Specific service suddenly stops reporting and then starts again

[Alexandros888]

Hello,

I have installed metribeat in a specific host named sag-dfo-055. in the connection between the metricbeat agent and logstash timeouts dont occur as the relative image show in a specific timeframe. So everything works ok.

Neverthelss when i apply in kibana a filter in order to see results for a specific service in the exact same timeframe i get the results that the image below shows:

As it is obvious from the image above the service (and only the specific service) stops sending log info and then it starts sending again.

From the relative logs of the service in the host itself i can find the following log information:

Neverthelss i cant explain still the gap that i see in kibana, even when the service is down it should have been able to be seen the relative logs in the kibana index....

Finally from the logs of the metricbeat agent itself hosted in the folder path: C:\ProgramData\metricbeat\logs there are no error logs and all info logs show normal behaviour
Any help please?

I cant figure out why when i apply the specific filter i have no information at all in my kibana index. How can i troubleshoot that problem?

[Marius_Dragomir]

Metricbeat's process.name doesn't really check for services, it checks for the processes spawned by a service. It looks to me like that process crashed right about when it shows on the chart and then got restarted by the service some time after.

[Alexandros888]

Hello Marius,

Thank you for your reply, nevertheless i dont understand what do you mean by saying: "process.name doesn't really check for services, it checks for the processes spawned by a service".

Do you also imply that the service itself never crashed?

Thank you a lot in advance.

[Marius_Dragomir]

It may have or may not have, but Metricbeat doesn't monitor that. Services are run by svchost.exe in Windows, that's the process name. But a service can start a difference process.
https://social.technet.microsoft.com/Forums/Lync/en-US/cba40481-7400-4c25-aaf6-4f378dcca5b7/service-vs-process?forum=operationsmanagergeneral

[Alexandros888]

Ok i see , thank you also for the relative link.

So Metricbeat checks for the processes spawned by a service, then in this case how can i get the info that those processes were down?

Is Winlobeat more suitable for windows service monitoring than Metricbeat?

Thank you

[Marius_Dragomir]

Winlogbeat will load events data from the EventViewer, yes, and if a service goes down, it should be logged there.