sendnrw/windows_exporter
2
0
Fork 0
mirror of https://github.com/prometheus-community/windows_exporter.git synced 2026-10-17 10:09:05 +02:00
Code Issues Packages Projects Releases Wiki Activity

docs: record PDH counter types of all collectors for agents (#2713)

Browse Source 
Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de>
This commit is contained in:
Jan-Otto Kröpke
2026-10-15 15:49:01 +00:00
committed by GitHub
parent b64cc3621c
commit 6e242d7af2
25 changed files with 2986 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+19
View File
@@ -186,6 +186,25 @@ go build -o windows_exporter.dev.exe ./cmd/windows_exporter/
Adjust the collector list for the change. Leave the existing exporter instance
running unless the user requests changes to it.
To check a collector's metric types against Windows, list each counter of the
PDH object with its type and raw value. Windows PowerShell 5.1 can do this
through .NET; `RawValue` and `BaseValue` are what `pdh.CounterTypeRaw` returns
as first and second value:
```powershell
$cat = [System.Diagnostics.PerformanceCounterCategory]'DirectoryServices'
$cat.GetCounters('NTDS') | ForEach-Object {
$s = $_.NextSample()
'{0} | {1} | raw={2} base={3}' -f $_.CounterName, $_.CounterType, $s.RawValue, $s.BaseValue
}
```
Every PDH-based collector except `exchange`, `smtp` and `vmware` has such a
dump in the `AGENTS.md` of its directory, including roles that are rarely
available on development machines (AD DS, AD CS, AD FS, DFSR, Hyper-V, IIS,
SQL Server, NPS, RemoteFX sessions). Check a type or unit question there
first.
## Dashboards, rules and runbooks
Read [`contrib/mixin/README.md`](contrib/mixin/README.md) and
internal/collector/ad/AGENTS.md
+311
View File
@@ -0,0 +1,311 @@
# `ad` collector
The collector reads the PDH object `DirectoryServices` (instance `NTDS`, the
only instance) with `pdh.CounterTypeRaw`. The object exists only on a domain
controller, so most development machines and CI runners cannot read it. The
notes below were recorded on a Windows Server 2025 DC (forest with one DC,
light lab traffic) so that changes can be checked without one. Re-check them on
a DC when one is available.
## Raw counter types
`pdh.CounterTypeRaw` returns the raw first value and, for fractions, the base
as second value. On this object the raw value of every type is either a
cumulative count or an instantaneous value:
- `PERF_COUNTER_COUNTER` (`RateOfCountsPerSecond32`): every counter whose name
ends in `/sec`, plus `Transitive operations milliseconds run` and
`DirSync session throttling rate`. The raw value is a cumulative count since
NTDS start; publish it as a counter.
- `PERF_RAW_FRACTION` (`RawFraction`): the 23 `DS % {Reads,Searches,Writes}
{from DRA,KCC,LDAP,LSA,NSPI,NTDSAPI,SAM}` and `DS % ... Other` counters (no
`DS % Reads from LDAP` exists). The raw value is a cumulative count of
operations from that origin; the base equals the raw value of
`DS Directory Reads/sec`, `DS Directory Searches/sec` or
`DS Directory Writes/sec`. Publish the numerator as a counter.
- `PERF_SAMPLE_FRACTION` (`SampleFraction`): `DS Name Cache hit rate`. Raw is
cumulative hits, base (`,secondvalue`) is cumulative lookups; both counters.
- `PERF_COUNTER_LARGE_RAWCOUNT` (`NumberOfItems64`):
`PDC successful password update notifications` and
`PDC failed password update notifications`, both cumulative.
- `PERF_COUNTER_RAWCOUNT` (`NumberOfItems32`): everything else. The type does
not say whether the value is a gauge, so go by the name:
- Cumulative since NTDS start: every name ending in `since boot`
(`DRA ... Since Boot` bytes, `DRA number of ... NC replication calls`,
`DRA total time of ...` (milliseconds), `DRA total number of
{Busy,MissingParent,NotEnoughAttrs/MissingObject,Preempted} failures`,
`RID Pool request successes/failures`, `RID Pool invalidations`,
`{Info,Warning,Error} eventlogs`, `{Warning,Error,Fatal} events`),
`DRA Sync Requests Made`, `DRA Sync Requests Successful`,
`DRA Sync Failures on Schema Mismatch`, `LDAP {Add,Modify,Modify DN,Delete}
Operations`, `LDAP Outbound Bytes`, `LDAP busy retries`, `Links added`,
`Links visited`, `Logical link deletes`, `Physical link deletes`,
`Objects visited`, `Objects returned`, `Replicate Single Object operations`,
and the `DRA Highest USN {Committed,Issued} ({High,Low} part)` pairs
(monotonic, combine as `high<<32 + low`).
- Instantaneous: thread counts (`DS Threads in Use`, `ATQ Threads
{LDAP,Other,Total}`, `LDAP Active Threads`, `LDAP Threads Sleeping on
BUSY`, `DRA Threads Getting NC Changes [Holding Semaphore]`), sessions
(`LDAP Client Sessions`, `AB Client Sessions`, `DirSync sessions in
progress`), queue and list sizes (`DS Monitor List Size`,
`DS Notify Queue Size`, `ATQ Outstanding Queued Requests`,
`DS Security Descriptor Propagations Events`,
`DS Security Descriptor Propagator Runtime Queue`,
`DRA Pending Replication Operations/Synchronizations`,
`DRA Inbound ... Remaining [in Packet]`, `LDAP batch slots available`,
`LDAP Page Search Cache size/entries count`), `Approximate highest DNT`,
and latencies in milliseconds: `ATQ Estimated Queue Delay`,
`ATQ Request Latency`, `ATQ Queue Latency`, `LDAP Bind Time` (last
successful bind), `SAM Account/Resource Group Evaluation Latency` (mean of
the last 100 evaluations) and
`DS Security Descriptor Propagator Average Exclusion Time`.
Most `X` / `X/sec` pairs report the same raw value (for example
`LDAP Add Operations` and `LDAP Add Operations/sec`). `Objects visited/sec` and
`Objects returned/sec` do not: they stayed 0 while `Objects visited` and
`Objects returned` counted. Read the plain counter for those.
## Sample
Raw values from the DC, about one hour after NTDS start:
```text
LDAP Searches/sec 1968 DS Directory Searches/sec 1524
LDAP Successful Binds/sec 213 DS % Searches from LDAP 1231 / 1524
Negotiated Binds/sec 209 DS % Writes from LSA 12 / 228
NTLM Binds/sec 2 DS % Searches from LSA 9 / 1524
LDAP New Connections/sec 233 DS Name Cache hit rate 69119 / 90091
LDAP Client Sessions 12 DRA Highest USN Committed 61682 (high 0)
DS Monitor List Size 24 Approximate highest DNT 5376
ATQ Threads Total 6 LDAP batch slots available 192
LDAP Outbound Bytes 5706176 Warning events since boot 8256
```
The DC had no replication partner, so all `DRA` counters were 0.
## Checking a change without a DC
`ad_test.go` skips when `DirectoryServices` is missing, so a passing test on a
machine without AD DS checks nothing. To check emitted
values, build `perfDataCounterValues` rows by hand from the types above (a
fraction's base goes into the `,secondvalue` field) and gather the metrics
through a registry. The mapping from struct field to metric and label is the
part most likely to be wrong: compare each `MustNewConstMetric` call with the
`perfdata` tag of the field it reads.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `DirectoryServices`
Multi-instance. Instances: `NTDS`. Sample instance: `NTDS`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `AB ANR/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `AB Browses/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `AB Client Sessions` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `AB Matches/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `AB Property Reads/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `AB Proxy Lookups/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `AB Searches/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Approximate highest DNT` | `PERF_COUNTER_RAWCOUNT` | 5376 | |
| `ATQ Estimated Queue Delay` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `ATQ Outstanding Queued Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `ATQ Queue Latency` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `ATQ Request Latency` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `ATQ Threads LDAP` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `ATQ Threads Other` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `ATQ Threads Total` | `PERF_COUNTER_RAWCOUNT` | 6 | |
| `Base searches/sec` | `PERF_COUNTER_COUNTER` | 1081 | |
| `Database adds/sec` | `PERF_COUNTER_COUNTER` | 71 | |
| `Database deletes/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Database modifys/sec` | `PERF_COUNTER_COUNTER` | 157 | |
| `Database recycles/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Digest Binds/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DirSync session throttling rate` | `PERF_COUNTER_COUNTER` | 0 | |
| `DirSync sessions in progress` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Highest USN Committed (High part)` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Highest USN Committed (Low part)` | `PERF_COUNTER_RAWCOUNT` | 61683 | |
| `DRA Highest USN Issued (High part)` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Highest USN Issued (Low part)` | `PERF_COUNTER_RAWCOUNT` | 61683 | |
| `DRA Inbound Bytes Compressed (Between Sites, After Compression) Since Boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Inbound Bytes Compressed (Between Sites, After Compression)/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Inbound Bytes Compressed (Between Sites, Before Compression) Since Boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Inbound Bytes Compressed (Between Sites, Before Compression)/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Inbound Bytes Not Compressed (Within Site) Since Boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Inbound Bytes Not Compressed (Within Site)/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Inbound Bytes Total Since Boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Inbound Bytes Total/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Inbound Full Sync Objects Remaining` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Inbound Link Value Updates Remaining in Packet` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Inbound Link Values/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Inbound Object Updates Remaining in Packet` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Inbound Objects Applied/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Inbound Objects Filtered/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Inbound Objects/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Inbound Properties Applied/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Inbound Properties Filtered/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Inbound Properties Total/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Inbound Sync Link Deletion/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Inbound Total Updates Remaining in Packet` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Inbound Values (DNs only)/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Inbound Values Total/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA number of NC replication calls since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA number of successful NC replication calls since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Outbound Bytes Compressed (Between Sites, After Compression) Since Boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Outbound Bytes Compressed (Between Sites, After Compression)/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Outbound Bytes Compressed (Between Sites, Before Compression) Since Boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Outbound Bytes Compressed (Between Sites, Before Compression)/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Outbound Bytes Not Compressed (Within Site) Since Boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Outbound Bytes Not Compressed (Within Site)/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Outbound Bytes Total Since Boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Outbound Bytes Total/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Outbound Objects Filtered/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Outbound Objects/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Outbound Properties/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Outbound Values (DNs only)/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Outbound Values Total/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `DRA Pending Replication Operations` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Pending Replication Synchronizations` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Sync Failures on Schema Mismatch` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Sync Requests Made` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Sync Requests Successful` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Threads Getting NC Changes` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA Threads Getting NC Changes Holding Semaphore` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA total number of Busy failures since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA total number of MissingParent failures since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA total number of NotEnoughAttrs/MissingObject failures since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA total number of Preempted failures since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA total time of applying replication package since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA total time of NC replication calls since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA total time of successful NC replication calls since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA total time of successfully applying replication package since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA total time on waiting async replication packages since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DRA total time on waiting sync replication packages since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DS % Reads from DRA` | `PERF_RAW_FRACTION` | 0 | 2227 |
| `DS % Reads from KCC` | `PERF_RAW_FRACTION` | 80 | 2227 |
| `DS % Reads from LSA` | `PERF_RAW_FRACTION` | 70 | 2227 |
| `DS % Reads from NSPI` | `PERF_RAW_FRACTION` | 0 | 2227 |
| `DS % Reads from NTDSAPI` | `PERF_RAW_FRACTION` | 0 | 2227 |
| `DS % Reads from SAM` | `PERF_RAW_FRACTION` | 1977 | 2227 |
| `DS % Reads Other` | `PERF_RAW_FRACTION` | 100 | 2227 |
| `DS % Searches from DRA` | `PERF_RAW_FRACTION` | 0 | 2003 |
| `DS % Searches from KCC` | `PERF_RAW_FRACTION` | 28 | 2003 |
| `DS % Searches from LDAP` | `PERF_RAW_FRACTION` | 1637 | 2003 |
| `DS % Searches from LSA` | `PERF_RAW_FRACTION` | 9 | 2003 |
| `DS % Searches from NSPI` | `PERF_RAW_FRACTION` | 0 | 2003 |
| `DS % Searches from NTDSAPI` | `PERF_RAW_FRACTION` | 161 | 2003 |
| `DS % Searches from SAM` | `PERF_RAW_FRACTION` | 95 | 2003 |
| `DS % Searches Other` | `PERF_RAW_FRACTION` | 73 | 2003 |
| `DS % Writes from DRA` | `PERF_RAW_FRACTION` | 0 | 228 |
| `DS % Writes from KCC` | `PERF_RAW_FRACTION` | 0 | 228 |
| `DS % Writes from LDAP` | `PERF_RAW_FRACTION` | 115 | 228 |
| `DS % Writes from LSA` | `PERF_RAW_FRACTION` | 12 | 228 |
| `DS % Writes from NSPI` | `PERF_RAW_FRACTION` | 0 | 228 |
| `DS % Writes from NTDSAPI` | `PERF_RAW_FRACTION` | 9 | 228 |
| `DS % Writes from SAM` | `PERF_RAW_FRACTION` | 91 | 228 |
| `DS % Writes Other` | `PERF_RAW_FRACTION` | 1 | 228 |
| `DS Client Binds/sec` | `PERF_COUNTER_COUNTER` | 136 | |
| `DS Client Name Translations/sec` | `PERF_COUNTER_COUNTER` | 81 | |
| `DS Directory Reads/sec` | `PERF_COUNTER_COUNTER` | 2227 | |
| `DS Directory Searches/sec` | `PERF_COUNTER_COUNTER` | 2003 | |
| `DS Directory Writes/sec` | `PERF_COUNTER_COUNTER` | 228 | |
| `DS Monitor List Size` | `PERF_COUNTER_RAWCOUNT` | 24 | |
| `DS Name Cache hit rate` | `PERF_SAMPLE_FRACTION` | 80335 | 101578 |
| `DS Notify Queue Size` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DS Search sub-operations/sec` | `PERF_COUNTER_COUNTER` | 10617 | |
| `DS Security Descriptor Propagations Events` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DS Security Descriptor Propagator Average Exclusion Time` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DS Security Descriptor Propagator Runtime Queue` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `DS Security Descriptor sub-operations/sec` | `PERF_COUNTER_COUNTER` | 17 | |
| `DS Server Binds/sec` | `PERF_COUNTER_COUNTER` | 1 | |
| `DS Server Name Translations/sec` | `PERF_COUNTER_COUNTER` | 13 | |
| `DS Threads in Use` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Error eventlogs since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Error events since boot` | `PERF_COUNTER_RAWCOUNT` | 46 | |
| `External Binds/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Fast Binds/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Fatal events since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Info eventlogs since boot` | `PERF_COUNTER_RAWCOUNT` | 18 | |
| `LDAP Active Threads` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `LDAP Add Operations` | `PERF_COUNTER_RAWCOUNT` | 66 | |
| `LDAP Add Operations/sec` | `PERF_COUNTER_COUNTER` | 66 | |
| `LDAP batch slots available` | `PERF_COUNTER_RAWCOUNT` | 192 | |
| `LDAP Bind Time` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `LDAP busy retries` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `LDAP busy retries/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `LDAP Client Sessions` | `PERF_COUNTER_RAWCOUNT` | 8 | |
| `LDAP Closed Connections/sec` | `PERF_COUNTER_COUNTER` | 269 | |
| `LDAP Delete Operations` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `LDAP Delete Operations/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `LDAP Modify DN Operations` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `LDAP Modify DN Operations/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `LDAP Modify Operations` | `PERF_COUNTER_RAWCOUNT` | 45 | |
| `LDAP Modify Operations/sec` | `PERF_COUNTER_COUNTER` | 45 | |
| `LDAP New Connections/sec` | `PERF_COUNTER_COUNTER` | 277 | |
| `LDAP New SSL Connections/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `LDAP Outbound Bytes` | `PERF_COUNTER_RAWCOUNT` | 6254589 | |
