Metricbeat 7.11.1 fail in system fsstat and filesystem: The device is not ready

I keep getting this:
module/wrapper.go:259 Error fetching data for metricset system.fsstat: filesystem list: GetFilesystemType failed: GetVolumeInformationW failed: The device is
module/wrapper.go:259 Error fetching data for metricset system.filesystem: error getting filesystem list: GetFilesystemType failed: GetVolumeInformationW failed: The device is not ready.

The enviroment is:
agent.type metricbeat
agent.version 7.11.1
ecs.version 1.7.0
error.message error getting filesystem list: GetFilesystemType failed: GetVolumeInformationW failed: The device is not ready.
event.dataset system.filesystem
event.module system
host.architecture x86_64
host.os.build 9600.19542
host.os.family windows
host.os.kernel 6.3.9600.19538 (winblue_ltsb_escrow.191014-1700)
host.os.name Windows Server 2012 R2 Standard
host.os.platform windows
host.os.version 6.3
metricset.name filesystem
service.type system

1 Like

We also have this issue when upgrading from 7.10 to 7.11.
The reason is this change to metricbeat: [Metricbeat] Filesystem Metricset: Inconsistent `system.filesystem.type` values on Windows · Issue #22501 · elastic/beats · GitHub

The change adds a call to Kernel32.GetVolumeInformationW to all drives on the system, but this will fail for certain drive types.

For example, on our system we get the drives A:\ C:\ D:\ L:\ where A is a floppy and D is a CD-ROM.
Both these two returns false when calling GetVolumeInformationW and that will stop metricbeat from working.

Right now you can only ignore certain filesystem types, but that filter will be applied on the result from making the syscall. Since the syscall fails, metricbeat stops reporting filesystem metrics.

I posted a script here that confirms the issue on our system:

When the GetVolumeInformationW returns false/error it will get to this line:

Downgrading to mb 7.10 solved the problem.

Thx

I am experiencing the same issue and although you have found the cause there does not seem to be a solution/workaround other than downgrading to 7.10. Is there a bug open on this issue?

@swtrux Yes, the original issue was re-opened and a fix was posted yesterday. Please see this comment [Metricbeat] Filesystem Metricset: Inconsistent `system.filesystem.type` values on Windows · Issue #22501 · elastic/beats · GitHub

Thanks for the quick response, that is great news. So at this time from what I can tell they have a fix but still have not disclosed what version the fix will be in. Is that true?

7.12.0 dropped today and it looks like the fix DID NOT make it in.

I'm wondering why the Github issue got closed since it's been confirmed that the error is still present in 7.12.0. I hope we are not dropping the ball here, there's still a bunch of Windows VMs out there :smile:.