Skip to content

[Metricbeat] Windows perfmon wildcard queries doesn't show correct instance name #9835

@martinscholz83

Description

@martinscholz83

In windows/perfmon when you you do a wildcard query like '\Process(*)\% Processor Time' you don't get the correct instance name for processes which have multiple instances. For example if you are running VSCode.
It has multiple instances like Code, Code#1, Code#2,...

With perfmon you get this: Code, Code, Code,...
This seems to be a bug in PDH.

Workaround is to instead of running the wildcard query with _PdhGetFormattedCounterArray we should first expand the wildcard query with PdhExpandWildCardPathW which returns the paths for every counter in the wildcard query with the correct name '\Process(Code)\% Processor Time', '\Process(Code#1)\% Processor Time', '\Process(Code#2)\% Processor Time',... and then make a call for every of these counters.

Metadata

Metadata

Assignees

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions