Troubleshoot

Always read main.jsonl first — it has the full conversation flow. Child files only appear when those operations occurred. main.jsonl contains child_session_ref entries that link to each child file by name. Title, categorization, and summarize files are UI housekeeping and rarely relevant to troubleshooting. When investigating model availability or selection issues, read models.json — it contains the full list of models (with capabilities, billing, and limits) that were available when the session started.

Each line is a JSON object. Common fields: ts (epoch ms), dur (duration ms), sid (session ID), type, name, spanId, parentSpanId, status (ok|error), attrs (type-specific details).

Event Type Reference with Examples

discovery — customization file loading (instructions, skills, agents, hooks)

{"ts":1773200251309,"dur":0,"sid":"62f52dec","type":"discovery","name":"Load Instructions","spanId":"2cb1f2f4","status":"ok","attrs":{"details":"Resolved 0 instructions in 0.0ms | folders: [/c:/Users/user/.copilot/instructions, /workspace/.github/instructions]","category":"discovery","source":"core"}}
{"ts":1773200251415,"dur":0,"sid":"62f52dec","type":"discovery","name":"Load Agents","spanId":"38a897d8","status":"ok","attrs":{"details":"Resolved 3 agents in 0.0ms | loaded: [Plan, Ask, Explore] | folders: [/workspace/.github/agents]","category":"discovery","source":"core"}}
{"ts":1773200251431,"dur":0,"sid":"62f52dec","type":"discovery","name":"Load Skills","spanId":"472eb225","status":"ok","attrs":{"details":"Resolved 6 skills in 0.0ms | loaded: [agent-customization, troubleshoot, ...]","category":"discovery","source":"core"}}

Key attrs: details (human-readable summary with folder paths, loaded items, skip reasons), category (always "discovery"), source ("core").

tool_call — tool invocation (success or failure)

{"ts":1773200222647,"dur":4,"sid":"62f52dec","type":"tool_call","name":"manage_todo_list","spanId":"000000000000000b","parentSpanId":"0000000000000003","status":"ok","attrs":{"args":"{\"operation\":\"read\"}","result":"No todo list found."}}
{"ts":1773200234047,"dur":8937,"sid":"62f52dec","type":"tool_call","name":"run_in_terminal","spanId":"000000000000000d","parentSpanId":"0000000000000003","status":"error","attrs":{"args":"{\"command\":\"echo rama\"}","result":"ERROR: conpty.node missing","error":"A native exception occurred during launch"}}

Key attrs: args (JSON string of tool input), result (tool output or error text), error (present when status:"error").

llm_request — model round-trip

{"ts":1773200231010,"dur":3001,"sid":"62f52dec","type":"llm_request","name":"chat:gpt-4o","spanId":"000000000000000c","parentSpanId":"0000000000000003","status":"ok","attrs":{"model":"gpt-4o","inputTokens":15025,"outputTokens":126,"ttft":1987}}

Key attrs: model, inputTokens, outputTokens, ttft (time to first token in ms), error (when failed).

agent_response — model output (text + tool calls)

{"ts":1773200234011,"dur":0,"sid":"62f52dec","type":"agent_response","name":"agent_response","spanId":"agent-msg-000000000000000c","parentSpanId":"0000000000000003","status":"ok","attrs":{"response":"[{\"role\":\"assistant\",\"parts\":[{\"type\":\"text\",\"content\":\"Running your command now.\"},{\"type\":\"tool_call\",\"name\":\"run_in_terminal\",\"arguments\":\"{...}\"}]}]"}}

Key attrs: response (JSON-encoded array of message parts; may be truncated).

user_message — user input

{"ts":1773200251345,"dur":0,"sid":"62f52dec","type":"user_message","name":"user_message","spanId":"000000000000000f","status":"ok","attrs":{"content":"using subagent count .md"}}

Key attrs: content (the user's message text).

subagent — subagent invocation

{"ts":1773200254954,"dur":7921,"sid":"62f52dec","type":"subagent","name":"Explore","spanId":"0000000000000014","parentSpanId":"0000000000000013","status":"ok","attrs":{"agentName":"Explore"}}

Key attrs: agentName, description (optional), error (when failed).

generic — miscellaneous events

{"ts":1773200260000,"dur":0,"sid":"62f52dec","type":"generic","name":"some-event","spanId":"abc123","status":"ok","attrs":{"details":"Additional context","category":"some-category"}}

Reading the event hierarchy

Events form a tree via spanId/parentSpanId. A typical chain:

1. user_message (spanId: X) — the user's turn
2. llm_request (parentSpanId: X) — model call for that turn
3. agent_response (parentSpanId: X) — what the model returned
4. tool_call (parentSpanId: X) — tool executed from the response
5. Another llm_request (parentSpanId: X) — next model call after tool result

Subagent calls create nested hierarchies: the tool_call for runSubagent (spanId: Y) becomes the parent for a child subagent span, which in turn parents its own llm_request/tool_call events.