| `LDAP Outbound Bytes/sec` | `PERF_COUNTER_COUNTER` | 6254589 | |
| `LDAP Page Search Cache entries count` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `LDAP Page Search Cache size` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `LDAP Searches/sec` | `PERF_COUNTER_COUNTER` | 2482 | |
| `LDAP Successful Binds/sec` | `PERF_COUNTER_COUNTER` | 257 | |
| `LDAP Threads Sleeping on BUSY` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `LDAP UDP operations/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `LDAP Writes/sec` | `PERF_COUNTER_COUNTER` | 111 | |
| `Link Values Cleaned/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Links added` | `PERF_COUNTER_RAWCOUNT` | 3 | |
| `Links added/sec` | `PERF_COUNTER_COUNTER` | 3 | |
| `Links visited` | `PERF_COUNTER_RAWCOUNT` | 2550 | |
| `Links visited/sec` | `PERF_COUNTER_COUNTER` | 2550 | |
| `Logical link deletes` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Logical link deletes/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Negotiated Binds/sec` | `PERF_COUNTER_COUNTER` | 253 | |
| `NTLM Binds/sec` | `PERF_COUNTER_COUNTER` | 2 | |
| `Objects returned` | `PERF_COUNTER_RAWCOUNT` | 24196 | |
| `Objects returned/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Objects visited` | `PERF_COUNTER_RAWCOUNT` | 31489 | |
| `Objects visited/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Onelevel searches/sec` | `PERF_COUNTER_COUNTER` | 287 | |
| `PDC failed password update notifications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `PDC password update notifications/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `PDC successful password update notifications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Phantoms Cleaned/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Phantoms Visited/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Physical link deletes` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Physical link deletes/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Replicate Single Object operations` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Replicate Single Object operations/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `RID Pool invalidations since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `RID Pool request failures since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `RID Pool request successes since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `SAM Account Group Evaluation Latency` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `SAM Display Information Queries/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `SAM Domain Local Group Membership Evaluations/sec` | `PERF_COUNTER_COUNTER` | 1002 | |
| `SAM Enumerations/sec` | `PERF_COUNTER_COUNTER` | 6 | |
| `SAM GC Evaluations/sec` | `PERF_COUNTER_COUNTER` | 1 | |
| `SAM Global Group Membership Evaluations/sec` | `PERF_COUNTER_COUNTER` | 160 | |
| `SAM Machine Creation Attempts/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `SAM Membership Changes/sec` | `PERF_COUNTER_COUNTER` | 7 | |
| `SAM Non-Transitive Membership Evaluations/sec` | `PERF_COUNTER_COUNTER` | 4700 | |
| `SAM Password Changes/sec` | `PERF_COUNTER_COUNTER` | 1 | |
| `SAM Resource Group Evaluation Latency` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `SAM Successful Computer Creations/sec: Includes all requests` | `PERF_COUNTER_COUNTER` | 0 | |
| `SAM Successful User Creations/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `SAM Transitive Membership Evaluations/sec` | `PERF_COUNTER_COUNTER` | 1498 | |
| `SAM Universal Group Membership Evaluations/sec` | `PERF_COUNTER_COUNTER` | 336 | |
| `SAM User Creation Attempts/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Simple Binds/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Subtree searches/sec` | `PERF_COUNTER_COUNTER` | 635 | |
| `Tombstones Garbage Collected/sec` | `PERF_COUNTER_COUNTER` | 37 | |
| `Tombstones Visited/sec` | `PERF_COUNTER_COUNTER` | 41 | |
| `Transitive operations milliseconds run` | `PERF_COUNTER_COUNTER` | 0 | |
| `Transitive operations/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Transitive suboperations/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Warning eventlogs since boot` | `PERF_COUNTER_RAWCOUNT` | 5 | |
| `Warning events since boot` | `PERF_COUNTER_RAWCOUNT` | 10302 | |
internal/collector/adcs/AGENTS.md
+55
View File
@@ -0,0 +1,55 @@
# `adcs` collector
The collector reads the PDH object `Certification Authority` with
`pdh.CounterTypeRaw`. It exists only on a server running Active Directory
Certificate Services (`CertSvc`). These notes were recorded on a Windows
Server 2025 enterprise root CA so that changes can be checked without one.
- Instances are certificate template names, plus `_Total`. An enterprise CA
has the default templates loaded, so the object has instances even before
any request was made, for example `Administrator`, `DirectoryEmailReplication`,
`DomainController`, `DomainControllerAuthentication`, `EFS`, `EFSRecovery`,
`KerberosAuthentication`, `Machine`, `SubCA`, `User` and `WebServer`. The
collector publishes them as `cert_template` and drops `_Total`.
- All 13 counters exist on every instance:
- `Requests/sec`, `Retrievals/sec`, `Failed Requests/sec`,
`Issued Requests/sec`, `Pending Requests/sec`, `Challenge Responses/sec`
and `Signed Certificate Timestamp Lists/sec` are `PERF_COUNTER_COUNTER`
(`RateOfCountsPerSecond32`); the raw value is a cumulative count since
CertSvc start.
- The six `... processing time (ms)` / `... signing time (ms)` counters are
`PERF_COUNTER_RAWCOUNT` (`NumberOfItems32`): the duration of the last
operation in milliseconds, a gauge.
- The separate object `Certification Authority Connections` (instance
`_Total`) has one counter, `Active connections` (`NumberOfItems32`). The
collector does not read it.
- A fresh CA reports 0 for every counter. Issuing a certificate changes the
CA database, so do not request certificates on a shared machine just to get
non-zero values.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `Certification Authority`
Multi-instance. Instances: `_Total`, `Administrator`, `DirectoryEmailReplication`, `DomainController`, `DomainControllerAuthentication`, `EFS`, `EFSRecovery`, `KerberosAuthentication`, ... (12 in total). Sample instance: `Administrator`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Challenge Response processing time (ms)` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Challenge Responses/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Failed Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Issued Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Pending Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Request cryptographic signing time (ms)` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Request policy module processing time (ms)` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Request processing time (ms)` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Retrieval processing time (ms)` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Retrievals/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Signed Certificate Timestamp List processing time (ms)` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Signed Certificate Timestamp Lists/sec` | `PERF_COUNTER_COUNTER` | 0 | |
internal/collector/adfs/AGENTS.md
+117
View File
@@ -0,0 +1,117 @@
# `adfs` collector
The collector reads the single-instance PDH object `AD FS` with
`pdh.CounterTypeRaw`. It exists only on a server running the AD FS service
(`adfssrv`). These notes were recorded on a Windows Server 2025 AD FS farm with
one node (WID configuration database) so that changes can be checked without
one.
## Raw counter types
- Each event has a cumulative counter of type `PERF_COUNTER_LARGE_RAWCOUNT`
(`NumberOfItems64`), for example `Token Requests`, and most have a twin with
a `/Sec` suffix of type `PERF_COUNTER_BULK_COUNT`
(`RateOfCountsPerSecond64`) with the same raw value. Read the plain name and
publish it as a counter. Some failure counters have no `/Sec` twin, and some
twins differ in spelling (`OAuth Client Authentications Failures` vs.
`OAuth Client Authentication Failures/Sec`), so copy names from a counter
dump, not from the twin.
- `Average Config Database Query Time`, `Average Artifact Database Query Time`
and `Average Search Latency for Alternate Login ID` are
`PERF_AVERAGE_TIMER` (`AverageTimer32`). The raw value is the summed
duration in ticks of the counter's time base (`PdhGetCounterTimeBase`,
10 MHz on the test host, same as `QueryPerformanceFrequency`); the base
(`,secondvalue`) is the number of operations. `pdh.CounterTypeRaw` does not
convert this type, and `internal/pdh` reads the time base only for
`PERF_ELAPSED_TIME`. Seconds are `raw / time base`; do not hardcode a scale
factor.
- Sample after about one hour: `Average Config Database Query Time` raw
11521176, base 306, which is 1.152 s in total, 3.8 ms per query.
`Federation Metadata Requests` was 1, all authentication counters 0.
## Counters
The object has about 150 counters on Server 2025. Besides the ones in
`types.go`, it has (each with `/Sec` twin unless noted): `Additional
Authentications` (MFA), `Device Authentication Failures`, `Federated
Authentication Failures`, `Microsoft Passport Authentication Failures`,
`Microsoft Passport Request [Failures]`, `Primary Device Authentications` and
`... Failures`, `Azure Primary Authentications` and `... Failures`,
`Alternate Login Id Authentications`, `Artifact Resolution Requests`,
`MSIS HTTP Token Requests`, `OAuth On Behalf Of Token Requests` and
`... Request Failures`, `OAuth VPN Certificate Token Requests` and
`... Request Failures`, `OAuth Device Flow {successful,failed} {device code,
usercode retrieval} requests`, `WebFinger Requests [Failures]`,
`UserInfo Requests [Failures]`, `Windows Hello Certificate Request [Failures]`,
`Token Requests/Sec`, the `Token Binding Requests ...` counters and the
`WIA` evaluation counters (no `/Sec` twins).
Other AD FS objects (`AD FS Domain Connection Counters`, `AD FS Attribute Store
Counters`, `AD FS Local Claims Provider Connections`, `AD FS Cryptographic
Counters`, `AD FS External Authentication Provider Counters`, `AD FS Inter-node
Communication Counters`) are multi-instance and had no instances on the
one-node farm. Their counters are `AverageTimer32` averages with
`NumberOfItems64` failure counts.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `AD FS`
Single-instance.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `AD Login Connection Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Artifact Database Connection Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Average Artifact Database Query Time` | `PERF_AVERAGE_TIMER` | 0 | 0 |
| `Average Config Database Query Time` | `PERF_AVERAGE_TIMER` | 11893699 | 333 |
| `Certificate Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Configuration Database Connection Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Device Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `External Authentication Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `External Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Extranet Account Lockouts` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Federated Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Federation Metadata Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1 | |
| `Microsoft Passport Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `OAuth AuthZ Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `OAuth Client Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `OAuth Client Authentications Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `OAuth Client Credentials Request Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `OAuth Client Credentials Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `OAuth Client Private Key Jwt Authentication Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `OAuth Client Private Key Jwt Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `OAuth Client Secret Basic Authentication Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `OAuth Client Secret Basic Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `OAuth Client Secret Post Authentication Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `OAuth Client Secret Post Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `OAuth Client Windows Integrated Authentication Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `OAuth Client Windows Integrated Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `OAuth Logon Certificate Request Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `OAuth Logon Certificate Token Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `OAuth Password Grant Request Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `OAuth Password Grant Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `OAuth Token Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Passive Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Password Change Failed Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Password Change Successful Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `SAML-P Token Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `SSO Authentication Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `SSO Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Token Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `U/P Authentication Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `U/P Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Windows Integrated Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `WS-Fed Token Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `WS-Trust Token Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
Not read by the collector:
- `PERF_AVERAGE_TIMER`: `Average Search Latency for Alternate Login ID`
- `PERF_COUNTER_BULK_COUNT`: `Additional Authentications/Sec`, `Alternate Login Id Authentications/Sec`, `Artifact Resolution Requests/Sec`, `Azure Primary Authentication Failures/Sec`, `Azure Primary Authentications/Sec`, `Certificate Authentications/Sec`, `Device Authentications/Sec`, `External Authentications/Sec`, `Federated Authentications/Sec`, `Federation Metadata Requests/Sec`, `Microsoft Passport Authentications Failures/Sec`, `Microsoft Passport Authentications/Sec`, `Microsoft Passport Request Failures/Sec`, `Microsoft Passport Request/Sec`, `MSIS HTTP Token Requests/Sec`, `OAuth AuthZ Requests/Sec`, `OAuth Client Authentication Failures/Sec`, `OAuth Client Authentications/Sec`, `OAuth Client Credentials Request Failures/Sec`, `OAuth Client Credentials Requests/Sec`, `OAuth Client Private Key Jwt Authentication Failures/Sec`, `OAuth Client Private Key Jwt Authentications/Sec`, `OAuth Client Secret Basic Authentication Failures/Sec`, `OAuth Client Secret Basic Authentications/Sec`, `OAuth Client Secret Post Authentication Failures/Sec`, `OAuth Client Secret Post Authentications/Sec`, `OAuth Client Windows Integrated Authentication Failures/Sec`, `OAuth Client Windows Integrated Authentications/Sec`, `OAuth Device Flow failed device code requests/sec`, `OAuth Device Flow failed usercode retrieval requests/sec`, `OAuth Device Flow successful device code requests/sec`, `OAuth Device Flow successful usercode retrieval requests/sec`, `OAuth Logon Certificate Request Failures/Sec`, `OAuth Logon Certificate Token Requests/Sec`, `OAuth On Behalf Of Request Failures/Sec`, `OAuth On Behalf Of Token Requests/Sec`, `OAuth Password Grant Requests Failures/Sec`, `OAuth Password Grant Requests/Sec`, `OAuth Token Requests/Sec`, `OAuth VPN Certificate Request Failures/Sec`, `OAuth VPN Certificate Token Requests/Sec`, `Passive Requests/Sec`, `Primary Device Authentications/Sec`, `SAML-P Token Requests/Sec`, `SSO Authentications/Sec`, `Token Requests/Sec`, `U/P Authentication Failures/Sec`, `U/P Authentications/Sec`, `UserInfo Requests Failures/Sec`, `UserInfo Requests/Sec`, `WebFinger Requests Failures/Sec`, `WebFinger Requests/Sec`, `Windows Hello Certificate Request Failures/Sec`, `Windows Hello Certificate Request/Sec`, `Windows Integrated Authentications/Sec`, `WS-Fed Token Requests/Sec`, `WS-Trust Token Requests/Sec`
- `PERF_COUNTER_LARGE_RAWCOUNT`: `Additional Authentications`, `Alternate Login Id Authentications`, `Artifact Resolution Requests`, `Azure Primary Authentication Failures`, `Azure Primary Authentications`, `Device Authentication Failures`, `Failed WIA Evaluation Requests`, `Federated Authentication Failures`, `Microsoft Passport Authentication Failures`, `Microsoft Passport Request Failures`, `Microsoft Passport Request`, `MSIS HTTP Token Requests`, `OAuth Device Flow failed device code requests`, `OAuth Device Flow failed usercode retrieval requests`, `OAuth Device Flow successful device code requests`, `OAuth Device Flow successful usercode retrieval requests`, `OAuth On Behalf Of Request Failures`, `OAuth On Behalf Of Token Requests`, `OAuth VPN Certificate Request Failures`, `OAuth VPN Certificate Token Requests`, `Primary Device Authentication Failures`, `Primary Device Authentications`, `Token Binding Requests Received with a Provided Binding ID`, `Token Binding Requests Received with a Referred Binding ID`, `Token Binding Requests Received`, `Token Binding Requests that contain an invalid token binding in a federated request scenario`, `Token Binding Requests that contain an invalid token binding in a non-federated request scenario`, `Token Binding Requests that failed due to invalid binding`, `Total WIA Evaluation Requests`, `UserInfo Requests Failures`, `UserInfo Requests`, `WebFinger Requests Failures`, `WebFinger Requests`, `WIA Cookied Requests`, `WIA No Cookied Requests`, `WIA Yes Cookied Requests`, `Windows Hello Certificate Request Failures`, `Windows Hello Certificate Request`
internal/collector/cache/AGENTS.md
Vendored
+69
View File
@@ -0,0 +1,69 @@
# `cache` collector
The collector reads the single-instance PDH object `Cache` (file system cache)
with `pdh.CounterTypeRaw`. The object exists on every Windows host, so no role
is needed. These notes were recorded on Windows Server 2025 (build 26100).
