Hello,
I am using metricbeat to monitor a Windows box, and I have noticed that Windows Permon metrics is not consistent. I have it configured to every 60s, but I am noticing that there are gaps in the data in elasticsearch. The gap ranges anywhere from 2 minutes - 5 minutes between documents.
Other modules (such as system and windows service) from this machine are working fine though as I can see them being reported every minute.
Looking at the logs for metricbeat I am not seeing any errors or warnings.
Metricbeat version: metricbeat-6.1.3
Operating System: Windows Server 2016
Configuration
metricbeat.modules:
- module: system
enabled: true
period: 60s
processes: ['.*']
cpu_ticks: false
metricsets:
- cpu
# - load does not work on windows
- filesystem # can only report on and monitor the C: drive. Does not work with network drives
- memory
- network
- process
- core
- diskio # does not seem to work on windows as it reports only 0s
- fsstat
# - socket does not work on windows
- process_summary
- uptime
processors:
- drop_event.when.regexp.mount_point: '^/(sys|cgroup|proc|dev|etc|host)($|/)'
# To get a complete list of possible performance counters, run the following
# command on the windows machine you wish to monitor in CMD:
# $ C:>TypePerf –q > counters.txt
- module: windows
metricsets: ["perfmon"]
period: 60s
perfmon.counters:
- instance_label: "processor.name"
instance_name: "Total"
measurement_label: "processor.time.total.pct"
query: '\Processor Information(_Total)\% Processor Time'
- instance_label: "diskio.name"
measurement_label: "diskio.write.bytes"
query: '\PhysicalDisk(*)\Disk Writes/sec'
format: "long"
- instance_label: "process.name"
measurement_label: "process.io.write.bytes"
query: '\Process(*)\IO Write Bytes/sec'
format: "long"
- module: windows
metricsets: ["service"]
period: 60s
output.kafka:
enabled: true
hosts: [...]
topic: '...'
version: "0.10.2.0"
required_acks: 1
client_id: "..."
worker: 1
max_retries: 3
bulk_max_size: 2048
timeout: 30s
broker_timeout: 10s
channel_buffer_size: 256
keep_alive: 0
compression: snappy
max_message_bytes: 1000000
partition.round_robin:
reachable_only: true
metadata:
refresh_frequency: 10m
retry.max: 3
retry.backoff: 250ms
logging:
level: warning
to_files: true
to_syslog: false