Windows File Monitoring

You can configure MetricsHub to monitor files on Windows systems either through WMI or WinRM.

The following example monitors C:\\Program Files\\MyApp\\logs\\file.log, counts occurrences of Error, Exception, and Failure in newly read log data, and exposes the combined count through the system.file.match.count metric.

Use this configuration to track errors, exceptions, or other events identified by specific keywords or patterns.

WinRM Requirements and Limits

When using WinRM, ensure that PowerShell 2.0 or later is available and runs in FullLanguage mode. The following limits also apply:

Whole-file reads are limited to 64 MiB.
Wildcard matching does not follow junctions or symbolic links.
Directory paths are limited to approximately 450 characters.
If a WinRM connection cannot be established and authenticated, MetricsHub retries the connection once after 5 seconds. Requests that may have reached the remote host are not retried.

Procedure

To achieve this use case:

Declare the resource to be monitored (prod-win-web) and its attributes (host.name, host.type)

resources:
  prod-win-web:
    attributes:
      host.name: prod-win-web
      host.type: windows

Configure either WMI or WinRM with the appropriate credentials and timeout:

WMI

    protocols:
      wmi:
        username: USERNAME
        password: PASSWORD
        timeout: 240

or WinRM

    protocols:
      winrm:
        username: USERNAME
        password: PASSWORD
        timeout: 240

Important: Reading large files may take time. Set a sufficient protocol timeout, such as 240 seconds, to prevent connection timeouts.

Configure the monitor job to target the desired files
```
    monitors:
      file:
        simple:
```

Configure the File source

          sources:
            # FileSource: a string containing the added data on the file since the last polling.
            fileSource:
              type: file
              paths: "C:\\Program Files\\MyApp\\logs\\file.log" # File path to monitor
              mode: log # File fetching mode. Use log for log file monitoring
              maxSizePerPoll: 1MB # Maximum size (in MB) to read per polling cycle.

Create an awk script to count how many times specific patterns appear in the file

              computes:
                - type: awk # The awk script counts how many times the content pattern is found
                  script: | # pattern can be a single string ("Error") or a regular expression ("Error|Exception|Failure").
                    BEGIN {
                      pattern = "Error|Exception|Failure"
                      occurrence_count = 0
                    }

                    function count_occurrences(line, regex, count, pos, part) {
                      count = 0
                      pos = 1

                      while (pos <= length(line)) {
                        part = substr(line, pos)

                        if (match(part, regex)) {
                          count++
                          pos += RSTART + RLENGTH - 1
                        } else {
                          break
                        }
                      }

                      return count
                    }

                    {
                      occurrence_count += count_occurrences($0, pattern)
                    }

                    END {
                      print occurrence_count
                    }

Define the identification attributes

          mapping:
            # Mapping is executed on the result produced by the source (after computes are applied).
            source: ${source::fileSource}
            attributes:
              id: "C:\\Program Files\\MyApp\\logs\\file.log"
              system.file.path: "C:\\Program Files\\MyApp\\logs\\file.log"
              system.file.keyword: "Error|Exception|Failure"

Expose the number of matches using the system.file.match.count metric

            metrics:
              # Number of pattern matches found.
              system.file.match.count: $1

Here is the complete YAML configuration for WMI. To use WinRM, replace the wmi protocol block with the winrm block shown above.

resources:
  prod-win-web:
    attributes:
      host.name: prod-win-web
      host.type: windows
    protocols:
      wmi:
        username: USERNAME
        password: PASSWORD
        timeout: 240
    monitors:
      file:
        keys:
          - id
          - system.file.keyword
        simple:
          sources:
            # FileSource: a string containing the added data on the file since the last polling.
            fileSource:
              type: file
              paths: "C:\\Program Files\\MyApp\\logs\\file.log"
              mode: log
              maxSizePerPoll: 1MB
              computes:
                - type: awk # The awk script counts how many times the content pattern is found
                  script: |
                    BEGIN {
                      pattern = "Error|Exception|Failure"
                      occurrence_count = 0
                    }

                    function count_occurrences(line, regex, count, pos, part) {
                      count = 0
                      pos = 1

                      while (pos <= length(line)) {
                        part = substr(line, pos)

                        if (match(part, regex)) {
                          count++
                          pos += RSTART + RLENGTH - 1
                        } else {
                          break
                        }
                      }

                      return count
                    }

                    {
                      occurrence_count += count_occurrences($0, pattern)
                    }

                    END {
                      print occurrence_count
                    }
          mapping:
            # Mapping is executed on the result produced by the source (after computes are applied).
            source: ${source::fileSource}
            attributes:
              id: "C:\\Program Files\\MyApp\\logs\\file.log"
              system.file.path: "C:\\Program Files\\MyApp\\logs\\file.log"
              system.file.keyword: "Error|Exception|Failure"
            metrics:
              # Number of pattern matches.
              system.file.match.count: $1

WinRM Requirements and Limits​

Procedure​

Supporting Resources​

WinRM Requirements and Limits

Procedure

Supporting Resources