- Every `PERF_COUNTER_COUNTER` (`/sec`) counter is a cumulative count since
boot. In the sample, each `Sync ...` plus `Async ...` pair adds up exactly to
its total: `Copy Reads/sec`, `Data Maps/sec`, `Fast Reads/sec`,
`MDL Reads/sec` and `Pin Reads/sec`.
- The four `... Hits %` counters are `PERF_SAMPLE_FRACTION`. The raw value is
the cumulative hit count, not a percentage. The base (`,secondvalue`) is the
cumulative count of attempts and equals the raw value of the matching
`/sec` counter: `Copy Read Hits %` with `Copy Reads/sec`, `Data Map Hits %`
with `Data Maps/sec`, `MDL Read Hits %` with `MDL Reads/sec` and
`Pin Read Hits %` with `Pin Reads/sec`. The hit ratio is
rate(raw) / rate(base).
- `Data Map Pins/sec` is also `PERF_SAMPLE_FRACTION`, despite its name. Its raw
value is the cumulative count of data maps that pinned a page; its base is
`Data Maps/sec`.
- `Data Flushes/sec` and `Lazy Write Flushes/sec` count write operations;
`Data Flush Pages/sec` and `Lazy Write Pages/sec` count pages. One operation
can move more than one page.
- `Dirty Pages` and `Dirty Page Threshold` are gauges in pages, not bytes.
- `Async Fast Reads/sec`, `Async MDL Reads/sec` and
`Fast Read Resource Misses/sec` stayed 0 on this host.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `Cache`
Single-instance.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Async Copy Reads/sec` | `PERF_COUNTER_COUNTER` | 35778 | |
| `Async Data Maps/sec` | `PERF_COUNTER_COUNTER` | 2 | |
| `Async Fast Reads/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Async MDL Reads/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Async Pin Reads/sec` | `PERF_COUNTER_COUNTER` | 12297 | |
| `Copy Read Hits %` | `PERF_SAMPLE_FRACTION` | 1607787 | 3347074 |
| `Copy Reads/sec` | `PERF_COUNTER_COUNTER` | 3347074 | |
| `Data Flush Pages/sec` | `PERF_COUNTER_COUNTER` | 9099373 | |
| `Data Flushes/sec` | `PERF_COUNTER_COUNTER` | 655879 | |
| `Data Map Hits %` | `PERF_SAMPLE_FRACTION` | 67204750 | 67331258 |
| `Data Map Pins/sec` | `PERF_SAMPLE_FRACTION` | 12144215 | 67331258 |
| `Data Maps/sec` | `PERF_COUNTER_COUNTER` | 67331258 | |
| `Dirty Page Threshold` | `PERF_COUNTER_LARGE_RAWCOUNT` | 2097010 | |
| `Dirty Pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 175 | |
| `Fast Read Not Possibles/sec` | `PERF_COUNTER_COUNTER` | 206860 | |
| `Fast Read Resource Misses/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Fast Reads/sec` | `PERF_COUNTER_COUNTER` | 2861445 | |
| `Lazy Write Flushes/sec` | `PERF_COUNTER_COUNTER` | 276157 | |
| `Lazy Write Pages/sec` | `PERF_COUNTER_COUNTER` | 5836457 | |
| `MDL Read Hits %` | `PERF_SAMPLE_FRACTION` | 1958 | 1959 |
| `MDL Reads/sec` | `PERF_COUNTER_COUNTER` | 1959 | |
| `Pin Read Hits %` | `PERF_SAMPLE_FRACTION` | 3216022 | 3671006 |
| `Pin Reads/sec` | `PERF_COUNTER_COUNTER` | 3671006 | |
| `Read Aheads/sec` | `PERF_COUNTER_COUNTER` | 2012322 | |
| `Sync Copy Reads/sec` | `PERF_COUNTER_COUNTER` | 3311296 | |
| `Sync Data Maps/sec` | `PERF_COUNTER_COUNTER` | 67331256 | |
| `Sync Fast Reads/sec` | `PERF_COUNTER_COUNTER` | 2861445 | |
| `Sync MDL Reads/sec` | `PERF_COUNTER_COUNTER` | 1959 | |
| `Sync Pin Reads/sec` | `PERF_COUNTER_COUNTER` | 3658709 | |
internal/collector/cpu/AGENTS.md
+77
View File
@@ -0,0 +1,77 @@
# `cpu` collector
The collector reads the multi-instance PDH object `Processor Information`
with `pdh.CounterTypeRaw`. The object exists on every Windows host, so no role
is needed. These notes were recorded on Windows Server 2025 (build 26100), a
Hyper-V guest with 12 logical processors in one processor group.
- Instances are `<group>,<processor>`, for example `0,0` to `0,11`. Besides
`_Total` the object has one aggregate per processor group, `<group>,_Total`
(here `0,_Total`). `pdh.IsTotalInstance` treats both as totals, so with
`pdh.InstancesAll` they are dropped and only per-processor rows remain. The
`core` label is the raw instance name, e.g. `0,3`.
- `% C1/C2/C3 Time`, `% DPC Time`, `% Idle Time`, `% Interrupt Time`,
`% Privileged Time` and `% User Time` are `PERF_100NSEC_TIMER`. Their raw
value is cumulative 100 ns ticks; `internal/pdh` scales them to seconds.
- `% Processor Time` and `% Priority Time` are `PERF_100NSEC_TIMER_INV`. The
raw value is cumulative idle (non-busy) time in 100 ns ticks, not busy time,
and `internal/pdh` does not scale this type to seconds. In the sample, the
raw value of `% Processor Time` equals `% Idle Time`.
- `% Processor Utility`, `% Processor Performance` and `% Privileged Utility`
are `PERF_AVERAGE_BULK`. Raw and base are both cumulative. The displayed
value is delta raw / delta base and is already a percentage (it can exceed
100). A 2 s sample on core `0,0` gave 63.4 for utility and 121.9 for
performance. The raw values of utility and performance are almost equal;
their bases differ. `% Processor Utility` and `% Privileged Utility` have
nearly equal bases that grew about 630 000 per second; the performance
base grew about 330 000 per second.
- `Interrupts/sec`, `DPCs Queued/sec` and `Clock Interrupts/sec`
(`PERF_COUNTER_COUNTER`) and `C1/C2/C3 Transitions/sec`,
`Idle Break Events/sec` (`PERF_COUNTER_BULK_COUNT`) are cumulative counts.
- `Processor Frequency` is a gauge in MHz (3700 here). `Parking Status` is a
gauge, 0 when the processor is not parked. `% Performance Limit` is a gauge
percentage (100 here). `% C3 Time` and `C3 Transitions/sec` stayed 0 on this
virtual machine.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `Processor Information`
Multi-instance. Instances: `_Total`, `0,_Total`, `0,0`, `0,1`, `0,10`, `0,11`, `0,2`, `0,3`, ... (14 in total). Sample instance: `0,0`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `% C1 Time` | `PERF_100NSEC_TIMER` | 3366958649 | |
| `% C2 Time` | `PERF_100NSEC_TIMER` | 21091589064 | |
| `% C3 Time` | `PERF_100NSEC_TIMER` | 0 | |
| `% DPC Time` | `PERF_100NSEC_TIMER` | 185312500 | |
| `% Idle Time` | `PERF_100NSEC_TIMER` | 25109218750 | |
| `% Interrupt Time` | `PERF_100NSEC_TIMER` | 257812500 | |
| `% Performance Limit` | `PERF_COUNTER_RAWCOUNT` | 100 | |
| `% Priority Time` | `PERF_100NSEC_TIMER_INV` | 26964687500 | |
| `% Privileged Time` | `PERF_100NSEC_TIMER` | 4745937500 | |
| `% Privileged Utility` | `PERF_AVERAGE_BULK` | 35875675583 | 2142017948 |
| `% Processor Performance` | `PERF_AVERAGE_BULK` | 80044724120 | 669031135 |
| `% Processor Time` | `PERF_100NSEC_TIMER_INV` | 25109218750 | |
| `% Processor Utility` | `PERF_AVERAGE_BULK` | 80044725697 | 2142017679 |
| `% User Time` | `PERF_100NSEC_TIMER` | 4394687500 | |
| `C1 Transitions/sec` | `PERF_COUNTER_BULK_COUNT` | 2303708 | |
| `C2 Transitions/sec` | `PERF_COUNTER_BULK_COUNT` | 2337838 | |
| `C3 Transitions/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Clock Interrupts/sec` | `PERF_COUNTER_COUNTER` | 1571877 | |
| `DPCs Queued/sec` | `PERF_COUNTER_COUNTER` | 561134 | |
| `Idle Break Events/sec` | `PERF_COUNTER_BULK_COUNT` | 4641550 | |
| `Interrupts/sec` | `PERF_COUNTER_COUNTER` | 7795204 | |
| `Parking Status` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Processor Frequency` | `PERF_COUNTER_RAWCOUNT` | 3700 | |
Not read by the collector:
- `PERF_AVERAGE_BULK`: `Actual Frequency`
- `PERF_COUNTER_RAWCOUNT`: `% of Maximum Frequency`, `DPC Rate`, `Performance Limit Flags`, `Processor State Flags`
- `PERF_PRECISION_100NS_TIMER`: `Average Idle Time`
internal/collector/dfsr/AGENTS.md
+103
View File
@@ -0,0 +1,103 @@
# `dfsr` collector
The collector reads three PDH objects with `pdh.CounterTypeRaw`:
`DFS Replication Connections`, `DFS Replicated Folders` and
`DFS Replication Service Volumes`. They exist only where the DFS Replication
service runs, for example on every domain controller (SYSVOL). CI does not
provision DFSR. These notes were recorded on a single Windows Server 2025 DC.
- Every counter of the three objects is `PERF_COUNTER_LARGE_RAWCOUNT`
(`NumberOfItems64`). The type does not say whether the value is cumulative,
so go by the counter help text:
- Cumulative since service start: the `... Generated`, `... Cleaned up`,
`... Received`, `File Installs ...`, `Updates Dropped`, `Database Commits`,
`Database Lookups` and `USN Journal Records Read/Accepted` counters.
- Gauges: `Staging/Conflict/Deleted Space In Use` (bytes),
`USN Journal Unread Percentage`, connection `Bytes Received Per Second`,
and `Bandwidth Savings Using DFS Replication`, which is a percentage
("a value of 20 indicates ... 20% less bandwidth"), not bytes.
- Instances: folders are `<replicated folder>-{<GUID>}`, for example
`SYSVOL Share-{DD658FCA-D7AE-487D-8E75-67481CEBE108}`; volumes are drive
letters (`C:`). A DC without replication partner has no instance of
`DFS Replication Connections`, so connection metrics are not exercised there.
