Aspire MonitoringSAFE

An Aspire reference architecture for cloud-native microservices and agentic AI with MCP, A2A & AG-UI

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: aspire-monitoring
description: >-
  **ANALYSIS SKILL** - Observe Aspire apps: logs, traces, metrics, resource state,
  telemetry export, browser telemetry, and the standalone dashboard. Routes between local
  Aspire CLI, AKS workload diagnostics, and deployed Azure resource health.
  USE FOR: aspire logs, aspire otel logs, aspire otel traces, aspire otel spans, aspire
  describe, aspire ps, aspire export, aspire dashboard run, describe --include-hidden,
  browser logs in dashboard, terminal view, DevTunnel URLs, WithBrowserLogs, App Insights
  query, AKS pod logs, container app logs.
  DO NOT USE FOR: start/stop/wait (use aspire-orchestration), deploy/publish/destroy (use
  aspire-deployment), AppHost code edits like WithBrowserLogs() (use aspireify), Azure
  provisioning (use azure-prepare).
  INVOKES: aspire CLI, azure-diagnostics (deployed Azure), kubectl + Container Insights.
  FOR SINGLE OPERATIONS: Run the aspire CLI command directly for quick log or describe lookups.
license: MIT
metadata:
  author: Microsoft
  version: "0.0.3"
---

# Aspire Monitoring

> Aspire CLI provides full observability **locally**. For deployed apps, route to platform-specific tools.

## Diagnostics Bridge — Where To Look

| Need                                                                    | Environment               | Tool                         | Command / Route                                                                              |
| ----------------------------------------------------------------------- | ------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------- |
| Console logs                                                            | Local dev                 | Aspire CLI                   | `aspire logs <resource>`                                                                     |
| Structured logs                                                         | Local dev                 | Aspire CLI                   | `aspire otel logs [resource]`                                                                |
| Distributed traces                                                      | Local dev                 | Aspire CLI                   | `aspire otel traces [resource]`                                                              |
| Span detail                                                             | Local dev                 | Aspire CLI                   | `aspire otel spans [resource]`                                                               |
| Running AppHosts                                                        | Local dev                 | Aspire CLI                   | `aspire ps`                                                                                  |
| Resource state                                                          | Local dev                 | Aspire CLI                   | `aspire describe` (add `--include-hidden` if a resource is missing)                          |
| Telemetry export                                                        | Local dev                 | Aspire CLI                   | `aspire export [resource]`                                                                   |
| Standalone dashboard                                                    | Any (no AppHost)          | Aspire CLI                   | `aspire dashboard run` (foreground/blocking — see below)                                     |
| Browser console / network / diagnostics                                 | Local dev (frontend)      | Aspire CLI + dashboard       | Discover `<frontend>-browser-logs`, start its tracked browser, then inspect its console logs |
| AppHost / deployment definition                                         | Authoring                 | aspire-deployment skill      | → `aspire-deployment` skill                                                                  |
| AKS workload (pod logs, pod state)                                      | Deployed AKS              | kubectl + Container Insights | `kubectl logs <pod>`, `kubectl describe pod <pod>`, Container Insights in Azure Monitor      |
| Azure resource health (App Insights, Front Door, NSP, private endpoint) | Deployed Azure            | azure-diagnostics            | → `azure-diagnostics` skill                                                                  |
| App Service / Container Apps logs                                       | Deployed Azure            | azure-diagnostics            | → `azure-diagnostics` skill                                                                  |
| Logs/state                                                              | Deployed Docker / Compose | Docker CLI                   | `docker logs <container>`, `docker compose logs <service>`                                   |

**Decision tree:**

1. Is this about **AppHost code or deployment definition**? → `aspire-deployment` skill.
2. Is the app **running locally** via `aspire start`? → Aspire CLI.
3. Is it deployed to **AKS**? → kubectl + Container Insights for workload; `azure-diagnostics` for the cluster's Azure resources.
4. Is it deployed to **other Azure** (App Service, Container Apps)? → `azure-diagnostics`.
5. Is it deployed to **Docker / Compose**? → `docker` / `docker compose` CLI.

See [diagnostics-bridge.md](references/diagnostics-bridge.md) for detailed routing.

## Investigation Workflow

When something is wrong, investigate before editing code:

1. `aspire describe` — check resource state and endpoints
2. `aspire otel logs <resource>` — structured logs first
3. `aspire logs <resource>` — console output as secondary view
4. `aspire otel traces <resource>` — cross-service activity
5. `aspire export` — zipped telemetry snapshot for deeper analysis

## Local Commands Reference

| Command                              | Purpose                                                      

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.