On Azure Windows VM, temporary D drive has CollectGuestLogsTemp folder and VMAgentLogs.zip auto‑generated.

Welcome to Microsoft Q&A!

@Manager One I hope you are doing well,

This a standard, built-in maintenance routine executed by the Azure Windows VM Agent (WaAppAgent / WindowsAzureGuestAgent).

Here is what is happening under the hood for each of your questions:

1. What triggers automatic CollectGuestLogs execution?

The Azure VM Guest Agent triggers CollectGuestLogs.exe automatically under a few standard scenarios:

• Agent Self-Diagnostics & Health Heartbeats: When the agent detects internal communication hiccups with the Azure Fabric Controller (168.63.129.16), high agent memory usage, or repeated heartbeat timeouts, it automatically captures diagnostic logs for self-triage.
• Extension Failures or Timeouts: If a VM extension (like Custom Script Extension, Azure Monitor Agent, or Defender) fails to report a status or crashes, the agent packages logs to capture the state at that moment.
• Host-Initiated Diagnostic Requests: Azure platform automated healing services or Azure Support automated health probes can trigger a silent log collection request to diagnose host-to-guest degradation.

2. Why does it output to the ephemeral D: drive instead of C:?

This is purely by design to protect your OS disk:

• Collecting event logs, agent traces, and extension dumps can generate hundreds of megabytes of temporary data. Writing and zipping these files on the C: drive risks filling up system disk space, which could crash the OS or production applications.
• The D: drive is dedicated scratch space backed by high-speed local host NVMe/SSD, making it the safest place to stage temporary dumps without consuming billable OS IOPS or disk capacity.

3. Can you change the log output path for CollectGuestLogs.exe?

No, the path is hardcoded into the Azure Guest Agent's diagnostic collection logic.

• By default, the tool queries the system for the designated temporary scratch volume (the resource disk labeled with DATALOSS_WARNING_README.txt) and stages files under D:\CollectGuestLogsTemp.
• It is safe to leave these files alone—the temporary disk is cleared whenever the VM is stopped/deallocated or moved to a new host during maintenance. You can also safely delete the .zip and temp folder manually if you need that scratch space.

References:

• Azure Windows VM Agent overview and troubleshooting
• Understand the temporary drive on Azure Virtual Machines

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.