Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 15 additions & 10 deletions wmi_check/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,9 @@

**Note 1:** Although the WMI check can still be used to collect Windows Performance Counters (and was previously the only method available), it is now recommended to use the dedicated [Windows Performance Counters integration][2]. This integration leverages the native Performance Counters API, making it more efficient and easier to configure. In practice, you should avoid using the `Win32_PerfFormattedData_XYZ` WMI class, as it merely acts as an alias for a Performance Counter Object/Counterset.

**Note 2:** Certain WMI classes, such as `Win32_Product` or `Win32_UserAccount`, are not well-suited for frequent queries, as they can be slow to respond or may cause high CPU usage. Before using any WMI class to collect telemetry, carefully test its performance to ensure it is appropriate for use in a production environment.
**Note 2:** Certain WMI classes, such as `Win32_Product` or `Win32_UserAccount`, are not well-suited for frequent queries, as they can be slow to respond or may cause high CPU usage. Before using any WMI class to collect telemetry, carefully test its performance to ensure it is appropriate for use in a production environment.

The built-in Windows WMI ecosystem offers rich, and in many cases exclusive, access to Windows and Microsoft features and products telemetry. This WMI Check allows mapping rows and columns from WMI class datasets to Datdog metrics and their tags, making it easier to extract meaningful telemetry. Additionally, it supports joining two WMI class datasets, allowing for correlations between datasets that would otherwise be impossible to achieve.
The built-in Windows WMI ecosystem offers rich, and in many cases exclusive, access to Windows and Microsoft features and products telemetry. This WMI Check allows mapping rows and columns from WMI class datasets to Datadog metrics and their tags, making it easier to extract meaningful telemetry. Additionally, it supports joining two WMI class datasets, allowing for correlations between datasets that would otherwise be impossible to achieve.

**Minimum Agent version:** 6.0.0

Expand Down Expand Up @@ -122,9 +122,9 @@ instances:
```
#### Configuration options

_This feature is available starting with version 5.3 of the agent_
_This feature is available starting with version 5.3 of the Agent_

Each WMI query has 2 required options, `class` and `metrics` and six optional options, `host`, `namespace`, `filters`, `provider`, `tag_by`, `constant_tags` and `tag_queries`.
Each WMI query has 2 required options, `class` and `metrics` and six optional options, `host`, `namespace`, `filters`, `provider`, `tag_by`, and `tag_queries`.

- `class` is the name of the WMI class, for example `Win32_OperatingSystem` or `Win32_PerfFormattedData_PerfProc_Process`. You can find many of the standard class names on the [MSDN docs][7]. The `Win32_FormattedData_*` classes provide many useful performance counters by default.

Expand All @@ -144,23 +144,28 @@ Each WMI query has 2 required options, `class` and `metrics` and six optional op
- `provider` is the optional WMI provider (default to `32` on Datadog Agent 32-bit or `64`). It is used to request WMI data from the non-default provider. Available options are: `32` or `64`.
See [MSDN][9] for more information.

- `tag_by` optionally lets you tag each metric with a property from the WMI class you're using. This is only useful when you have multiple values for your WMI query.
- `tag_by` optionally lets you tag each metric with a property from the WMI class you're using. This is only useful when you have multiple values for your WMI query. For Agent versions 7.74 and later, aliases can be set for property tags by appending `AS <ALIAS_NAME>` to the property name. For example: `Name AS wmi_name` is tagged as `wmi_name:value` instead of `Name:value`.

- `tags` optionally lets you tag each metric with a set of fixed values.

- `tag_queries` optionally lets you specify a list of queries, to tag metrics with a target class property. Each item in the list is a set of `[<LINK_SOURCE_PROPERTY>, <TARGET_CLASS>, <LINK_TARGET_CLASS_PROPERTY>, <TARGET_PROPERTY>]` where:
- `tag_queries` optionally lets you specify a list of queries, to tag metrics with a target class property. Each item in the list is a set of `[<LINK_SOURCE_PROPERTY>, <TARGET_CLASS>, <LINK_TARGET_CLASS_PROPERTY>, <TARGET_PROPERTY> AS <TAG_ALIAS>]` where:

- `<LINK_SOURCE_PROPERTY>` contains the link value
- `<TARGET_CLASS>` is the class to link to
- `<LINK_TARGET_CLASS_PROPERTY>` is the target class property to link to
- `<TARGET_PROPERTY>` contains the value to tag with
- `<TAG_ALIAS>` is the alias to use for the tag. If not provided, the target property's name is used. This functionality is available with Agent versions 7.74 and later.

It translates to a WMI query:
`SELECT '<TARGET_PROPERTY>' FROM '<TARGET_CLASS>' WHERE '<LINK_TARGET_CLASS_PROPERTY>' = '<LINK_SOURCE_PROPERTY>'`

##### Example

The setting `[IDProcess, Win32_Process, Handle, CommandLine]` tags each process with its command line. Any instance number is removed from tag_by values, for example: `name:process#1` => `name:process. NB`. The Agent must be running under an **Administrator** account for this to work as the `CommandLine` property is not accessible to non-admins.
The setting `[IDProcess, Win32_Process, Handle, CommandLine]` tags each process with its command line. For example: `commandline:agent.exe`.

An alias can be set for these tags with the setting `[IDProcess, Win32_Process, Handle, CommandLine AS cmd]`. For example: `cmd:agent.exe`.

Any instance number is removed from `tag_by` values, for example: `name:process#1` => `name:process`. **Note**: The Agent must be running under an **Administrator** account for this to work because the `CommandLine` property is not accessible to non-admins.

### Validation

Expand Down Expand Up @@ -192,23 +197,23 @@ PS> Get-WmiObject -Namespace Root -Class __Namespace | Select Name

#### List WMI Namespace Classes

To list all WMI classes available in `XYZ` namespace run the following PowerShell command:
To list all WMI classes available in `XYZ` namespace, run the following PowerShell command:

