Metricbeat - filesystem metrics does not include remote network drives

Elastic Stack Beats
,
1

Hello!
I attached a few S3 buckets via TntDrive (https://tntdrive.com/) as a network device. They have a "remote" type in the old metricbeat:

{
  "_index": "metricbeat-6.3.0-2020.10",
  "_type": "_doc",
  "_id": "k-8OMXUBmeNgQXQabOTu",
  "_version": 1,
  "_score": null,
  "_source": {
    "beat": {
      "version": "6.3.0"
    },
    "metricset": {
      "module": "system",
      "name": "filesystem",
      "rtt": 311999
    },
    "system": {
      "filesystem": {
        "free_files": 0,
        "available": 17592186044416,
        "mount_point": "U:\\",
        "used": {
          "pct": 0,
          "bytes": 0
        },
        "files": 0,
        "device_name": "U:\\",
        "total": 17592186044416,
        "type": "remote",
        "free": 17592186044416
      }
    }
  }
}

In the newer versions of metricbeat, there are no "remote" devices. How can I fix it? I saw on this topic (Metricbeat - 'system' -> 'filesystem' metrics does not include network drives) that I probably have to change the filesystem.ignore_types. It doesn't work, unfortunately.
Here is my config file:

metricbeat.modules:
- module: system
  enabled: true
  period: 60s
  processes: ['.*']
  filesystem.ignore_types: []
  metricsets:
    - process
    - filesystem
  processors:
    - drop_event.when.regexp.mount_point: '^/(sys|cgroup|proc|dev|etc|host)($|/)'

With metricbeat 6.3.0 it works like a charm.

2

UPD: I downloaded the latest version of https://github.com/elastic/gosigar, compiled examples/df/df.go, and ran. I don't see the network devices in the output:

C:\Users\Administrator\Desktop>df.exe
Filesystem      Size Used Avail Use% Mounted on
C:\              75G  49G   26G  66% C:\

C:\Users\Administrator\Desktop>

Screenshot 2020-10-19 at 11.13.44
Screenshot 2020-10-19 at 11.13.442794×1002 225 KB

3

So, my windows knowledge is pretty limited, but this is the API we're using to get network volumes: https://docs.microsoft.com/es-es/windows/win32/api/fileapi/nf-fileapi-findfirstvolumew

And this is how we're using it: https://github.com/elastic/gosigar/commits/master/sys/windows/syscall_windows.go Previously, (I think under 6.3) we used a different API: https://docs.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-getlogicaldrivestringsw

Not currently sure if there's a workaround, I'll keep investigating.

4

It looks like this is a known issue, we may want to re-open: https://github.com/elastic/beats/issues/10664

1 Like
5

Yeah, will be great! I could attach this discussion URL to the issue

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.