- Sample from the DC (volume `C:`): `USN Journal Records Read` 1932712,
`Database Commits` 800998, `Database Lookups` 1058283,
`USN Journal Records Accepted` 0, `USN Journal Unread Percentage` 0. All
folder counters of SYSVOL were 0.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `DFS Replicated Folders`
Multi-instance. Instances: `SYSVOL Share-{DD658FCA-D7AE-487D-8E75-67481CEBE108}`. Sample instance: `SYSVOL Share-{DD658FCA-D7AE-487D-8E75-67481CEBE108}`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Bandwidth Savings Using DFS Replication` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Compressed Size of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Conflict Bytes Cleaned up` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Conflict Bytes Generated` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Conflict Files Cleaned up` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Conflict Files Generated` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Conflict Folder Cleanups Completed` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Conflict Space In Use` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Deleted Bytes Cleaned up` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Deleted Bytes Generated` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Deleted Files Cleaned up` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Deleted Files Generated` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Deleted Space In Use` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `File Installs Retried` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `File Installs Succeeded` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `RDC Bytes Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `RDC Compressed Size of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `RDC Number of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `RDC Size of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Size of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Staging Bytes Cleaned up` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Staging Bytes Generated` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Staging Files Cleaned up` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Staging Files Generated` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Staging Space In Use` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Total Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Updates Dropped` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
### `DFS Replication Connections`
Multi-instance. No instances on the recording host, so the table has types only.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Bandwidth Savings Using DFS Replication` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `Compressed Size of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `RDC Bytes Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `RDC Compressed Size of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `RDC Number of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `RDC Size of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `Size of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `Total Bytes Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `Total Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
Not read by the collector:
- `PERF_COUNTER_LARGE_RAWCOUNT`: `Bytes Received Per Second`
### `DFS Replication Service Volumes`
Multi-instance. Instances: `C:`. Sample instance: `C:`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Database Commits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 802516 | |
| `Database Lookups` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1060537 | |
| `USN Journal Records Accepted` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `USN Journal Records Read` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1936015 | |
| `USN Journal Unread Percentage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
internal/collector/dhcp/AGENTS.md
+64
View File
@@ -0,0 +1,64 @@
# `dhcp` collector
The server metrics come from the single-instance PDH object `DHCP Server`,
read with `pdh.CounterTypeRaw`. It exists only where the DHCP Server role is
installed. These notes were recorded on Windows Server 2025 (build 26100)
with a DHCP server that served no clients.
- Every `.../sec` counter is `PERF_COUNTER_COUNTER`. Its raw value is a
cumulative count since the DHCP service started; publish it as a counter.
- `PERF_COUNTER_RAWCOUNT` counters, by help text:
- Gauges: `Active Queue Length`, `Conflict Check Queue Length`,
`Offer Queue Length` (packets in a queue) and
`Failover: BndUpd pending in outbound queue.`
- Cumulative: `Denied due to match.`, `Denied due to nonmatch.`,
`Failover: BndUpd Dropped.` and the three
`Failover: Transitions to ... state.` counters.
- `Milliseconds per packet (Avg).` (not read) is an average in
milliseconds, not paired with a base.
- Many counter names end in a period, and some failover names in `/sec.`.
The `perfdata` tags must keep it.
- Only `Packets Received/sec` was nonzero on the recording host.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `DHCP Server`
Single-instance.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Acks/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Active Queue Length` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Conflict Check Queue Length` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Declines/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Denied due to match.` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Denied due to nonmatch.` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Discovers/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Duplicates Dropped/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Failover: BndAck received/sec.` | `PERF_COUNTER_COUNTER` | 0 | |
| `Failover: BndAck sent/sec.` | `PERF_COUNTER_COUNTER` | 0 | |
| `Failover: BndUpd Dropped.` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Failover: BndUpd pending in outbound queue.` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Failover: BndUpd received/sec.` | `PERF_COUNTER_COUNTER` | 0 | |
| `Failover: BndUpd sent/sec.` | `PERF_COUNTER_COUNTER` | 0 | |
| `Failover: Transitions to COMMUNICATION-INTERRUPTED state.` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Failover: Transitions to PARTNER-DOWN state.` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Failover: Transitions to RECOVER state.` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Informs/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Nacks/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Offer Queue Length` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Offers/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Packets Expired/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Packets Received/sec` | `PERF_COUNTER_COUNTER` | 59 | |
| `Releases/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | |
Not read by the collector:
- `PERF_COUNTER_RAWCOUNT`: `Milliseconds per packet (Avg).`
internal/collector/dns/AGENTS.md
+131
View File
@@ -0,0 +1,131 @@
# `dns` collector
The collector reads the single-instance PDH object `DNS` with
`pdh.CounterTypeRaw`, plus the `MicrosoftDNS_Statistic` class
(`Error Stats` collection) through MI. Both exist only where the DNS Server
role is installed. These notes were recorded on Windows Server 2025
(build 26100) on a domain controller that hosts AD-integrated zones and has no
secondary server, so zone transfer counters stayed 0.
- The type does not tell the kind. Every `X` counter that has an `X/sec` twin
is `PERF_COUNTER_RAWCOUNT` and cumulative, and the twin
(`PERF_COUNTER_COUNTER`) has the same raw value (`Total Query Received` 830
= `Total Query Received/sec` 830, `Dynamic Update Received` 165 = its
`/sec` twin). The help text calls the plain counters "the total number of".
- `WINS Reverse Lookup Received/sec` is `PERF_COUNTER_RAWCOUNT` despite its
name.
- Gauges: the `... Memory` counters ("total ... memory used by DNS server")
and `Total Remote Inflight Queries`. The help text gives no unit for the
memory counters.
- `Total Query Received` equals `UDP Query Received` + `TCP Query Received`
(830 = 820 + 10); `Total Response Sent` likewise (825 = 815 + 10).
- `Recursive Send TimeOuts` and `Recursive TimeOut/sec` are a twin pair with
different names; the collector reads the `/sec` one.
- Eleven counters of the object have names that belong to other objects and
no help text: `% User Time`, `Async Fast Reads/sec`,
`Fast Read Not Possibles/sec`, `Fast Read Resource Misses/sec`,
`Lazy Write Flushes/sec`, `Lazy Write Pages/sec`, `Data Flushes/sec`,
`Data Flush Pages/sec`, `Level 2 TLB Fills/sec`, `Enumerations Server/sec`
and `Virtual Bytes`. `Get-Counter -ListSet DNS` also lists a counter named
`176`. All of them stayed 0; the collector ignores them (`_` fields).
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `DNS`
Single-instance.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `% User Time` | `PERF_COUNTER_COUNTER` | 0 | |
| `Async Fast Reads/sec` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `AXFR Request Received` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `AXFR Request Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `AXFR Response Received` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `AXFR Success Received` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `AXFR Success Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Caching Memory` | `PERF_COUNTER_RAWCOUNT` | 14216 | |
| `Data Flush Pages/sec` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Data Flushes/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Database Node Memory` | `PERF_COUNTER_RAWCOUNT` | 21958 | |
| `Dynamic Update NoOperation` | `PERF_COUNTER_RAWCOUNT` | 118 | |
| `Dynamic Update NoOperation/sec` | `PERF_COUNTER_COUNTER` | 118 | |
| `Dynamic Update Queued` | `PERF_COUNTER_RAWCOUNT` | 110 | |
| `Dynamic Update Received` | `PERF_COUNTER_RAWCOUNT` | 165 | |
| `Dynamic Update Received/sec` | `PERF_COUNTER_COUNTER` | 165 | |
| `Dynamic Update Rejected` | `PERF_COUNTER_RAWCOUNT` | 34 | |
| `Dynamic Update TimeOuts` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Dynamic Update Written to Database` | `PERF_COUNTER_RAWCOUNT` | 21 | |
| `Dynamic Update Written to Database/sec` | `PERF_COUNTER_COUNTER` | 21 | |
| `Enumerations Server/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Fast Read Not Possibles/sec` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Fast Read Resource Misses/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `IXFR Request Received` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `IXFR Request Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `IXFR Response Received` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `IXFR Success Received` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `IXFR Success Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `IXFR TCP Success Received` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `IXFR UDP Success Received` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Lazy Write Flushes/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Lazy Write Pages/sec` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Level 2 TLB Fills/sec` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Nbstat Memory` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Notify Received` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Notify Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Query Dropped Bad Socket` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Query Dropped Bad Socket/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Query Dropped By Policy` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Query Dropped By Policy/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Query Dropped By Response Rate Limiting` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Query Dropped By Response Rate Limiting/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Query Dropped Send` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Query Dropped Send/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Query Dropped Total` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Query Dropped Total/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Record Flow Memory` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Recursive Queries` | `PERF_COUNTER_RAWCOUNT` | 85 | |
| `Recursive Queries/sec` | `PERF_COUNTER_COUNTER` | 85 | |
| `Recursive Query Failure` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Recursive Query Failure/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Recursive Send TimeOuts` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Recursive TimeOut/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Responses Suppressed` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Responses Suppressed/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Secure Update Failure` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Secure Update Received` | `PERF_COUNTER_RAWCOUNT` | 8 | |
| `Secure Update Received/sec` | `PERF_COUNTER_COUNTER` | 8 | |
| `TCP Message Memory` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `TCP Query Received` | `PERF_COUNTER_RAWCOUNT` | 10 | |
| `TCP Query Received/sec` | `PERF_COUNTER_COUNTER` | 10 | |
| `TCP Response Sent` | `PERF_COUNTER_RAWCOUNT` | 10 | |
| `TCP Response Sent/sec` | `PERF_COUNTER_COUNTER` | 10 | |
| `Total Query Received` | `PERF_COUNTER_RAWCOUNT` | 830 | |
| `Total Query Received/sec` | `PERF_COUNTER_COUNTER` | 830 | |
| `Total Remote Inflight Queries` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Response Sent` | `PERF_COUNTER_RAWCOUNT` | 825 | |
| `Total Response Sent/sec` | `PERF_COUNTER_COUNTER` | 825 | |
| `UDP Message Memory` | `PERF_COUNTER_RAWCOUNT` | 447529584 | |
| `UDP Query Received` | `PERF_COUNTER_RAWCOUNT` | 820 | |
| `UDP Query Received/sec` | `PERF_COUNTER_COUNTER` | 820 | |
| `UDP Response Sent` | `PERF_COUNTER_RAWCOUNT` | 815 | |
| `UDP Response Sent/sec` | `PERF_COUNTER_COUNTER` | 815 | |
| `Unmatched Responses Received` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Virtual Bytes` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `WINS Lookup Received` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `WINS Lookup Received/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `WINS Response Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `WINS Response Sent/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `WINS Reverse Lookup Received` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `WINS Reverse Lookup Received/sec` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `WINS Reverse Response Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `WINS Reverse Response Sent/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Zone Transfer Failure` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Zone Transfer Request Received` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Zone Transfer SOA Request Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Zone Transfer Success` | `PERF_COUNTER_RAWCOUNT` | 0 | |
internal/collector/gpu/AGENTS.md
+110
View File
@@ -0,0 +1,110 @@
# `gpu` collector
The collector reads five PDH objects with `pdh.CounterTypeRaw`:
`GPU Engine`, `GPU Adapter Memory`, `GPU Local Adapter Memory`,
`GPU Non Local Adapter Memory` and `GPU Process Memory`. WDDM (dxgkrnl)
provides them, so they exist on any host with a WDDM display driver, including
the Microsoft Basic Render Driver on VMs without a GPU. These notes were
recorded on a Windows 11 workstation with an NVIDIA GeForce GTX 1070
(driver 32.0.15.8266).
- All counters the collector reads are `PERF_COUNTER_LARGE_RAWCOUNT`
(`NumberOfItems64`), so the raw value is the value:
- `Running Time` is cumulative engine busy time in 100 ns units. The
collector divides it by 10,000,000 for `engine_time_seconds`.
- The memory counters are gauges in bytes.
- `Utilization Percentage` is `PERF_100NSEC_TIMER` and has the same raw value
as `Running Time`; Task Manager derives the percentage from two samples.
The collector exports the counter instead, so `rate()` of
`engine_time_seconds` gives the utilization.
- Instance names encode the labels, see `parseGPUCounterInstanceString`:
- Engine: `pid_<pid>_luid_0x<high>_0x<low>_phys_<n>_eng_<n>_engtype_<type>`.
Types seen: `3D`, `Copy`, `LegacyOverlay`, `Security`, `VideoDecode`,
`VideoEncode`, `VR`. Other vendors append an index (`Compute_0`), which is
why `engtype` keeps everything after the key.
- Adapter memory: `luid_..._phys_<n>`. Local and non local adapter memory
may append `_part_<n>`, but not consistently: on the recording host the
NVIDIA adapter had a local instance without `part` and a non local
instance with `part_0`, while the second adapter had only a local
instance with `part_0`.
- Process memory: `pid_<pid>_luid_..._phys_<n>`.
- The recording host had two LUIDs: `0x00000000_0x0001120B` (the GTX 1070,
9 engines per process) and `0x00000000_0x0001241E`, which has no PnP display
device and 25 engines, all `3D`. The second one is presumably the Microsoft
Basic Render Driver (inferred, not verified).
- Engine instances are per process and engine: 510 instances across 40
processes on an ordinary desktop, 48 process memory instances. Every
process that opens a D3D device gets a full set of engine instances, so the
engine metric has high cardinality.
## Counter reference
Recorded on Windows 11 Pro (build 26300). `Raw` and `Base` are the first and
second values that `pdh.CounterTypeRaw` returns for the sample instance.
### `GPU Engine`
Multi-instance. 510 instances. Sample instance:
`pid_1064_luid_0x00000000_0x0001120B_phys_0_eng_0_engtype_3D` (`dwm`).
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Running Time` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1660393259 | |
Not read by the collector:
- `PERF_100NSEC_TIMER`: `Utilization Percentage`
### `GPU Adapter Memory`
Multi-instance. Instances: `luid_0x00000000_0x0001120B_phys_0`,
`luid_0x00000000_0x0001241E_phys_0`. Sample instance:
`luid_0x00000000_0x0001120B_phys_0`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Dedicated Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1641607168 | |
| `Shared Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 87773184 | |
| `Total Committed` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1962553344 | |
### `GPU Local Adapter Memory`
Multi-instance. Instances: `luid_0x00000000_0x0001120B_phys_0`,
`luid_0x00000000_0x0001241E_phys_0_part_0`. Sample instance:
`luid_0x00000000_0x0001120B_phys_0`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Local Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 903745536 | |
### `GPU Non Local Adapter Memory`
Multi-instance. Instances: `luid_0x00000000_0x0001120B_phys_0_part_0`.
Sample instance: `luid_0x00000000_0x0001120B_phys_0_part_0`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Non Local Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 87773184 | |
### `GPU Process Memory`
Multi-instance. 48 instances. Sample instance:
`pid_1064_luid_0x00000000_0x0001120B_phys_0` (`dwm`).
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Dedicated Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1126207488 | |
| `Local Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 314675200 | |
| `Non Local Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 4931584 | |
| `Shared Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 4931584 | |
| `Total Committed` | `PERF_COUNTER_LARGE_RAWCOUNT` | 717426688 | |
internal/collector/hyperv/AGENTS.md
+522
View File
@@ -0,0 +1,522 @@
# `hyperv` collector
The collector reads 16 `Hyper-V ...` PDH objects with `pdh.CounterTypeRaw`
from its sub-collectors, plus HCS, WMI and `virtdisk.dll` data. The objects
exist only where the Hyper-V role is installed; CI does not provision it.
Almost all objects are multi-instance; `Hyper-V Virtual Machine Health Summary`
is single-instance. These notes were recorded on Windows Server 2025 build
26100 with one running Generation 2 VM (`ubuntu`, 6 vCPUs, 2 GiB static
memory) on a host with 12 logical processors.
- `pdh.InstancesAll` drops the `_Total` instance, so the processor objects
return `Hv LP 0`..`Hv LP 11`, `Root VP 0`..`Root VP 11` and
`ubuntu:Hv VP 0`..`ubuntu:Hv VP 5`. The host logical processor count is the
number of `Hv LP` instances (12 here).
- Hypervisor processor objects: every `%` counter and `CPU Wait Time Per
Dispatch` is `PERF_PRECISION_100NS_TIMER`. The raw value is cumulative time
in 100 ns ticks. On a logical processor `% Idle Time` + `% Total Run Time`
equals the time since boot (453 s after a 452.7 s uptime), and
`% Total Run Time` is about `% Guest Run Time` + `% Hypervisor Run Time`.
The help text of `CPU Wait Time Per Dispatch` and `I/O TLB Flush Cost` says
"average time (in nanoseconds)", but the raw value is cumulative 100 ns
ticks.
- `Hyper-V Hypervisor Root Partition` is read for the instance `Root` only.
All its non-`/sec` counters are `PERF_COUNTER_LARGE_RAWCOUNT`. Page counts
and sizes are gauges; by the help text `Skipped Timer Ticks` and
`Device Interrupt Throttle Events` count events.
- Dynamic Memory: memory counters are in MB (`Physical Memory` and
`Guest Visible Physical Memory` are 2048 for the 2 GiB VM). `Added Memory`
and `Removed Memory` are cumulative MB, `Memory Add/Remove Operations` are
cumulative counts. Pressure counters are percentages and exceed 100
(145 here). The VM instance exists even with Dynamic Memory disabled.
Instances are VM names; VMs of the Host Compute Service (WSL 2) have an
empty instance name.
- `Hyper-V DataStore`: instances are `<VM GUID> <file kind>` with the kinds
`configuration file`, `runtime file`, `worker process configuration` and
`worker process runtime state`. Every counter is
`PERF_COUNTER_LARGE_RAWCOUNT` and the help text only repeats the name. The
`... count` counters are cumulative. The `... latency microseconds`
counters are not cumulative: `Commit operation latency microseconds` of the
configuration file dropped from 6659 to 5213 while `Commit operation count`
stayed 1.
- `Hyper-V VM Vid Partition`: pages are 4 KiB. The 2 GiB VM had 526336
`Physical Pages Allocated`.
- `Hyper-V Virtual Storage Device`: instances are the disk path with `\`
replaced by `-` and `(...)` by `[...]`, for example
`C:-ProgramData-Microsoft-Windows-Virtual Hard Disks-ubuntu.vhdx`; a `\\?\`
prefix becomes `--?-` (the `.vmgs` guest state file). A DVD drive shows up
as `ISO`. Only running VMs have instances.
- `Latency`, `Lower Latency`, `Queue Length` and `Lower Queue Length` all
had the same raw value (56686): the sum of IO latencies in 100 ns ticks.
The base of `Latency` (10) equals the raw `Throughput` and
`Read Count` + `Write Count` (6 + 4).
- `Throughput` (`PERF_COUNTER_COUNTER`) counts IO transfers.
`Normalized Throughput` (`PERF_COUNTER_BULK_COUNT`) counts 8 KB IO
transfers by its help text. Both raw values are cumulative.
- `Read Count`, `Write Count` and `Error Count` are
`PERF_COUNTER_RAWCOUNT` but cumulative ("total number of ...").
- `Hyper-V Virtual Switch` and `Hyper-V Virtual Network Adapter`: all
`/sec` counters are `PERF_COUNTER_BULK_COUNT`, so the raw value is a
cumulative count. `Bytes/sec` is `Bytes Received/sec` + `Bytes Sent/sec`
and `Packets/sec` is `Packets Received/sec` + `Packets Sent/sec` in the
samples. Switch instances are the switch names (`External`, `Internal`).
VM adapter instances are `<VM>_<adapter>_<VM GUID>--<GUID>`. Host side
instances look like `Internal_<GUID>`, `Ethernet_<GUID>`,
`DrPort <GUID>_<GUID>` and
`Microsoft Hyper-V Network Adapter__DEVICE_{<GUID>}`. The collector uses
them unchanged as `adapter`.
- `Hyper-V Virtual Network Adapter Drop Reasons` has the same instances as
`Hyper-V Virtual Network Adapter`. Every counter is a cumulative
`PERF_COUNTER_LARGE_RAWCOUNT`; only `Outgoing NotReady` was non-zero (9).
- `Hyper-V Replica VM` exists but had no instance (no replication).
By the help text `Replication Latency` and `Average Replication Latency`
are in seconds, the size counters in bytes, and `Replication Count`,
`Network Bytes Sent/Recv` and `Resynchronized Bytes` are cumulative since
VMMS start.
- `Hyper-V Virtual SMB` and `Hyper-V Legacy Network Adapter` had no
instances (no SMB-backed VM storage, no legacy adapter). In Virtual SMB,
`Tree Connect Count` is `PERF_COUNTER_COUNTER` but its help text says
"the current number of Tree Connects".
- `Hyper-V Virtual Machine Health Summary` counts VMs: `Health Ok` was 1 for
the one VM.
- The `wmi_health`, `virtual_hard_disk` and host VM processor metrics do not
come from PDH, so the table below does not cover them.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `Hyper-V DataStore`
Multi-instance. Instances: `2F713ADB-4A60-4959-8986-949D88D9D6AC configuration file`, `2F713ADB-4A60-4959-8986-949D88D9D6AC runtime file`, `2F713ADB-4A60-4959-8986-949D88D9D6AC worker process configuration`, `2F713ADB-4A60-4959-8986-949D88D9D6AC worker process runtime state`. Sample instance: `2F713ADB-4A60-4959-8986-949D88D9D6AC configuration file`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Cache update operation count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Cache update operation latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Commit byte count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 12210 | |
| `Commit byte latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Commit count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Commit operation count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1 | |
| `Commit operation latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 6659 | |
| `Compact operation count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Compact operation latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Current replay logSize` | `PERF_COUNTER_LARGE_RAWCOUNT` | 32768 | |
| `Data alignment` | `PERF_COUNTER_LARGE_RAWCOUNT` | 4096 | |
| `Data end` | `PERF_COUNTER_LARGE_RAWCOUNT` | 77824 | |
| `Disconnect count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `File data size in bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Fragmentation ratio` | `PERF_COUNTER_LARGE_RAWCOUNT` | 12 | |
| `Load file operation count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1 | |
| `Load file operation latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 4350 | |
| `Names size in bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 4500 | |
| `Number of available entries inside object tables` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Number of empty entries inside object tables` | `PERF_COUNTER_LARGE_RAWCOUNT` | 218 | |
| `Number of file objects` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Number of free bytes inside key tables` | `PERF_COUNTER_LARGE_RAWCOUNT` | 6974 | |
| `Number of key tables` | `PERF_COUNTER_LARGE_RAWCOUNT` | 8 | |
| `Number of keys` | `PERF_COUNTER_LARGE_RAWCOUNT` | 361 | |
| `Number of object tables` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1 | |
| `Query size operation count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 208 | |
| `Query size operation latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 3 | |
| `Read from file byte count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 51356 | |
| `Read from file byte latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 9 | |
| `Read from file count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 236 | |
| `Read from storage byte count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 18470 | |
| `Read from storage byte latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1 | |
| `Read from storage count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 490 | |
| `Reconnect latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Remove operation count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Remove operation latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Sector size` | `PERF_COUNTER_LARGE_RAWCOUNT` | 512 | |
| `Set operation count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 5 | |
| `Set operation latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 6 | |
| `Table data size in bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 21247 | |
| `Write to file byte count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 4234 | |
| `Write to file byte latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 12 | |
| `Write to file count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 8 | |
| `Write to storage byte count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 58 | |
| `Write to storage byte latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 6 | |
| `Write to storage count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 5 | |
Not read by the collector:
- `PERF_COUNTER_LARGE_RAWCOUNT`: `File lock acquire latency microseconds`, `File lock count`, `File lock release latency microseconds`, `Get operation count`, `Get operation latency microseconds`, `Storage lock acquire latency microseconds`, `Storage lock count`, `Storage lock release latency microseconds`
### `Hyper-V Dynamic Memory Balancer`
Multi-instance. Instances: `System Balancer`. Sample instance: `System Balancer`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Available Memory` | `PERF_COUNTER_RAWCOUNT` | 4240 | |
| `Available Memory For Balancing` | `PERF_COUNTER_RAWCOUNT` | 4240 | |
| `Average Pressure` | `PERF_COUNTER_RAWCOUNT` | 145 | |
| `System Current Pressure` | `PERF_COUNTER_RAWCOUNT` | 100 | |
### `Hyper-V Dynamic Memory VM`
Multi-instance. Instances: `ubuntu`. Sample instance: `ubuntu`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Added Memory` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Average Pressure` | `PERF_COUNTER_RAWCOUNT` | 146 | |
| `Current Pressure` | `PERF_COUNTER_RAWCOUNT` | 145 | |
| `Guest Available Memory` | `PERF_COUNTER_RAWCOUNT` | 1025 | |
| `Guest Visible Physical Memory` | `PERF_COUNTER_RAWCOUNT` | 2048 | |
| `Maximum Pressure` | `PERF_COUNTER_RAWCOUNT` | 149 | |
| `Memory Add Operations` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Memory Remove Operations` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Minimum Pressure` | `PERF_COUNTER_RAWCOUNT` | 143 | |
| `Physical Memory` | `PERF_COUNTER_RAWCOUNT` | 2048 | |
| `Removed Memory` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
Not read by the collector:
- `PERF_COUNTER_RAWCOUNT`: `Smart Paging Working Set Size`
### `Hyper-V Hypervisor Logical Processor`
Multi-instance. Instances: `_Total`, `Hv LP 0`, `Hv LP 1`, `Hv LP 10`, `Hv LP 11`, `Hv LP 2`, `Hv LP 3`, `Hv LP 4`, ... (13 in total). Sample instance: `Hv LP 0`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `% Guest Run Time` | `PERF_PRECISION_100NS_TIMER` | 9270346767 | |
| `% Hypervisor Run Time` | `PERF_PRECISION_100NS_TIMER` | 1438355934 | |
| `% Idle Time` | `PERF_PRECISION_100NS_TIMER` | 23500462022 | |
| `% Total Run Time` | `PERF_PRECISION_100NS_TIMER` | 10708658352 | |
| `Context Switches/sec` | `PERF_COUNTER_BULK_COUNT` | 9299560 | |
Not read by the collector:
- `PERF_COUNTER_BULK_COUNT`: `C1 Transitions/sec`, `C2 Transitions/sec`, `C3 Transitions/sec`, `CPPC Request Context Switches/sec`, `Hardware Interrupts/sec`, `Hypervisor Branch Predictor Flushes/sec`, `Hypervisor Immediate L1 Data Cache Flushes/sec`, `Hypervisor L1 Data Cache Flushes/sec`, `Hypervisor Microarchitectural Buffer Flushes/sec`, `Inter-Processor Interrupts Sent/sec`, `Inter-Processor Interrupts/sec`, `Performance Monitoring Interrupts/sec`, `Posted Interrupt Notifications/sec`, `Scheduler Interrupts/sec`, `Timer Interrupts/sec`, `Total Interrupts/sec`
- `PERF_COUNTER_LARGE_RAWCOUNT`: `Monitor Transition Cost`, `Reserve Group Id`, `Root Vp Index`, `Running Priority`, `Scheduler Local Run List Size`
- `PERF_PRECISION_100NS_TIMER`: `% C1 Time`, `% C2 Time`, `% C3 Time`
### `Hyper-V Hypervisor Root Partition`
Multi-instance. Instances: `_Total`, `Root`. Sample instance: `Root`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `1G device pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `1G GPA pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 11 | |
| `2M device pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `2M GPA pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 2461 | |
| `4K device pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `4K GPA pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 51200 | |
| `Address Spaces` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Attached Devices` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Deposited Pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 29667 | |
| `Device DMA Errors` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Device Interrupt Errors` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Device Interrupt Mappings` | `PERF_COUNTER_LARGE_RAWCOUNT` | 2 | |
| `Device Interrupt Throttle Events` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `GPA Pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `GPA Space Modifications/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `I/O TLB Flush Cost` | `PERF_PRECISION_100NS_TIMER` | 0 | |
| `I/O TLB Flushes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Recommended Virtual TLB Size` | `PERF_COUNTER_LARGE_RAWCOUNT` | 64 | |
| `Skipped Timer Ticks` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Virtual TLB Flush Entires/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Virtual TLB Pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 64 | |
Not read by the collector:
- `PERF_COUNTER_BULK_COUNT`: `Nested TLB Trimmed Pages/sec`, `Pages Recombined/sec`, `Pages Shattered/sec`
- `PERF_COUNTER_LARGE_RAWCOUNT`: `Nested TLB Free List Size`, `Nested TLB Size`, `Recommended Nested TLB Size`, `Virtual Processors`
- `PERF_COUNTER_LARGE_RAWCOUNT_HEX`: `CPPC Requested Performance Level`
### `Hyper-V Hypervisor Root Virtual Processor`
Multi-instance. Instances: `_Total`, `Root VP 0`, `Root VP 1`, `Root VP 10`, `Root VP 11`, `Root VP 2`, `Root VP 3`, `Root VP 4`, ... (13 in total). Sample instance: `Root VP 0`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `% Guest Run Time` | `PERF_PRECISION_100NS_TIMER` | 9150616357 | |
| `% Hypervisor Run Time` | `PERF_PRECISION_100NS_TIMER` | 1260894784 | |
| `% Remote Run Time` | `PERF_PRECISION_100NS_TIMER` | 0 | |
| `% Total Run Time` | `PERF_PRECISION_100NS_TIMER` | 10411471300 | |
| `CPU Wait Time Per Dispatch` | `PERF_PRECISION_100NS_TIMER` | 290865977 | |
Not read by the collector:
- `PERF_COUNTER_BULK_COUNT`: `Address Domain Flushes/sec`, `Address Space Evictions/sec`, `Address Space Flushes/sec`, `Address Space Switches/sec`, `APIC EOI Accesses/sec`, `APIC IPIs Sent/sec`, `APIC MMIO Accesses/sec`, `APIC Self IPIs Sent/sec`, `APIC TPR Accesses/sec`, `Bus Lock Acquisitions/sec`, `Control Register Accesses Forwarded/sec`, `Control Register Accesses/sec`, `CPPC Request Context Switches/sec`, `CPU Group Hypercalls/sec`, `CPUID Instructions Forwarded/sec`, `CPUID Instructions/sec`, `Debug Register Accesses Forwarded/sec`, `Debug Register Accesses/sec`, `Deposit Hypercalls/sec`, `Device Domain Hypercalls/sec`, `Emulated Instructions Forwarded/sec`, `Emulated Instructions/sec`, `Event Log Hypercalls/sec`, `Extended Hypercall Intercept Messages/sec`, `Extended Hypercalls/sec`, `External Interrupts Forwarded/sec`, `External Interrupts/sec`, `Flush Physical Address List Hypercalls/sec`, `Flush Physical Address Space Hypercalls/sec`, `GIF Instruction Emulation Intercepts/sec`, `Global GVA Range Flushes/sec`, `Global I/O TLB Flushes/sec`, `GPA Space Hypercalls/sec`, `Guest Page Table Maps/sec`, `Hardware Interrupts/sec`, `HLT Instructions Forwarded/sec`, `HLT Instructions/sec`, `Hypercalls Forwarded/sec`, `Hypercalls/sec`, `InvEpt All Context Emulation Intercepts/sec`, `InvEpt Single Context Emulation Intercepts/sec`, `InvVpid All Context Emulation Intercepts/sec`, `InvVpid Single Address Emulation Intercepts/sec`, `InvVpid Single Context Emulation Intercepts/sec`, `IO Instructions Forwarded/sec`, `IO Instructions/sec`, `IO Intercept Messages/sec`, `IOMMU Hypercalls/sec`, `Large Page TLB Fills/sec`, `Local Flushed GVA Ranges/sec`, `Local I/O TLB Flushes/sec`, `Logical Processor Dispatches/sec`, `Logical Processor Hypercalls/sec`, `Logical Processor Migrations/sec`, `Long Spin Wait Hypercalls/sec`, `MBEC Nested Page Table Switches/sec`, `Memory Intercept Messages/sec`, `MSR Accesses Forwarded/sec`, `MSR Accesses/sec`, `MWAIT Instructions Forwarded/sec`, `MWAIT Instructions/sec`, `Nested Page Fault Intercepts/sec`, `Nested SLAT Hard Page Faults/sec`, `Nested SLAT Soft Page Faults/sec`, `Nested TLB Page Table Evictions/sec`, `Nested TLB Page Table Reclamations/sec`, `Nested VM Entries/sec`, `Other Hypercalls/sec`, `Other Intercepts Forwarded/sec`, `Other Intercepts/sec`, `Other Messages/sec`, `Other Reflected Guest Exceptions/sec`, `Page Fault Intercepts Forwarded/sec`, `Page Fault Intercepts/sec`, `Page Invalidations Forwarded/sec`, `Page Invalidations/sec`, `Page Scans/sec`, `Page Table Allocations/sec`, `Page Table Evictions/sec`, `Page Table Reclamations/sec`, `Page Table Resets/sec`, `Page Table Validations/sec`, `Page Table Write Intercepts/sec`, `Pending Interrupts Forwarded/sec`, `Pending Interrupts/sec`, `Performance Monitoring Interrupts/sec`, `Performance Monitoring IPT MSR Accesses/sec`, `Performance Monitoring LBR MSR Accesses/sec`, `Performance Monitoring vPMU MSR Accesses/sec`, `Posted Interrupt Notifications/sec`, `Posted Interrupt Scans/sec`, `RDPMC Instructions/sec`, `Reflected Guest Page Faults/sec`, `Small Page TLB Fills/sec`, `SVM Hypercalls/sec`, `Synthetic Interrupt Hypercalls/sec`, `Synthetic Interrupts/sec`, `Total Intercepts/sec`, `Total Messages/sec`, `Total Virtualization Instructions Emulated/sec`, `Virtual Interrupt Hypercalls/sec`, `Virtual Interrupts/sec`, `Virtual MMU Hypercalls/sec`, `Virtual Processor Hypercalls/sec`, `VMCLEAR Emulation Intercepts/sec`, `VMLOAD Emulation Intercepts/sec`, `VMPTRLD Emulation Intercepts/sec`, `VMPTRST Emulation Intercepts/sec`, `VMREAD Emulation Intercepts/sec`, `VMSAVE Emulation Intercepts/sec`, `VMWRITE Emulation Intercepts/sec`, `VMXOFF Emulation Intercepts/sec`, `VMXON Emulation Intercepts/sec`, `VSM Hypercalls/sec`, `VTL1 Dispatches/sec`, `VTL2 Dispatches/sec`
- `PERF_COUNTER_LARGE_RAWCOUNT`: `Scheduling Priority`
- `PERF_PRECISION_100NS_TIMER`: `% Guest-Relative Utilization`, `% Total Core Run Time`, `% VTL1 Run Time`, `% VTL2 Run Time`, `Control Register Accesses Cost`, `Control Register Accesses Forwarding Cost`, `CPU Contention Time Per Dispatch`, `CPU Wake Up Time Per Dispatch`, `CPUID Instructions Cost`, `CPUID Instructions Forwarding Cost`, `Debug Register Accesses Cost`, `Debug Register Accesses Forwarding Cost`, `Emulated Instructions Cost`, `Emulated Instructions Forwarding Cost`, `External Interrupts Cost`, `GIF Instruction Emulation Cost`, `Global I/O TLB Flush Cost`, `HLT Instructions Cost`, `HLT Instructions Forwarding Cost`, `Hypercalls Cost`, `Hypercalls Forwarding Cost`, `InvEpt All Context Instruction Emulation Cost`, `InvEpt Single Context Instruction Emulation Cost`, `InvVpid All Context Instruction Emulation Cost`, `InvVpid Single Address Instruction Emulation Cost`, `InvVpid Single Context Instruction Emulation Cost`, `IO Instructions Cost`, `IO Instructions Forwarding Cost`, `Local I/O TLB Flush Cost`, `MSR Accesses Cost`, `MSR Accesses Forwarding Cost`, `MWAIT Instructions Cost`, `MWAIT Instructions Forwarding Cost`, `Nested Page Fault Intercepts Cost`, `Nested SLAT Hard Page Faults Cost`, `Nested SLAT Soft Page Faults Cost`, `Nested VM Entries Cost`, `Other Intercepts Cost`, `Other Intercepts Forwarding Cost`, `Page Fault Intercepts Cost`, `Page Fault Intercepts Forwarding Cost`, `Page Invalidations Cost`, `Page Invalidations Forwarding Cost`, `Pending Interrupts Cost`, `Pending Interrupts Forwarding Cost`, `RDPMC Instructions Cost`, `Total Intercepts Cost`, `Total Virtualization Instructions Emulation Cost`, `VMCLEAR Instruction Emulation Cost`, `VMLOAD Instruction Emulation Cost`, `VMPTRLD Instruction Emulation Cost`, `VMPTRST Instruction Emulation Cost`, `VMREAD Instruction Emulation Cost`, `VMSAVE Instruction Emulation Cost`, `VMWRITE Instruction Emulation Cost`, `VMXOFF Instruction Emulation Cost`, `VMXON Instruction Emulation Cost`, `VTL1 Average Run Time`, `VTL2 Average Run Time`
### `Hyper-V Hypervisor Virtual Processor`
Multi-instance. Instances: `_Total`, `ubuntu:Hv VP 0`, `ubuntu:Hv VP 1`, `ubuntu:Hv VP 2`, `ubuntu:Hv VP 3`, `ubuntu:Hv VP 4`, `ubuntu:Hv VP 5`. Sample instance: `ubuntu:Hv VP 0`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `% Guest Run Time` | `PERF_PRECISION_100NS_TIMER` | 2198066669 | |
| `% Hypervisor Run Time` | `PERF_PRECISION_100NS_TIMER` | 982721208 | |
| `% Remote Run Time` | `PERF_PRECISION_100NS_TIMER` | 0 | |
| `% Total Run Time` | `PERF_PRECISION_100NS_TIMER` | 3180787877 | |
| `CPU Wait Time Per Dispatch` | `PERF_PRECISION_100NS_TIMER` | 1217187193 | |
Not read by the collector:
- `PERF_COUNTER_BULK_COUNT`: `Address Domain Flushes/sec`, `Address Space Evictions/sec`, `Address Space Flushes/sec`, `Address Space Switches/sec`, `APIC EOI Accesses/sec`, `APIC IPIs Sent/sec`, `APIC MMIO Accesses/sec`, `APIC Self IPIs Sent/sec`, `APIC TPR Accesses/sec`, `Bus Lock Acquisitions/sec`, `Control Register Accesses Forwarded/sec`, `Control Register Accesses/sec`, `CPPC Request Context Switches/sec`, `CPU Group Hypercalls/sec`, `CPUID Instructions Forwarded/sec`, `CPUID Instructions/sec`, `Debug Register Accesses Forwarded/sec`, `Debug Register Accesses/sec`, `Deposit Hypercalls/sec`, `Device Domain Hypercalls/sec`, `Emulated Instructions Forwarded/sec`, `Emulated Instructions/sec`, `Event Log Hypercalls/sec`, `Extended Hypercall Intercept Messages/sec`, `Extended Hypercalls/sec`, `External Interrupts Forwarded/sec`, `External Interrupts/sec`, `Flush Physical Address List Hypercalls/sec`, `Flush Physical Address Space Hypercalls/sec`, `GIF Instruction Emulation Intercepts/sec`, `Global GVA Range Flushes/sec`, `Global I/O TLB Flushes/sec`, `GPA Space Hypercalls/sec`, `Guest Page Table Maps/sec`, `Hardware Interrupts/sec`, `HLT Instructions Forwarded/sec`, `HLT Instructions/sec`, `Hypercalls Forwarded/sec`, `Hypercalls/sec`, `InvEpt All Context Emulation Intercepts/sec`, `InvEpt Single Context Emulation Intercepts/sec`, `InvVpid All Context Emulation Intercepts/sec`, `InvVpid Single Address Emulation Intercepts/sec`, `InvVpid Single Context Emulation Intercepts/sec`, `IO Instructions Forwarded/sec`, `IO Instructions/sec`, `IO Intercept Messages/sec`, `IOMMU Hypercalls/sec`, `Large Page TLB Fills/sec`, `Local Flushed GVA Ranges/sec`, `Local I/O TLB Flushes/sec`, `Logical Processor Dispatches/sec`, `Logical Processor Hypercalls/sec`, `Logical Processor Migrations/sec`, `Long Spin Wait Hypercalls/sec`, `MBEC Nested Page Table Switches/sec`, `Memory Intercept Messages/sec`, `MSR Accesses Forwarded/sec`, `MSR Accesses/sec`, `MWAIT Instructions Forwarded/sec`, `MWAIT Instructions/sec`, `Nested Page Fault Intercepts/sec`, `Nested SLAT Hard Page Faults/sec`, `Nested SLAT Soft Page Faults/sec`, `Nested TLB Page Table Evictions/sec`, `Nested TLB Page Table Reclamations/sec`, `Nested VM Entries/sec`, `Other Hypercalls/sec`, `Other Intercepts Forwarded/sec`, `Other Intercepts/sec`, `Other Messages/sec`, `Other Reflected Guest Exceptions/sec`, `Page Fault Intercepts Forwarded/sec`, `Page Fault Intercepts/sec`, `Page Invalidations Forwarded/sec`, `Page Invalidations/sec`, `Page Scans/sec`, `Page Table Allocations/sec`, `Page Table Evictions/sec`, `Page Table Reclamations/sec`, `Page Table Resets/sec`, `Page Table Validations/sec`, `Page Table Write Intercepts/sec`, `Pending Interrupts Forwarded/sec`, `Pending Interrupts/sec`, `Performance Monitoring Interrupts/sec`, `Performance Monitoring IPT MSR Accesses/sec`, `Performance Monitoring LBR MSR Accesses/sec`, `Performance Monitoring vPMU MSR Accesses/sec`, `Posted Interrupt Notifications/sec`, `Posted Interrupt Scans/sec`, `RDPMC Instructions/sec`, `Reflected Guest Page Faults/sec`, `Small Page TLB Fills/sec`, `SVM Hypercalls/sec`, `Synthetic Interrupt Hypercalls/sec`, `Synthetic Interrupts/sec`, `Total Intercepts/sec`, `Total Messages/sec`, `Total Virtualization Instructions Emulated/sec`, `Virtual Interrupt Hypercalls/sec`, `Virtual Interrupts/sec`, `Virtual MMU Hypercalls/sec`, `Virtual Processor Hypercalls/sec`, `VMCLEAR Emulation Intercepts/sec`, `VMLOAD Emulation Intercepts/sec`, `VMPTRLD Emulation Intercepts/sec`, `VMPTRST Emulation Intercepts/sec`, `VMREAD Emulation Intercepts/sec`, `VMSAVE Emulation Intercepts/sec`, `VMWRITE Emulation Intercepts/sec`, `VMXOFF Emulation Intercepts/sec`, `VMXON Emulation Intercepts/sec`, `VSM Hypercalls/sec`, `VTL1 Dispatches/sec`, `VTL2 Dispatches/sec`
- `PERF_COUNTER_LARGE_RAWCOUNT`: `Scheduling Priority`
- `PERF_PRECISION_100NS_TIMER`: `% Guest-Relative Utilization`, `% Total Core Run Time`, `% VTL1 Run Time`, `% VTL2 Run Time`, `Control Register Accesses Cost`, `Control Register Accesses Forwarding Cost`, `CPU Contention Time Per Dispatch`, `CPU Wake Up Time Per Dispatch`, `CPUID Instructions Cost`, `CPUID Instructions Forwarding Cost`, `Debug Register Accesses Cost`, `Debug Register Accesses Forwarding Cost`, `Emulated Instructions Cost`, `Emulated Instructions Forwarding Cost`, `External Interrupts Cost`, `GIF Instruction Emulation Cost`, `Global I/O TLB Flush Cost`, `HLT Instructions Cost`, `HLT Instructions Forwarding Cost`, `Hypercalls Cost`, `Hypercalls Forwarding Cost`, `InvEpt All Context Instruction Emulation Cost`, `InvEpt Single Context Instruction Emulation Cost`, `InvVpid All Context Instruction Emulation Cost`, `InvVpid Single Address Instruction Emulation Cost`, `InvVpid Single Context Instruction Emulation Cost`, `IO Instructions Cost`, `IO Instructions Forwarding Cost`, `Local I/O TLB Flush Cost`, `MSR Accesses Cost`, `MSR Accesses Forwarding Cost`, `MWAIT Instructions Cost`, `MWAIT Instructions Forwarding Cost`, `Nested Page Fault Intercepts Cost`, `Nested SLAT Hard Page Faults Cost`, `Nested SLAT Soft Page Faults Cost`, `Nested VM Entries Cost`, `Other Intercepts Cost`, `Other Intercepts Forwarding Cost`, `Page Fault Intercepts Cost`, `Page Fault Intercepts Forwarding Cost`, `Page Invalidations Cost`, `Page Invalidations Forwarding Cost`, `Pending Interrupts Cost`, `Pending Interrupts Forwarding Cost`, `RDPMC Instructions Cost`, `Total Intercepts Cost`, `Total Virtualization Instructions Emulation Cost`, `VMCLEAR Instruction Emulation Cost`, `VMLOAD Instruction Emulation Cost`, `VMPTRLD Instruction Emulation Cost`, `VMPTRST Instruction Emulation Cost`, `VMREAD Instruction Emulation Cost`, `VMSAVE Instruction Emulation Cost`, `VMWRITE Instruction Emulation Cost`, `VMXOFF Instruction Emulation Cost`, `VMXON Instruction Emulation Cost`, `VTL1 Average Run Time`, `VTL2 Average Run Time`
### `Hyper-V Legacy Network Adapter`
Multi-instance. No instances on the recording host, so the table has types only.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Bytes Dropped` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `Bytes Received/sec` | `PERF_COUNTER_BULK_COUNT` | | |
| `Bytes Sent/sec` | `PERF_COUNTER_BULK_COUNT` | | |
| `Frames Dropped` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `Frames Received/sec` | `PERF_COUNTER_BULK_COUNT` | | |
| `Frames Sent/sec` | `PERF_COUNTER_BULK_COUNT` | | |
### `Hyper-V Replica VM`
Multi-instance. No instances on the recording host, so the table has types only.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Average Replication Latency` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `Average Replication Size` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `Compression Efficiency` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `Last Replication Size` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `Network Bytes Recv` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `Network Bytes Sent` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `Replication Count` | `PERF_COUNTER_RAWCOUNT` | | |
