New module windows for metricbeat

metricbeat/include/list.go

@@ -69,6 +69,8 @@ import (
 	_ "github.com/elastic/beats/metricbeat/module/system/network"
 	_ "github.com/elastic/beats/metricbeat/module/system/process"
 	_ "github.com/elastic/beats/metricbeat/module/system/socket"
+	_ "github.com/elastic/beats/metricbeat/module/windows"
+	_ "github.com/elastic/beats/metricbeat/module/windows/perfmon"
 	_ "github.com/elastic/beats/metricbeat/module/zookeeper"
 	_ "github.com/elastic/beats/metricbeat/module/zookeeper/mntr"
 )

metricbeat/module/windows/_meta/config.yml

@@ -0,0 +1,5 @@
+#- module: windows
+#  metricsets: ["perfmon"]
+#  enabled: true
+#  period: 10s
+#  perfmon.counters:

metricbeat/module/windows/_meta/docs.asciidoc

@@ -0,0 +1,3 @@
+== windows Module
+
+This is the windows Module.

metricbeat/module/windows/_meta/fields.yml

@@ -0,0 +1,10 @@
+- key: windows
+  title: "Windows"
+  description: >
+    []beta
+    Module for Windows
+  fields:
+    - name: windows
+      type: group
+      description: >
+      fields:

metricbeat/module/windows/doc.go

@@ -0,0 +1,4 @@
+/*
+Package windows is a Metricbeat module that contains MetricSets.
+*/
+package windows

metricbeat/module/windows/perfmon/_meta/data.json

@@ -0,0 +1,19 @@
+{
+    "@timestamp":"2016-05-23T08:05:34.853Z",
+    "beat":{
+        "hostname":"beathost",
+        "name":"beathost"
+    },
+    "metricset":{
+        "host":"localhost",
+        "module":"mysql",
+        "name":"status",
+        "rtt":44269
+    },
+    "windows":{
+        "perfmon":{
+            "example": "perfmon"
+        }
+    },
+    "type":"metricsets"
+}

metricbeat/module/windows/perfmon/_meta/docs.asciidoc

@@ -0,0 +1,26 @@
+=== windows perfmon MetricSet
+
+This is the perfmon metricset of the module windows.
+
+[float]
+=== Features and configuration
+
+Metricset to collect performance counters.
+Example configuration:
+```
+- module: windows
+  metricsets: ["perfmon"]
+  enabled: true
+  period: 10s
+  perfmon.counters:
+    - group: "processor"  
+      collectors:
+        - alias: "processor_perfomance"
+          query: '\Processor Information(_Total)\% Processor Performance'
+        - alias: "processor_time"
+          query: "\\Processor Information(_Total)\\% Performance Limit"
+    - group: "disk"
+      collectors:
+        - alias: "bytes_written"
+          query: '\FileSystem Disk Activity(_Total)\FileSystem Bytes Written'
+```

metricbeat/module/windows/perfmon/_meta/fields.yml

@@ -0,0 +1,26 @@
+- name: perfmon
+  type: group
+  fields:
+    - name: counters
+      type: group
+      description: >
+        Grouping of different counters
+      fields: 
+        - name: group
+          type: string
+          description: >
+            Name of the group. For example `processor` or `disk`
+
+        - name: collectors
+          type: group
+          fields:
+            - name: alias
+              type: string
+              description: >
+                Short form for the query
+
+            - name: query
+              type: string
+              description: >
+                The query. For example `\\Processor Information(_Total)\\% Processor Performance`. Backslashes have to be escaped.
+

metricbeat/module/windows/perfmon/defs_windows.go

@@ -0,0 +1,31 @@
+// +build ignore
+
+package perfmon
+
+/*
+#include <windows.h>
+#include <stdio.h>
+#include <conio.h>
+#include <pdh.h>
+#include <pdhmsg.h>
+#cgo LDFLAGS: -lpdh
+*/
+import "C"
+
+const (
+	ERROR_SUCCESS           = C.ERROR_SUCCESS
+	PDH_STATUS_VALID_DATA   = C.PDH_CSTATUS_VALID_DATA
+	PDH_STATUS_NEW_DATA     = C.PDH_CSTATUS_NEW_DATA
+	PDH_NO_DATA             = C.PDH_NO_DATA
+	PDH_STATUS_NO_OBJECT    = C.PDH_CSTATUS_NO_OBJECT
+	PDH_STATUS_NO_COUNTER   = C.PDH_CSTATUS_NO_COUNTER
+	PDH_STATUS_INVALID_DATA = C.PDH_CSTATUS_INVALID_DATA
+	PDH_INVALID_HANDLE      = C.PDH_INVALID_HANDLE
+	PDH_INVALID_DATA        = C.PDH_INVALID_DATA
+	PDH_NO_MORE_DATA        = C.PDH_NO_MORE_DATA
+	PdhFmtDouble            = C.PDH_FMT_DOUBLE
+	PdhFmtLarge             = C.PDH_FMT_LARGE
+	PdhFmtLong              = C.PDH_FMT_LONG
+)
+
+type PdhCounterValue C.PDH_FMT_COUNTERVALUE

