SaveToPath`. In this scenario, both diagnostic logs and ad-hoc logs are collected and saved to a specified path.
+In this scenario, with `SaveToPath`, both diagnostic logs and ad-hoc logs are collected and saved to a specified path.
 
 ```powershell
 Send-DiagnosticData [-SupplementaryLogs <string>] -SaveToPath <path>
 ```
 
-With `NoLogCollection`. Here, only ad-hoc logs are collected and sent to Microsoft. No diagnostic logs are collected.
+Here, with `NoLogCollection`, only ad-hoc logs are collected and sent to Microsoft. No diagnostic logs are collected.
 
 ```powershell
 Send-DiagnosticData -SupplementaryLogs <string> -NoLogCollection
@@ -420,7 +432,7 @@ Send-DiagnosticData –SaveToPath <path> -SupplementaryLogs <path to adhoc logs
 With `NoLogCollection`:
 
 ```powershell
-Send-DiagnosticData –NoLogCollection –SupplemenatryLogs <path to adhoc logs to collect>
+Send-DiagnosticData –NoLogCollection –SupplementaryLogs <path to adhoc logs to collect>
 ```
 
 **Extension version**
@@ -520,7 +532,7 @@ Initially accessible across all versions, however, this parameter will eventuall
 The SharePath parameter can be used for one of the following purposes:
 
 - Save diagnostic logs to a share path or output path.
-- Send logs to Microsoft from a share path or output path. If you're using a share path and the share path is not mapped, then the `ShareCredential` parameter must also be used.
+- Send logs to Microsoft from a share path or output path. If you're using a share path and the share path isn't mapped, then the `ShareCredential` parameter must also be used.
 
 Since this parameter will be removed in future versions of the extension, use the `–SaveToPath` to save logs to a path, or `–SupplementaryLogs` when sending ad-hoc logs to Microsoft instead.
 
@@ -576,26 +588,42 @@ The following roles are available for filtering by the **FilterByRole** paramete
 | HostNetwork | Logs used to troubleshoot Network ATC, the underlying operating system component used to configure host networking. |
 | MOC_ARB | Management stack that enables cloud-based management of virtual machines on Azure Stack HCI and Windows Server. |
 | NC | Information related to the network infrastructure. |
-| ObservabilityLogmanTraces | Collects logs for Observability traces. These logs help with troubleshooting issues with sending diagnostic data. |
-| ObservabilityVolume | Collects logs for Observability volume. |
+| ObservabilityLogmanTraces | Collects logs for the observability traces. These logs help with troubleshooting issues with sending diagnostic data. |
+| ObservabilityVolume | Collects logs for the observability volume. |
 | OEMDiagnostics | Collects logs for OEM diagnostics, which can help to identify and resolve issues with your server hardware, such as BIOS, drivers, sensors, and more. |
 | OSUpdateLogs | Role that collects logs related to operating system updates on Azure Stack HCI nodes, useful for troubleshooting update-related issues. |
 | RemoteSupportAgent | Logs that help troubleshoot issues with remote support sessions, which are used to address customer support cases. |
 | TestObservability | Collects logs from the `Test-Observability` cmdlet, which is used to test that the `TelemetryAndDiagnostics` extension is working properly. |
 | URP | Consists of logs related to the `UpdateService` and `OsUpdate` ECE role events. The `Update Service` manages updates for Azure Stack HCI systems. The `OsUpdate` ECE role is used to acquire and install operating system updates on machines (physical hosts and InfraVMs) which aren't part of the cluster during the deployment, add node, repair node, and Infra VMs update scenarios. Traces from these two components are part of the `URP` role. |
 
-## Perform on-demand log collection via Windows Admin Center in the Azure portal
+---
+
+## Provide required information in a support case
+
+If you encounter an issue and need help from Microsoft Support, they might ask for specific information to locate your logs.
+
+### [Azure portal](#tab/azureportal)
+
+Follow these steps to provide the required information in the Azure portal:
+
+1. In the **Diagnostics** tab, under **Log activity**, select the link under **Time collected** for the relevant log collection.
+
+1. In the **Log detail** pane, note the value of **Correlation ID**, and share it with Microsoft Support for troubleshooting purposes.
+
+   :::image type="content" source="./media/collect-logs/log-details-pane.png" alt-text="Screenshot shows the Log details pane." lightbox="./media/collect-logs/log-details-pane.png" :::
+
+### [PowerShell](#tab/powershell)
 
-The `Diagnostics` extension in Windows Admin Center in the Azure portal enables you to perform on-demand log collection and share the logs with Microsoft.
+When you use `Send-DiagnosticData` to collect logs, it also provides key details in its output that you need to share with Microsoft Support. After you collect logs, they're sent to the Kusto database. Microsoft Support can then use the information provided to locate your logs in Kusto and help you in resolving the reported issue.
 
-Follow these steps to perform on-demand log collection via Windows Admin Center in the Azure portal:
+When requested, share the following information with Microsoft Support. Get this information from the `Send-DiagnosticData` output.
 
-1. Connect to Windows Admin Center in the Azure portal. For information, see [Manage Azure Stack HCI clusters using Windows Admin Center in Azure](/windows-server/manage/windows-admin-center/azure/manage-hci-clusters).
-1. In the left pane, under **Extensions**, select **Diagnostics**.
-1. On the **Diagnostics** page, under **Log activity** review log collection history or select a row to show the details about a specific log collection.
-1. Select **Send manually**. In the context pane on the right, enter the log start and end time and then select **Collect & upload logs**.
+- `AEORegion`: The location where your device is registered.
+- `AEODeviceARMResourceUri`: A unique identifier to locate the resource, for example: `/subscriptions/<subscription GUID>/resourceGroups/<Name of Resource group>/providers/Microsoft.AzureStackHCI/clusters/<Name of Cluster>`.
+- `AEOClusterNodeArcResourceUri`: A unique identifier to locate the ARC resource, for example: `/subscriptions/<subscription GUID>/resourceGroups/<Name of Resource group>/providers/Microsoft.HybridCompute/Machines/<machine name>`.
+- `CorrelationId`: A unique identifier to locate the logs.
 
-   :::image type="content" source="./media/collect-logs/send-logs-manually.png" alt-text="Screenshot of the Diagnostics page showing the Send manually button for on-demand log collection." lightbox="./media/collect-logs/send-logs-manually.png" :::
+---
 
 ## Next steps