Issue with 32bit Counter Metricbeat 5.5 and 5.4.3 for Windows

Elastic Stack Beats
1

Hi,
I have some systems running server2012r2. I installed Metricbeat 5.5 to monitor the network traffic with this counter:
System.network.in.bytes
System.network.out.bytes

After 4GBytes of traffic the counter Startes again with 0 which means that this is a 32bit Counter?

I am using the metricbeat x64 binary 5.5 and 5.4.3 and the Index template shows that the type is "long".

To visualize the data i am using Kibana visual builder with aggregation 'derivative' and 'positive only.

Because i have a lot of traffic on the network i am reaching the 4GB limit after a short time.

How can i make sure that metribeat uses a counter with more than 4GB?

Frank

2

This is a limitation of the data types used by Windows. MIB_IFROW uses DWORD (aka uint32) to represent the values.

I haven't looked, but can these values be queries using Windows Performance Counters? Metricbeat 6.x is adding a module to collect perf counters. This might be an alternative.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.