metricbeat/module/windows/perfmon/defs_windows_386.go

@@ -0,0 +1,24 @@
+package perfmon
+
+const (
+	ERROR_SUCCESS           = 0x0
+	PDH_STATUS_VALID_DATA   = 0x0
+	PDH_STATUS_NEW_DATA     = 0x1
+	PDH_NO_DATA             = 0x800007d5
+	PDH_STATUS_NO_OBJECT    = 0xc0000bb8
+	PDH_STATUS_NO_COUNTER   = 0xc0000bb9
+	PDH_STATUS_INVALID_DATA = 0xc0000bba
+	PDH_INVALID_HANDLE      = 0xc0000bbc
+	PDH_INVALID_DATA        = 0xc0000bc6
+	PDH_NO_MORE_DATA        = 0xc0000bcc
+	PdhFmtDouble            = 0x00000200
+	PdhFmtLarge             = 0x00000400
+	PdhFmtLong              = 0x00000100
+)
+
+type PdhCounterValue struct {
+	CStatus   uint32
+	Pad_cgo_0 [4]byte
+	LongValue int32
+	Pad_cgo_1 [4]byte
+}

metricbeat/module/windows/perfmon/defs_windows_amd64.go

@@ -0,0 +1,24 @@
+package perfmon
+
+const (
+	ERROR_SUCCESS           = 0x0
+	PDH_STATUS_VALID_DATA   = 0x0
+	PDH_STATUS_NEW_DATA     = 0x1
+	PDH_NO_DATA             = 0x800007d5
+	PDH_STATUS_NO_OBJECT    = 0xc0000bb8
+	PDH_STATUS_NO_COUNTER   = 0xc0000bb9
+	PDH_STATUS_INVALID_DATA = 0xc0000bba
+	PDH_INVALID_HANDLE      = 0xc0000bbc
+	PDH_INVALID_DATA        = 0xc0000bc6
+	PDH_NO_MORE_DATA        = 0xc0000bcc
+	PdhFmtDouble            = 0x00000200
+	PdhFmtLarge             = 0x00000400
+	PdhFmtLong              = 0x00000100
+)
+
+type PdhCounterValue struct {
+	CStatus   uint32
+	Pad_cgo_0 [4]byte
+	LongValue int32
+	Pad_cgo_1 [4]byte
+}

metricbeat/module/windows/perfmon/pdh.go

@@ -0,0 +1,93 @@
+// +build windows
+
+package perfmon
+
+import (
+	"unsafe"
+
+	"time"
+
+	"github.com/elastic/beats/libbeat/common"
+)
+
+type Handle struct {
+	status      error
+	query       uintptr
+	counterType int
+	counters    []CounterGroup
+}
+
+type CounterGroup struct {
+	GroupName string
+	Counters  []Counter
+}
+
+type Counter struct {
+	counterName  string
+	counter      uintptr
+	counterPath  string
+	displayValue PdhCounterValue
+}
+
+func getHandle(config []CounterConfig) (*Handle, error) {
+	q := &Handle{}
+	err := _PdhOpenQuery(0, 0, &q.query)
+	if err != nil {
+		return nil, err
+	}
+
+	counterGroups := make([]CounterGroup, len(config))
+	q.counters = counterGroups
+
+	for i, v := range config {
+		counterGroups[i] = CounterGroup{GroupName: v.Name, Counters: make([]Counter, len(v.Group))}
+		for j, v1 := range v.Group {
+			counterGroups[i].Counters[j] = Counter{counterName: v1.Alias, counterPath: v1.Query}
+			err := _PdhAddCounter(q.query, counterGroups[i].Counters[j].counterPath, 0, &counterGroups[i].Counters[j].counter)
+			if err != nil {
+				return q, err
+			}
+		}
+	}
+
+	return q, nil
+}
+
+func (q *Handle) readData(firstFetch bool) (common.MapStr, error) {
+
+	err := _PdhCollectQueryData(q.query)
+
+	if firstFetch {
+		// Most counters require two sample values in order to compute a displayable value. So wait and then collect the second value
+		time.Sleep(2000)
+		err = _PdhCollectQueryData(q.query)
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	result := common.MapStr{}
+
+	for _, v := range q.counters {
+		groupVal := make(map[string]interface{})
+		for _, v1 := range v.Counters {
+			err := _PdhGetFormattedCounterValue(v1.counter, PdhFmtDouble, q.counterType, &v1.displayValue)
+			if err != nil {
+				return nil, err
+			}
+			doubleValue := (*float64)(unsafe.Pointer(&v1.displayValue.LongValue))
+			groupVal[v1.counterName] = *doubleValue
+
+		}
+		result[v.GroupName] = groupVal
+	}
+	return result, nil
+}
+
+//go:generate go run $GOROOT/src/syscall/mksyscall_windows.go -output pdh_windows.go pdh.go
+// Windows API calls
+//sys   _PdhOpenQuery(dataSource uintptr, userData uintptr, query *uintptr) (err error) = pdh.PdhOpenQuery
+//sys   _PdhAddCounter(query uintptr, counterPath string, userData uintptr, counter *uintptr) (err error) = pdh.PdhAddEnglishCounterW
+//sys   _PdhCollectQueryData(query uintptr) (err error) = pdh.PdhCollectQueryData
+//sys   _PdhGetFormattedCounterValue(counter uintptr, format uint32, counterType int, value *PdhCounterValue) (err error) = pdh.PdhGetFormattedCounterValue

metricbeat/module/windows/perfmon/pdh_windows.go

@@ -0,0 +1,77 @@
+// MACHINE GENERATED BY 'go generate' COMMAND; DO NOT EDIT
+
+package perfmon
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+var _ unsafe.Pointer
+
+var (
+	modpdh = syscall.NewLazyDLL("pdh.dll")
+
+	procPdhOpenQuery                = modpdh.NewProc("PdhOpenQuery")
+	procPdhAddEnglishCounterW       = modpdh.NewProc("PdhAddEnglishCounterW")
+	procPdhCollectQueryData         = modpdh.NewProc("PdhCollectQueryData")
+	procPdhGetFormattedCounterValue = modpdh.NewProc("PdhGetFormattedCounterValue")
+)
+
+func _PdhOpenQuery(dataSource uintptr, userData uintptr, query *uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall(procPdhOpenQuery.Addr(), 3, uintptr(dataSource), uintptr(userData), uintptr(unsafe.Pointer(query)))
+	if r1 == 0 {
+		if e1 != 0 {
+			err = error(e1)
+		} else {
+			err = nil
+		}
+	}
+	return
+}
+
+func _PdhAddCounter(query uintptr, counterPath string, userData uintptr, counter *uintptr) (err error) {
+	var _p0 *uint16
+	_p0, err = syscall.UTF16PtrFromString(counterPath)
+	if err != nil {
+		return
+	}
+	return __PdhAddCounter(query, _p0, userData, counter)
+}
+
+func __PdhAddCounter(query uintptr, counterPath *uint16, userData uintptr, counter *uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall6(procPdhAddEnglishCounterW.Addr(), 4, uintptr(query), uintptr(unsafe.Pointer(counterPath)), uintptr(userData), uintptr(unsafe.Pointer(counter)), 0, 0)
+	if r1 == 0 {
+		// Ignoring error 2147485649. This error means PDH_CSTATUS_NO_INSTANCE. See here for description https://msdn.microsoft.com/en-us/library/windows/desktop/aa371894%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396
+		if e1 != 0 && e1 != 2147485649 {
+			err = error(e1)
+		} else {
+			err = nil
+		}
+	}
+	return
+}
+
+func _PdhCollectQueryData(query uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall(procPdhCollectQueryData.Addr(), 1, uintptr(query), 0, 0)
+	if r1 == 0 {
+		if e1 != 0 {
+			err = error(e1)
+		} else {
+			err = nil
+		}
+	}
+	return
+}
+
+func _PdhGetFormattedCounterValue(counter uintptr, format uint32, counterType int, value *PdhCounterValue) (err error) {
+	r1, _, e1 := syscall.Syscall6(procPdhGetFormattedCounterValue.Addr(), 4, uintptr(counter), uintptr(format), uintptr(counterType), uintptr(unsafe.Pointer(value)), 0, 0)
+	if r1 == 0 {
+		if e1 != 0 {
+			err = error(e1)
+		} else {
+			err = nil
+		}
+	}
+	return
+}