| `Replication Latency` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `Resynchronized Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
### `Hyper-V Virtual Machine Health Summary`
Single-instance.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Health Critical` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Health Ok` | `PERF_COUNTER_RAWCOUNT` | 1 | |
### `Hyper-V Virtual Network Adapter`
Multi-instance. Instances: `DrPort 700EF58F-56E7-4982-9DC4-4BCD5FC2C56F_B3548C76-D68D-4199-B45F-5C9DE21BD03C`, `Ethernet_700EF58F-56E7-4982-9DC4-4BCD5FC2C56E`, `Internal_FDECB3D5-AD64-4B6A-B96C-6AFD1616F33A`, `Microsoft Hyper-V Network Adapter__DEVICE_{9FE7CB58-7B03-4A3F-814F-9CD52BF15705}`, `ubuntu_Network Adapter_2F713ADB-4A60-4959-8986-949D88D9D6AC--F28DA7DA-095C-4544-B094-97085584E17D`. Sample instance: `DrPort 700EF58F-56E7-4982-9DC4-4BCD5FC2C56F_B3548C76-D68D-4199-B45F-5C9DE21BD03C`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Broadcast Packets Received/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Broadcast Packets Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 18 | |
| `Bytes Received/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Bytes Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 1708 | |
| `Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 1708 | |
| `Directed Packets Received/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Directed Packets Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Dropped Packets Incoming/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Dropped Packets Outgoing/sec` | `PERF_COUNTER_BULK_COUNT` | 21 | |
| `Extensions Dropped Packets Incoming/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Extensions Dropped Packets Outgoing/sec` | `PERF_COUNTER_BULK_COUNT` | 30 | |
| `Multicast Packets Received/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Multicast Packets Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 12 | |
| `Packets Received/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Packets Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 30 | |
| `Packets/sec` | `PERF_COUNTER_BULK_COUNT` | 30 | |
Not read by the collector:
- `PERF_COUNTER_BULK_COUNT`: `IPsec offload Bytes Receive/sec`, `IPsec offload Bytes Sent/sec`, `Packets Failed Software IP Rx CSO/sec`, `Packets Failed Software Rx CSO Parsing/sec`, `Packets Failed Software TCP Rx CSO/sec`, `Packets Failed Software UDP Rx CSO/sec`, `Packets Passed Software IP Rx CSO/sec`, `Packets Passed Software TCP Rx CSO/sec`, `Packets Passed Software UDP Rx CSO/sec`, `Packets With Software IP Tx CSO/sec`, `Packets With Software TCP Tx CSO/sec`, `Packets With Software UDP Tx CSO/sec`
- `PERF_COUNTER_LARGE_RAWCOUNT`: `Packets Failed Software IP Rx CSO`, `Packets Failed Software TCP Rx CSO`, `Packets Failed Software UDP Rx CSO`, `RSC Coalesce Events`, `RSC Coalesced Bytes`, `RSC Coalesced Event Bucket 1 (0To1)`, `RSC Coalesced Event Bucket 2 (2To3)`, `RSC Coalesced Event Bucket 3 (4To7)`, `RSC Coalesced Event Bucket 4 (8To15)`, `RSC Coalesced Event Bucket 5 (16To31)`, `RSC Coalesced Event Bucket 6 (32To63)`, `RSC Coalesced Packet Bucket 1 (0To1)`, `RSC Coalesced Packet Bucket 2 (2To3)`, `RSC Coalesced Packet Bucket 3 (4To7)`, `RSC Coalesced Packet Bucket 4 (8To15)`, `RSC Coalesced Packet Bucket 5 (16To31)`, `RSC Coalesced Packet Bucket 6 (32To63)`, `RSC Coalesced Packets`, `RSC Packets Processed`
### `Hyper-V Virtual Network Adapter Drop Reasons`
Multi-instance. Instances: `DrPort 700EF58F-56E7-4982-9DC4-4BCD5FC2C56F_B3548C76-D68D-4199-B45F-5C9DE21BD03C`, `Ethernet_700EF58F-56E7-4982-9DC4-4BCD5FC2C56E`, `Internal_FDECB3D5-AD64-4B6A-B96C-6AFD1616F33A`, `Microsoft Hyper-V Network Adapter__DEVICE_{9FE7CB58-7B03-4A3F-814F-9CD52BF15705}`, `ubuntu_Network Adapter_2F713ADB-4A60-4959-8986-949D88D9D6AC--F28DA7DA-095C-4544-B094-97085584E17D`. Sample instance: `DrPort 700EF58F-56E7-4982-9DC4-4BCD5FC2C56F_B3548C76-D68D-4199-B45F-5C9DE21BD03C`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Incoming BridgeReserved` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming Busy` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming DhcpGuard` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming Disconnected` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming FailedPvlanSetting` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming FailedSecurityPolicy` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming Filtered` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming FilteredVLAN` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming InvalidConfig` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming InvalidData` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming InvalidPacket` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming Ipsec` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming MacSpoofing` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming MTUMismatch` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming NativeFwdingReq` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming NotAccepted` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming NotReady` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming Qos` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming RequiredExtensionMissing` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming Resources` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming RouterGuard` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming UnauthorizedMAC` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming UnauthorizedVLAN` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming Unknown` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Incoming VirtualSubnetId` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing BridgeReserved` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing Busy` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing DhcpGuard` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing Disconnected` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing FailedPvlanSetting` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing FailedSecurityPolicy` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing Filtered` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing FilteredVLAN` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing InvalidConfig` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing InvalidData` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing InvalidPacket` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing Ipsec` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing MacSpoofing` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing MTUMismatch` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing NativeFwdingReq` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing NotAccepted` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing NotReady` | `PERF_COUNTER_LARGE_RAWCOUNT` | 9 | |
| `Outgoing Qos` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing RequiredExtensionMissing` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing Resources` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing RouterGuard` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing UnauthorizedMAC` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing UnauthorizedVLAN` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing Unknown` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Outgoing VirtualSubnetId` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
Not read by the collector:
- `PERF_COUNTER_LARGE_RAWCOUNT`: `Incoming FailedDestinationListUpdate`, `Incoming FailedPacketFilter`, `Incoming FilteredIsolationUntagged`, `Incoming InjectedIcmp`, `Incoming InvalidDestMac`, `Incoming InvalidFirstNBTooSmall`, `Incoming InvalidPDQueue`, `Incoming InvalidSourceMac`, `Incoming InvalidVlanFormat`, `Incoming LowPowerPacketFilter`, `Incoming NicDisabled`, `Incoming StormLimit`, `Incoming SwitchDataFlowDisabled`, `Outgoing FailedDestinationListUpdate`, `Outgoing FailedPacketFilter`, `Outgoing FilteredIsolationUntagged`, `Outgoing InjectedIcmp`, `Outgoing InvalidDestMac`, `Outgoing InvalidFirstNBTooSmall`, `Outgoing InvalidPDQueue`, `Outgoing InvalidSourceMac`, `Outgoing InvalidVlanFormat`, `Outgoing LowPowerPacketFilter`, `Outgoing NicDisabled`, `Outgoing StormLimit`, `Outgoing SwitchDataFlowDisabled`
### `Hyper-V Virtual SMB`
Multi-instance. No instances on the recording host, so the table has types only.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Current Open File Count` | `PERF_COUNTER_RAWCOUNT` | | |
| `Current Pending Requests` | `PERF_COUNTER_RAWCOUNT` | | |
| `Direct-Mapped Pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `Direct-Mapped Sections` | `PERF_COUNTER_RAWCOUNT` | | |
| `Flush Requests/sec` | `PERF_COUNTER_COUNTER` | | |
| `Read Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | | |
| `Read Bytes/sec (RDMA)` | `PERF_COUNTER_BULK_COUNT` | | |
| `Read Requests/sec` | `PERF_COUNTER_COUNTER` | | |
| `Read Requests/sec (RDMA)` | `PERF_COUNTER_COUNTER` | | |
| `Received Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | | |
| `Requests/sec` | `PERF_COUNTER_COUNTER` | | |
| `Sent Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | | |
| `Tree Connect Count` | `PERF_COUNTER_COUNTER` | | |
| `Write Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | | |
| `Write Bytes/sec (RDMA)` | `PERF_COUNTER_BULK_COUNT` | | |
| `Write Requests/sec` | `PERF_COUNTER_COUNTER` | | |
| `Write Requests/sec (RDMA)` | `PERF_COUNTER_COUNTER` | | |
Not read by the collector:
- `PERF_AVERAGE_TIMER`: `Avg. sec/Request`
### `Hyper-V Virtual Storage Device`
Multi-instance. Instances: `--?-C:-ProgramData-Microsoft-Windows-Hyper-V-Virtual Machines-2F713ADB-4A60-4959-8986-949D88D9D6AC.vmgs`, `C:-ProgramData-Microsoft-Windows-Virtual Hard Disks-ubuntu.vhdx`, `ISO`. Sample instance: `--?-C:-ProgramData-Microsoft-Windows-Hyper-V-Virtual Machines-2F713ADB-4A60-4959-8986-949D88D9D6AC.vmgs`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Error Count` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Io Quota Replenishment Rate` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Latency` | `PERF_AVERAGE_TIMER` | 56686 | 10 |
| `Lower Latency` | `PERF_AVERAGE_TIMER` | 56686 | 10 |
| `Lower Queue Length` | `PERF_COUNTER_LARGE_QUEUELEN_TYPE` | 56686 | |
| `Normalized Throughput` | `PERF_COUNTER_BULK_COUNT` | 95 | |
| `Queue Length` | `PERF_COUNTER_LARGE_QUEUELEN_TYPE` | 56686 | |
| `Read Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 252416 | |
| `Read Count` | `PERF_COUNTER_RAWCOUNT` | 6 | |
| `Throughput` | `PERF_COUNTER_COUNTER` | 10 | |
| `Write Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 468992 | |
| `Write Count` | `PERF_COUNTER_RAWCOUNT` | 4 | |
Not read by the collector:
- `PERF_COUNTER_BULK_COUNT`: `Byte Quota Replenishment Rate`
- `PERF_COUNTER_COUNTER`: `Read Operations/Sec`, `Write Operations/Sec`
- `PERF_COUNTER_LARGE_RAWCOUNT`: `Maximum Bandwidth`, `Maximum IO Rate`, `Minimum IO Rate`
- `PERF_COUNTER_RAWCOUNT`: `Adapter Open Channel Count`, `Flush Count`, `Maximum Adapter Worker Count`
### `Hyper-V Virtual Switch`
Multi-instance. Instances: `External`, `Internal`. Sample instance: `External`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Broadcast Packets Received/sec` | `PERF_COUNTER_BULK_COUNT` | 208 | |
| `Broadcast Packets Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 190 | |
| `Bytes Received/sec` | `PERF_COUNTER_BULK_COUNT` | 6209983540 | |
| `Bytes Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 6209976573 | |
| `Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 12419960113 | |
| `Directed Packets Received/sec` | `PERF_COUNTER_BULK_COUNT` | 1035024 | |
| `Directed Packets Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 1035024 | |
| `Dropped Packets Incoming/sec` | `PERF_COUNTER_BULK_COUNT` | 23 | |
| `Dropped Packets Outgoing/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Extensions Dropped Packets Incoming/sec` | `PERF_COUNTER_BULK_COUNT` | 96 | |
| `Extensions Dropped Packets Outgoing/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Learned Mac Addresses` | `PERF_COUNTER_LARGE_RAWCOUNT` | 3 | |
| `Multicast Packets Received/sec` | `PERF_COUNTER_BULK_COUNT` | 438 | |
| `Multicast Packets Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 360 | |
| `Number of Send Channel Moves/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Number of VMQ Moves/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Packets Flooded` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Packets Received/sec` | `PERF_COUNTER_BULK_COUNT` | 1035670 | |
| `Packets Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 1035574 | |
| `Packets/sec` | `PERF_COUNTER_BULK_COUNT` | 2071244 | |
| `Purged Mac Addresses` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
Not read by the collector:
- `PERF_COUNTER_BULK_COUNT`: `Learned Mac Addresses/sec`, `Packets Flooded/sec`, `Purged Mac Addresses/sec`
- `PERF_COUNTER_LARGE_RAWCOUNT`: `RSC Coalesce Events`, `RSC Coalesced Bytes`, `RSC Coalesced Event Bucket 1 (0To1)`, `RSC Coalesced Event Bucket 2 (2To3)`, `RSC Coalesced Event Bucket 3 (4To7)`, `RSC Coalesced Event Bucket 4 (8To15)`, `RSC Coalesced Event Bucket 5 (16To31)`, `RSC Coalesced Event Bucket 6 (32To63)`, `RSC Coalesced Packet Bucket 1 (0To1)`, `RSC Coalesced Packet Bucket 2 (2To3)`, `RSC Coalesced Packet Bucket 3 (4To7)`, `RSC Coalesced Packet Bucket 4 (8To15)`, `RSC Coalesced Packet Bucket 5 (16To31)`, `RSC Coalesced Packet Bucket 6 (32To63)`, `RSC Coalesced Packets`, `RSC Packets Processed`
### `Hyper-V VM Vid Partition`
Multi-instance. Instances: `_Total`, `ubuntu`. Sample instance: `ubuntu`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Physical Pages Allocated` | `PERF_COUNTER_LARGE_RAWCOUNT` | 526336 | |
| `Preferred NUMA Node Index` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Remote Physical Pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
internal/collector/iis/AGENTS.md
+251
View File
@@ -25,3 +25,254 @@
- To find which Windows call a collector blocks in, capture a Go execution
trace with `--debug.enabled` and `/debug/pprof/trace?seconds=600`. Collectors
waiting in a Windows call use no CPU, so a CPU profile does not show it.
