Metricbeat Windows network stats resetting (MIB_IFROW vs MIB_IFROW2)

Elastic Stack Beats
1

Hi,

On Windows based hosts the network statistics seem to be reset at 4GB.

There's already an older thread about this, but it's closed, hence the new thread.

According to the answer by Andrew Kroh, this is because 'The data is returned from Windows in a MIB_IFROW which uses a DWORD (uint32) to store the value. So it will always rollover after 4GB.'

Is there any reason why the MIB_IF_ROW2 structure is not used instead? This structure uses ULONG64, which would prevent the values from resetting at 4,294,967,295.

Thank you in advance for your reply.

2

I'm not sure why MIB_IF_ROW2 wasn't used. We use a third-party library, gopsutil, to get the information and it uses MIB_IFROW.

It would be nice to have gopsutil using the MIB_IF_ROW2 so we can get 64-bit counters.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.