```
Get-WmiObject -List -Namespace ROOT\xyz | Select Name
```

... or drop `-Namespace` parameter for the default namespace.

To find a WMI class `abc` one can run the following PowerShell command:
To find a WMI class `abc`, run the following PowerShell command:

```
Get-WmiObject -List | WHERE{$_.Name -Like "*abc*"}
```

#### WMI Provider Documentation

Microsoft provide detailed documentation for many but not all WMI classes in [WMI Providers][13]
Microsoft provides detailed documentation for many but not all WMI classes in [WMI Providers][13].

## Troubleshooting

Expand Down
6 changes: 3 additions & 3 deletions wmi_check/assets/configuration/spec.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -144,15 +144,15 @@ files:
The `tag_by` parameter lets you tag each metric with a property from the WMI class you're using.
This is only useful when you will have multiple values for your WMI query.
Comma-separated list of property names
Add aliases to the property tags with by appending AS <ALIAS_NAME> to the property name.
Add aliases to the property tags by appending AS <ALIAS_NAME> to the property name.
For example: Name AS wmi_name will be tagged as wmi_name:value instead of Name:value.
value:
type: string
display_default: null
example: Name AS wmi_name,Label
- name: tag_queries
description: |
The `tag_queries` parameter lets you specify a list of queries, to tag metrics with a target class property.
The `tag_queries` parameter lets you specify a list of queries to tag metrics with a target class property.
Each item in the list is a set of :

`[<LINK_SOURCE_PROPERTY>, <TARGET_CLASS>, <LINK_TARGET_CLASS_PROPERTY>, <TARGET_PROPERTY> AS <TAG_ALIAS>]`
Expand All @@ -161,7 +161,7 @@ files:
* `<TARGET_CLASS>` is the class to link to
* `<LINK_TARGET_CLASS_PROPERTY>` is the target class property to link to
* `<TARGET_PROPERTY>` contains the value to tag with
* `<TAG_ALIAS>`is the alias to use for the tag. If not provided, the target property's name will be used.
* `<TAG_ALIAS>` is the alias to use for the tag. If not provided, the target property's name is used.

It translates to a WMI query:

Expand Down
6 changes: 3 additions & 3 deletions wmi_check/datadog_checks/wmi_check/data/conf.yaml.example
Original file line number Diff line number Diff line change
Expand Up @@ -132,13 +132,13 @@ instances:
## The `tag_by` parameter lets you tag each metric with a property from the WMI class you're using.
## This is only useful when you will have multiple values for your WMI query.
## Comma-separated list of property names
## Add aliases to the property tags with by appending AS <ALIAS_NAME> to the property name.
## Add aliases to the property tags by appending AS <ALIAS_NAME> to the property name.
## For example: Name AS wmi_name will be tagged as wmi_name:value instead of Name:value.
#
# tag_by: Name AS wmi_name,Label

## @param tag_queries - list of lists - optional
## The `tag_queries` parameter lets you specify a list of queries, to tag metrics with a target class property.
## The `tag_queries` parameter lets you specify a list of queries to tag metrics with a target class property.
## Each item in the list is a set of :
##
## `[<LINK_SOURCE_PROPERTY>, <TARGET_CLASS>, <LINK_TARGET_CLASS_PROPERTY>, <TARGET_PROPERTY> AS <TAG_ALIAS>]`
Expand All @@ -147,7 +147,7 @@ instances:
## * `<TARGET_CLASS>` is the class to link to
## * `<LINK_TARGET_CLASS_PROPERTY>` is the target class property to link to
## * `<TARGET_PROPERTY>` contains the value to tag with
## * `<TAG_ALIAS>`is the alias to use for the tag. If not provided, the target property's name will be used.
## * `<TAG_ALIAS>` is the alias to use for the tag. If not provided, the target property's name is used.
##
## It translates to a WMI query:
##
Expand Down
Loading