Metricbeat process metricset fails to run

Elastic Stack Beats
1

Some context on my issue: I am trying to run Metricbeat as a service on a Windows machine. Metricbeat was installed using Chocolatey and the Metricbeat service was also installed using the script from Chocolatey.

These are the modules enabled in Metricbeat

metricbeat.modules:
- module: system
  metricsets:
	- process
  enabled: true
  period: 10s
  processes: ['.*']

  cpu.metrics: ["percentages"]
  core.metrics: ["percentages"]

- module: windows
  metricsets: ["service"]
  enabled: true
  period: 10s

So when I run Metricbeat manually on Windows using metricbeat.exe -e -c metricbeat.yml, everything works fine. However, when I run it as a service, the process metricset was not working. I get a bunch of "could not get Win32_Process" error. Here's one such line of log

2018-09-30T19:08:03.415-0700	ERROR	process/process.go:454	Error getting process details. pid=1080: error getting process arguments for pid=1080: ProcArgs failed for pid=1080: could not get Win32_Process WHERE ProcessId = 1080: Class does not exist.

And the log file was bombarded with these log lines just 5 seconds after the service starts. So the question is, why does this happen only when I run Metricbeat as a service and how can I fix it?

2

Hi,

Which version of metricbeat are you using?

Also, could you run the following Powershell command and share what it returns? Replace the process ID with one that's giving you the error in Metricbeat.

PS C:\Users\me > Get-WmiObject -Query "select * from win32_process where ProcessId=1080" | Format-List
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.