Metricbeat process_summary on windows

tomr · November 7, 2019, 2:25am

I'm using metricbeat (7.3.2) on Windows, and trying to figure out what the various process_summary metrics mean.

	t metricset.name		 	process_summary
	t service.type 				system
	# system.process.summary.dead 		0
	# system.process.summary.idle 		0
	# system.process.summary.running 	70
	# system.process.summary.sleeping 	0
	# system.process.summary.stopped 	0
	# system.process.summary.total	 	72
	# system.process.summary.unknown 	2
	# system.process.summary.zombie 	0

Primarily I would like to know what unknown might indicate, in a windows context.

Next to that, I would like to know which of the other statuses are relevant on windows. In the data I've collected so far, I haven't seen any dead / idle / stopped / zombie (I have seen sleeping).

tomr · November 12, 2019, 1:24am

Is this question better asked on Github?

exekias · November 13, 2019, 2:44pm

Hi @tomr,

You guessed correctly, only possible states in Windows are running, sleeping and unknown. Unknown means there was an error retrieving this info. An error should show up in Metricbeat logs for latest case. Some more details on the implementation can be found here:

github.com

elastic/gosigar/blob/7aef3366157f2bfdf3e068f73ce7193573e88e0c/sigar_windows.go#L216




	filename, err := windows.GetProcessImageFileName(handle)
	if err != nil {
		return "", errors.Wrapf(err, "GetProcessImageFileName failed for pid=%v", pid)
	}


	return filepath.Base(filename), nil
}


// getProcStatus returns the status of a process.
func getProcStatus(pid int) (RunState, error) {
	handle, err := syscall.OpenProcess(processQueryLimitedInfoAccess, false, uint32(pid))
	if err != nil {
		return RunStateUnknown, errors.Wrapf(err, "OpenProcess failed for pid=%v", pid)
	}
	defer syscall.CloseHandle(handle)


	var exitCode uint32
	err = syscall.GetExitCodeProcess(handle, &exitCode)
	if err != nil {
		return RunStateUnknown, errors.Wrapf(err, "GetExitCodeProcess failed for pid=%v", pid)

Best regards

system · December 11, 2019, 2:44pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Errors in metric beat log Beats metricbeat	12	1391	October 12, 2018
Metricbeat 7.5.1 monitors Windows Processes Beats metricbeat	2	318	February 19, 2020
Can't get any other state on a process exept Running state on Metricbeat Beats metricbeat	1	260	September 29, 2022
How to Monitor the process using metricbeat Beats beats-module , metricbeat	6	1021	December 8, 2022
Metricbeat process metricset fails to run Beats metricbeat	2	850	October 30, 2018

Metricbeat process_summary on windows

Related topics