Tooling Strategy (important)

Debug log files live outside the workspace (in user storage), so workspace-scoped search tools like grep_search cannot access them. Use the terminal instead.

Do not use grep_search for log files — it only works on workspace files.

macOS / Linux / WSL / Git Bash

Use run_in_terminal with grep or jq:

• Find errors: grep '"status":"error"' <logPath>
• Find discovery events: grep '"type":"discovery"' <logPath>
• Find slow events (duration > 5s): jq -c 'select(.dur > 5000)' <logPath>
• Find tool calls: grep '"type":"tool_call"' <logPath>
• Search for specific text: grep 'search_term' <logPath>
• Get last N lines: tail -n 50 <logPath>
• Count events by type: jq -r '.type' <logPath> | sort | uniq -c | sort -rn
• Extract specific fields: jq -c '{type, name, status, dur}' <logPath>
• Filter by type and show details: jq -c 'select(.type == "discovery")' <logPath>
• Find user messages: jq -c 'select(.type == "user_message") | .attrs.content' <logPath>

Windows (PowerShell)

Use run_in_terminal with PowerShell commands:

• Find errors: Select-String '"status":"error"' <logPath>
• Find discovery events: Select-String '"type":"discovery"' <logPath>
• Find tool calls: Select-String '"type":"tool_call"' <logPath>
• Search for specific text: Select-String 'search_term' <logPath>
• Get last N lines: Get-Content <logPath> -Tail 50
• Parse and filter with Node.js (always available): node -e "require('fs').readFileSync('<logPath>','utf8').split('\n').filter(Boolean).map(JSON.parse).filter(e => e.dur > 5000).forEach(e => console.log(JSON.stringify(e)))"
• Count events by type: node -e "const lines=require('fs').readFileSync('<logPath>','utf8').split('\n').filter(Boolean).map(JSON.parse);const c={};lines.forEach(e=>c[e.type]=(c[e.type]||0)+1);Object.entries(c).sort((a,b)=>b[1]-a[1]).forEach(([t,n])=>console.log(n,t))"

General rules

• Log files can be very large (tens of MB or more for long sessions). Always check file size first if unsure: ls -lh <logPath> (or (Get-Item <logPath>).Length on Windows). If the file is large, avoid commands that load the entire file into memory (e.g. node -e with readFileSync). Prefer streaming tools like grep, jq, Select-String, tail, or head.
• Use read_file only for small targeted ranges (a few lines) once you know the line numbers. Never read entire log files.
• Use run_in_terminal with ls -lh (or dir on Windows) to locate candidate .jsonl files and check their sizes.
• On Windows, if grep/jq are not available, fall back to Select-String or node -e one-liners (only for smaller files).

Investigation Workflow

1. Identify the log file(s)

• Focus on the session log directories provided in the Runtime Log Context section above. Start by reading main.jsonl in each directory.
• If multiple session directories are listed, investigate all of them — the user wants to compare or find common patterns across sessions.
• Only search other session files in the debug-logs directory if the issue spans multiple sessions or the provided sessions don't contain relevant events.

2. Triage quickly via run_in_terminal (use grep/jq on macOS/Linux, Select-String/node -e on Windows)

• Errors: search for "status":"error"
• Latency: filter for high dur values (> 5000)
• Discovery issues: search for "type":"discovery"
• Tool behavior: search for "type":"tool_call"
• Model behavior: search for "type":"llm_request"

3. Read only relevant slices

• Pull exact lines around suspicious events.
• Correlate with spanId / parentSpanId when needed.

4. Determine root cause

• Pick the most likely cause from evidence.
• If multiple factors contribute, order by impact.

5. Provide remediation

• Offer concrete next steps when possible.

Network Issue Investigation

If you suspect network connectivity or authentication problems (e.g., repeated request timeouts, 401/403 errors, or model endpoint failures in the logs), run the VS Code command github.copilot.debug.collectDiagnostics using the run_vscode_command tool. The command returns the full diagnostics report as a string, so you can read the result directly from the tool output. The report includes:

• Authentication and token status
• Network reachability checks
• Proxy and certificate configuration
• Extension and environment details

The command also opens the report in an editor for the user to see. Use the returned string to diagnose the network issue.

