Start here. This is the direct spoken answer to practice first.
Why this question matters
Production diagnostics need enough access to inspect a live process, which is exactly why an improvised collection path can weaken isolation or expose sensitive memory. The capability should be designed and rehearsed before an urgent incident.
I provide a controlled diagnostic path instead of installing tools manually during every incident. For distributed or containerized services, dotnet-monitor can expose approved collection operations and trigger-based capture, while direct CLI tools can connect through the runtime diagnostic port or process IPC when the environment permits it. Access is authenticated, network-restricted, least-privileged, and available only to an incident role. Every capture has a target instance, artifact type, duration or size limit, reason, owner, and stop condition. I collect from one replica removed from traffic where practical, watch resource headroom, and send the artifact directly to encrypted restricted storage. Dumps and traces receive retention and deletion rules because they may contain application secrets or user data.