New metricset for windows services status

[martinscholz83]

Because there are some requests for having a collector for windows services, i have decided to create a new metricset. Config would look like this

- module: windows
  metricsets: ["services"]
  period: 10s
  services:
    state: "[all] | [active] | [inactive]

With state option you can decide which services you would to like to collect. This option is optional and has all as default value.

Here is an output example

{
  "@timestamp": "2017-09-27T06:32:01.561Z",
  "@metadata": {
    "beat": "metricbeat",
    "type": "doc",
    "version": "7.0.0-alpha1"
  },
    "beat": "metricbeat",
    "type": "doc",
    "version": "7.0.0-alpha1"
  },
  "windows": {
    "services": {
      "state": "ServiceRuning",
      "display_name": "Benutzerdatenzugriff_1f43d46",
      "service_name": "UserDataSvc_1f43d46"
    }
  },
  "metricset": {
    "module": "windows",
    "name": "services",
    "rtt": 16511
  },
  "beat": {
    "name": "4201halwsd00001",
    "hostname": "4201halwsd00001",
    "version": "7.0.0-alpha1"
  }
}
{
  "@timestamp": "2017-09-27T06:32:01.561Z",
  "@metadata": {
    "beat": "metricbeat",
    "type": "doc",
    "version": "7.0.0-alpha1"
  },
  "beat": {
    "name": "4201halwsd00001",
    "hostname": "4201halwsd00001",
    "version": "7.0.0-alpha1"
  },
  "windows": {
    "services": {
      "display_name": "Windows-Pushbenachrichtigungs-Benutzerdienst_1f43d46",
      "service_name": "WpnUserService_1f43d46",
      "state": "ServiceStopped"
    }
  },
  "metricset": {
    "rtt": 16511,
    "module": "windows",
    "name": "services"
  }
}

[martinscholz83]

Should i open a PR?

[andrewkroh]

SGTM. I have a few questions.

• Would it be possible to collect info about the auto-start setting for the service (like auto/manual/disabled)?
• And how about uptime for the service?

As for the config, for the first iteration I recommend not including the services.state filter. I'd like to see if it's really necessary. We have the drop_event filter that could be used instead.

[martinscholz83]

Yes that is possible. You have QueryServiceConfig and QueryConfigService2 which deliver you detailed information about a service. However this requires to open every service you get and call one of these functions. The uptime you can get with the ProcessId. With this ID you can call OpenProcess. With the returned handle you can call GetProcessTimes