Customization Documentation Reference

When investigating issues related to a specific type of customization file (instructions, prompt files, agents, etc.) and you need more details about the expected format or behavior, load the relevant documentation page:

• Custom instructions: https://code.visualstudio.com/docs/copilot/customization/custom-instructions
• Prompt files: https://code.visualstudio.com/docs/copilot/customization/prompt-files
• Custom agents: https://code.visualstudio.com/docs/copilot/customization/custom-agents
• Language models: https://code.visualstudio.com/docs/copilot/customization/language-models
• MCP servers: https://code.visualstudio.com/docs/copilot/customization/mcp-servers
• Hooks: https://code.visualstudio.com/docs/copilot/customization/hooks
• Agent plugins: https://code.visualstudio.com/docs/copilot/customization/agent-plugins

Use these when you need to verify file format expectations, confirm supported fields, or help the user fix a customization file.

Last Resort — Copilot Issues Wiki

When your investigation yields no clear root cause or you have no specific remediation suggestions:

1. Load the Copilot Issues wiki page: https://github.com/microsoft/vscode/wiki/Copilot-Issues.
2. Search the returned wiki content for sections relevant to the user's problem.
3. Summarize the applicable troubleshooting steps from the wiki in your response.
4. If the wiki contains relevant guidance, present those steps as concrete suggestions the user can try.
5. If even the wiki has no relevant information, tell the user: "The diagnostics logs do not show a clear cause for this behavior, and the known issues wiki does not cover this scenario. Consider filing an issue at https://github.com/microsoft/vscode/issues."

Response Guidelines

Your response should cover:

• What happened and why (the root cause or most likely explanation)
• Key evidence from logs (paraphrased, not raw dumps)
• How to fix it or what to try next

You do not need separate headers for each of these. For straightforward issues, a short combined explanation with a "How to fix" section is fine. Use more structure (headers, multiple sections) only when the issue is complex or involves multiple contributing factors.

Formatting

• Use headers, bullet points, and bold text to make the response scannable.
• Keep paragraphs short. Prefer lists over walls of text.
• When citing log evidence, paraphrase or summarize rather than pasting raw log lines. If a specific detail is important (e.g., an error message), quote just that message — not entire log entries.
• Use tables when comparing multiple values or events (e.g., a name mismatch, latency breakdown across steps).

Abstraction level

• Do not narrate your investigation process. Never say things like "I'm investigating the session debug log…", "I found the key clue in the log…", or "I'm now checking the skill file metadata…". Jump straight to the findings.
• Do not use internal terminology like "discovery summary", "frontmatter name", "the loader", "event hierarchy", or "span tree". Describe what happened in plain language the user can act on.
• Do not describe the internal log file structure, event types, or JSONL format to the user — they do not need to know these implementation details.
• Refer to log files abstractly (e.g., "the debug log" or "the session log") rather than by literal filenames like main.jsonl or runSubagent-Explore-abc123.jsonl.
• Focus on what happened and why, not how you found it.

Example

Bad (narrates investigation, uses internal terms, pastes raw log):

I'm investigating the session debug log to confirm whether a testing skill was discovered. In the skills discovery summary, the loader reports: skipped: testing2 (name-mismatch). The frontmatter name in SKILL.md doesn't match the folder identity.

Good (concise, user-friendly, actionable):

The "testing" skill was found but not loaded because there's a name mismatch between the folder and the skill file:

	Value
Folder name	testing
Name in SKILL.md	testing2

These must match for the skill to load.

How to fix

Either:

• Change name: testing2 to name: testing in your SKILL.md, or
• Rename the folder from testing/ to testing2/

Then start a new chat session so it gets picked up.

Important Rules

• Never assume causality without evidence.
• Use run_in_terminal to search log files — never use grep_search (it cannot access files outside the workspace). Use grep/jq on macOS/Linux, Select-String/node -e on Windows.
• Never read entire log files with read_file — they can be very large. Search first, then read_file for small targeted ranges.
• Keep log access targeted and efficient.
• If you suspect network issues, run github.copilot.debug.collectDiagnostics via the run_vscode_command tool and use the returned diagnostics string before concluding.
• If no clear cause is found, consult the Copilot Issues wiki before giving up. If even the wiki has no relevant information, say so explicitly.