# Service Metricset: System Call Level Is Not Correct

**URL:** <https://discuss.elastic.co/t/service-metricset-system-call-level-is-not-correct/129476>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [April 25, 2018, 11:56am UTC](https://discuss.elastic.co/t/service-metricset-system-call-level-is-not-correct/129476 "2018-04-25T11:56:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jordan.cockles](https://avatars.discourse-cdn.com/v4/letter/j/db5fbb/32.png) [@jordan.cockles](https://discuss.elastic.co/u/jordan.cockles)\
**Post date:** [April 25, 2018, 11:56am UTC](https://discuss.elastic.co/t/service-metricset-system-call-level-is-not-correct/129476/1 "2018-04-25T11:56:03Z")

</div>

I am in the process of setting up MetricBeat on a Windows 2003 Server. So far, the normal checks are in place on Kibana that monitor CPU, Memory and Disk Space.

However, I am facing an issue when I come to monitor the services running on the server. When I check the metricbeat log, and the results when searching for the windows module in Kibana I am given the following error: "The system call level is not correct."

![image](https://us1.discourse-cdn.com/elastic/original/3X/1/f/1fb8cd014f49ba131533772c407b536d4d0b105d.png)

I have verified the configuration and tried granting the directory with the metricbeat.exe heightened privileges.

Has anyone else come across this issue before when adding the service metricset to a machine and has any idea on what might be causing this issue, or could this be a compatibility issue with Windows Server 2003?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 25, 2018, 3:58pm UTC](https://discuss.elastic.co/t/service-metricset-system-call-level-is-not-correct/129476/2 "2018-04-25T15:58:11Z")

</div>

I took a look at the source code to try to reason about where that error could be coming from. That error message is for a [ERROR\_INVALID\_LEVEL](https://msdn.microsoft.com/en-us/library/cc231199.aspx).

Of the system calls used, only [EnumServicesStatusEx](https://msdn.microsoft.com/en-us/library/windows/desktop/ms682640(v=vs.85).aspx) documents that it can return `ERROR_INVALID_LEVEL`. But [Metricbeat uses](https://github.com/elastic/beats/blob/8596d2a7ef458e04c7bcf7c7653f57b21bdf7277/metricbeat/module/windows/service/service_windows.go#L221-L227) the one and only level value when making the call so I don't see why Windows would be returning that error.

Unfortunately Windows 2003 is not one of our [officially supported](https://www.elastic.co/support/matrix) operating systems and we don't do any testing on it.

What service pack level does this host have installed?  
What is the OS architecture? 32 or 64-bit?

---

<div class="post-metadata">

**Author:** ![jordan.cockles](https://avatars.discourse-cdn.com/v4/letter/j/db5fbb/32.png) [@jordan.cockles](https://discuss.elastic.co/u/jordan.cockles)\
**Post date:** [April 26, 2018, 9:53am UTC](https://discuss.elastic.co/t/service-metricset-system-call-level-is-not-correct/129476/3 "2018-04-26T09:53:34Z")

</div>

Thank you for your response,

I had a research around to see if there is anything that could be causing issues with the EnumServicesStatusEx function that I could fix. There doesn't appear to be any answers I can find at the moment.

The OS is currently Windows Server 2003 R2 Standard Edition with service pack 2. This is on a 32 bit version of windows.

Thanks,  
Jordan

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 24, 2018, 10:00am UTC](https://discuss.elastic.co/t/service-metricset-system-call-level-is-not-correct/129476/4 "2018-05-24T10:00:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
