How do you choose between counters, traces, stack snapshots, GC dumps, full process dumps, and a profiler when diagnosing a .NET service?

I also separate time-based evidence from state-based evidence. An intermittent CPU spike or lock wait needs a bounded trace that covers the event; a dump taken after the spike may show nothing useful. A process that is currently hung may be explained by repeated stack snapshots or one full dump. Steadily growing retained memory needs counter history first, then comparable heap evidence at meaningful points. High working set alone does not prove a managed leak, and a large heap type alone does not prove ownership. Before collection I record deployment version, instance, traffic, timestamps, resource limits, and the exact symptom so the artifact can be correlated with logs, metrics, and user impact.