Metricbeat - 'system' -> 'filesystem' metrics does not include network drives

Elastic Stack Beats
1

Hi all,
I am using system module in Metricbeat in order to monitor my computer's drives and I don't see any metrics on network drives, just on local drives.
I am using 'filesystem' metricset.

Thanks for your help,
Yuval.

2

Hi @yuval_yellin and welcome :slight_smile:

The focus on the system module is to collect metrics from the system where metricbeat is running, for the filesystem metricset it means that the defaults may collect data only from local disks.
But said that, the truth is that sometimes both local and remote stores appear in the operating system as the same thing, but it depends on the operating system and the type of drive.

If you are using linux, you can try to customize the filesystem.ignore_types setting, all filesystems not using a physical device are ignored by default, but you can override this to include for example metrics of nfs or smbfs.

If you are using Windows, you may benefit from this recent change that aims to collect volumes in a more generic way, this will be included in Metricbeat 6.7.0.

What operating system and what kind of network drive are you using?

3

Hi Jaime,

I am using Metricbeat on windows and on linux computers, can you please show me how exactly to add the field [filesystem.ignore_type](https://www.elastic.co/guide/en/beats/metricbeat/6.5/metricbeat-metricset-system-filesystem.html#_configuration_5)sin order to get metrics on network drives in Linux computers?

And on windows, I will have to wait until version 6.7.0 will be released?

Thanks,

Yuval

‫בתאריך יום ה׳, 24 בינו׳ 2019 ב-16:59 מאת ‪Jaime Soriano via Discuss the Elastic Stack‬‏ <‪elastic@discoursemail.com‬‏>:‬

4

@yuval_yellin what kind of network volumes are you using?

5

NFS drives.
Thanks

6

Then linux is surely ignoring them with filesystem.ignore_type. When metricbeat starts, it logs the list of ignored filesystems with a line starting with Ignoring filesystem types.... You can use the list logged there as a base to build your own custom filesystem.ignore_type with the types that make sense in your case, something like this for example:

filesystem.ignore_types: [sysfs, proc, cpuset, cgroup, cgroup2, tmpfs, devtmpfs, configfs, debugfs, tracefs, securityfs, sockfs, dax, bpf, pipefs, hugetlbfs, devpts, ecryptfs, fuse, fusectl, pstore, efivarfs, mqueue, autofs, overlay, aufs, binfmt_misc, rpc_pipefs]

For Windows, how do you access NFS? Does it have an assigned letter or access path?

7

So in linux, for example, if I want to get metrics on 'nfs' I just need to remove 'nfs' from filesystem.ignore_types list?
And in Windows we add a mapping to an NFS address, so we have a 'N:' drive which points to a network path.

8

Correct, you may also need to remove nfs4.

Then it may work with the changes introduced in 6.7.0.

To confirm that, if you have the chance you can try to download the source code of gosigar and run go run examples/df/df.go (requires go). gosigar is a library we use to collect system information, this command lists the filesystem this library (and thus metricbeat) is able to detect.

9

OK, so in Linux it works and I see all mounted devices.

In windows, I downloaded and started metricbeat 7.0.0-alpha2 but unfortunately I still don't see any network drive.. Is there any other option?
The changes that you have mentioned above to be introduced in 6.7.0 are in 7.0.0-alpha2 ?

10

@yuval_yellin no, sorry, the change is not in 7.0.0-alpha2, but it will be in next 7.0 build.

It'd be great if you could do the test of running the gosigar example if you have the option to do it in Windows.

11

I tried the gosigar example on windows and unfortunately I still get only local drives..

12

Ok, then we are still missing something :frowning:

Could you please open an enhancement request asking for support of network drives in Windows?

Thanks!

13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.