## PDH objects and raw values
The collector reads five PDH objects with `pdh.CounterTypeRaw`: `Web Service`,
`Web Service Cache` (single instance), `APP_POOL_WAS`, `W3SVC_W3WP` and
`HTTP Service Request Queues`. They need the IIS role (W3SVC and WAS). These
notes were recorded on Windows Server 2025 (build 26100) with only
`Default Web Site` and `DefaultAppPool`.
- Almost every counter is `PERF_COUNTER_RAWCOUNT` or
`PERF_COUNTER_LARGE_RAWCOUNT`. The help text decides the kind:
- Cumulative "since service startup": every `Total ...` counter of
`Web Service`, the `... Hits`, `... Misses`, `... Flushes` and `Total ...`
counters of `Web Service Cache` and `W3SVC_W3WP`, and
`Total HTTP Requests Served`.
- Gauges: every `Current ...` counter, `Active Requests`,
`Active Threads Count`, `WebSocket Active Requests`,
`Active Flushed Entries`, `Output Cache Current ...` and `Total Threads`
(threads available in the worker process, 12 here).
- `Maximum Threads Count` is the thread pool limit (256 here), not a peak.
`Maximum File Cache Memory Usage` is the peak of
`Current File Cache Memory Usage`.
- Units: `... Memory Usage` and `Total Bytes ...` are bytes. `Service Uptime`
is seconds (334 about 5 minutes after boot).
- The `X/sec` twins are not read. Their raw value equals the `Total X`
counter (`Get Requests/sec` = `Total Get Requests`,
`Bytes Sent/sec` = `Total Bytes Sent`, `Requests / Sec` =
`Total HTTP Requests Served`).
- `% 401/403/404/500 HTTP Response Sent` of `W3SVC_W3WP` are
`PERF_SAMPLE_FRACTION`. Raw is the cumulative count of that status, base is
the cumulative request count (after one 200 and one 404 request: 404 raw 1,
base 2).
- `APP_POOL_WAS` uptimes and `Time Since Last Worker Process Failure` are
`PERF_ELAPSED_TIME`. Raw is the start time as a FILETIME (100 ns since 1601),
the second value is the current time, and `internal/pdh` returns the elapsed
seconds (298 about 5 minutes after boot). Without any failure,
`Time Since Last Worker Process Failure` equals the pool uptime.
`Current Application Pool State` is an enum (1 to 7, 3 = Running).
- `HTTP Service Request Queues`: `ArrivalRate` is `PERF_COUNTER_BULK_COUNT`, a
cumulative count of arrived requests. `RejectedRequests` is cumulative
("Total number of requests rejected"). `MaxQueueItemAge` is
`PERF_ELAPSED_TIME`; on an empty queue the raw value is `math.MaxInt64`, PDH
formats it as 0, and the raw calculation gives a large negative number.
- Instances: `Web Service` and `APP_POOL_WAS` have a `_Total` instance, which
the collector exports like a site or pool named `_Total`. `W3SVC_W3WP`
instances are `<PID>_<app pool>` (`10932_DefaultAppPool`) plus `_Total`, and
exist only while a worker process runs; send one HTTP request to start one.
`HTTP Service Request Queues` instances are app pool names plus about 40
`---<n>` queues, which the collector skips. Recycled instances get a `#<n>`
suffix that the collector strips.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `APP_POOL_WAS`
Multi-instance. Instances: `_Total`, `DefaultAppPool`. Sample instance: `DefaultAppPool`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Current Application Pool State` | `PERF_COUNTER_RAWCOUNT` | 3 | |
| `Current Application Pool Uptime` | `PERF_ELAPSED_TIME` | 134365471332535000 | |
| `Current Worker Processes` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Maximum Worker Processes` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Recent Worker Process Failures` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Time Since Last Worker Process Failure` | `PERF_ELAPSED_TIME` | 134365471332535000 | |
| `Total Application Pool Recycles` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Application Pool Uptime` | `PERF_ELAPSED_TIME` | 134365471332535000 | |
| `Total Worker Process Failures` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Worker Process Ping Failures` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Worker Process Shutdown Failures` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Worker Process Startup Failures` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Worker Processes Created` | `PERF_COUNTER_RAWCOUNT` | 0 | |
### `HTTP Service Request Queues`
Multi-instance. Instances: `---1`, `---10`, `---11`, `---12`, `---13`, `---14`, `---15`, `---16`, ... (40 in total). Sample instance: `---1`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `ArrivalRate` | `PERF_COUNTER_BULK_COUNT` | 67 | |
| `CurrentQueueSize` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `MaxQueueItemAge` | `PERF_ELAPSED_TIME` | 9223372036854780000 | |
| `RejectedRequests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
Not read by the collector:
- `PERF_COUNTER_BULK_COUNT`: `CacheHitRate`, `RejectionRate`
- `PERF_COUNTER_RAWCOUNT`: `PendingReceiveRequests`
### `W3SVC_W3WP`
Multi-instance. No instances on the recording host, so the table has types only.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `% 401 HTTP Response Sent` | `PERF_SAMPLE_FRACTION` | | |
| `% 403 HTTP Response Sent` | `PERF_SAMPLE_FRACTION` | | |
| `% 404 HTTP Response Sent` | `PERF_SAMPLE_FRACTION` | | |
| `% 500 HTTP Response Sent` | `PERF_SAMPLE_FRACTION` | | |
| `Active Flushed Entries` | `PERF_COUNTER_RAWCOUNT` | | |
| `Active Requests` | `PERF_COUNTER_RAWCOUNT` | | |
| `Active Threads Count` | `PERF_COUNTER_RAWCOUNT` | | |
| `Current File Cache Memory Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `Current Files Cached` | `PERF_COUNTER_RAWCOUNT` | | |
| `Current Metadata Cached` | `PERF_COUNTER_RAWCOUNT` | | |
| `Current URIs Cached` | `PERF_COUNTER_RAWCOUNT` | | |
| `File Cache Flushes` | `PERF_COUNTER_RAWCOUNT` | | |
| `File Cache Hits` | `PERF_COUNTER_RAWCOUNT` | | |
| `File Cache Misses` | `PERF_COUNTER_RAWCOUNT` | | |
| `Maximum File Cache Memory Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `Maximum Threads Count` | `PERF_COUNTER_RAWCOUNT` | | |
| `Metadata Cache Flushes` | `PERF_COUNTER_RAWCOUNT` | | |
| `Metadata Cache Hits` | `PERF_COUNTER_RAWCOUNT` | | |
| `Metadata Cache Misses` | `PERF_COUNTER_RAWCOUNT` | | |
| `Output Cache Current Flushed Items` | `PERF_COUNTER_RAWCOUNT` | | |
| `Output Cache Current Items` | `PERF_COUNTER_RAWCOUNT` | | |
| `Output Cache Current Memory Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | | |
| `Output Cache Total Flushed Items` | `PERF_COUNTER_RAWCOUNT` | | |
| `Output Cache Total Flushes` | `PERF_COUNTER_RAWCOUNT` | | |
| `Output Cache Total Hits` | `PERF_COUNTER_RAWCOUNT` | | |
| `Output Cache Total Misses` | `PERF_COUNTER_RAWCOUNT` | | |
| `Total Files Cached` | `PERF_COUNTER_RAWCOUNT` | | |
| `Total Flushed Files` | `PERF_COUNTER_RAWCOUNT` | | |
| `Total Flushed Metadata` | `PERF_COUNTER_RAWCOUNT` | | |
| `Total Flushed URIs` | `PERF_COUNTER_RAWCOUNT` | | |
| `Total HTTP Requests Served` | `PERF_COUNTER_RAWCOUNT` | | |
| `Total Metadata Cached` | `PERF_COUNTER_RAWCOUNT` | | |
| `Total URIs Cached` | `PERF_COUNTER_RAWCOUNT` | | |
| `URI Cache Flushes` | `PERF_COUNTER_RAWCOUNT` | | |
| `URI Cache Hits` | `PERF_COUNTER_RAWCOUNT` | | |
| `URI Cache Misses` | `PERF_COUNTER_RAWCOUNT` | | |
| `WebSocket Active Requests` | `PERF_COUNTER_RAWCOUNT` | | |
| `WebSocket Connection Attempts / Sec` | `PERF_COUNTER_COUNTER` | | |
| `WebSocket Connections Accepted / Sec` | `PERF_COUNTER_COUNTER` | | |
| `WebSocket Connections Rejected / Sec` | `PERF_COUNTER_COUNTER` | | |
Not read by the collector:
- `PERF_COUNTER_COUNTER`: `File Cache Hits / sec`, `File Cache Misses / sec`, `Metadata Cache Hits / sec`, `Metadata Cache Misses / sec`, `Output Cache Hits / sec`, `Output Cache Misses / sec`, `Requests / Sec`, `Uri Cache Hits / sec`, `Uri Cache Misses / sec`
- `PERF_COUNTER_RAWCOUNT`: `Total Threads`
### `Web Service`
Multi-instance. Instances: `_Total`, `Default Web Site`. Sample instance: `Default Web Site`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Current Anonymous Users` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Current Blocked Async I/O Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Current CGI Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Current Connections` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Current ISAPI Extension Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Current NonAnonymous Users` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Service Uptime` | `PERF_COUNTER_RAWCOUNT` | 3399 | |
| `Total Anonymous Users` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Blocked Async I/O Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Bytes Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Total Bytes Sent` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Total CGI Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Connection Attempts (all instances)` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Copy Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Delete Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Files Received` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Files Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Get Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Head Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total ISAPI Extension Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Lock Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Locked Errors` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Logon Attempts` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Mkcol Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Move Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total NonAnonymous Users` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Not Found Errors` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Options Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Other Request Methods` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Post Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Propfind Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Proppatch Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Put Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Rejected Async I/O Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Search Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Trace Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Unlock Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
Not read by the collector:
- `PERF_COUNTER_BULK_COUNT`: `Bytes Received/sec`, `Bytes Sent/sec`, `Bytes Total/sec`
- `PERF_COUNTER_COUNTER`: `Anonymous Users/sec`, `CGI Requests/sec`, `Connection Attempts/sec`, `Copy Requests/sec`, `Delete Requests/sec`, `Files Received/sec`, `Files Sent/sec`, `Files/sec`, `Get Requests/sec`, `Head Requests/sec`, `ISAPI Extension Requests/sec`, `Lock Requests/sec`, `Locked Errors/sec`, `Logon Attempts/sec`, `Mkcol Requests/sec`, `Move Requests/sec`, `NonAnonymous Users/sec`, `Not Found Errors/sec`, `Options Requests/sec`, `Other Request Methods/sec`, `Post Requests/sec`, `Propfind Requests/sec`, `Proppatch Requests/sec`, `Put Requests/sec`, `Search Requests/sec`, `Total Method Requests/sec`, `Trace Requests/sec`, `Unlock Requests/sec`
- `PERF_COUNTER_LARGE_RAWCOUNT`: `Total Bytes Transferred`
- `PERF_COUNTER_RAWCOUNT`: `Current blocked bandwidth bytes.`, `Current CAL count for authenticated users`, `Current CAL count for SSL connections`, `Maximum Anonymous Users`, `Maximum CAL count for authenticated users`, `Maximum CAL count for SSL connections`, `Maximum CGI Requests`, `Maximum Connections`, `Maximum ISAPI Extension Requests`, `Maximum NonAnonymous Users`, `Measured Async I/O Bandwidth Usage`, `Total Allowed Async I/O Requests`, `Total blocked bandwidth bytes.`, `Total count of failed CAL requests for authenticated users`, `Total count of failed CAL requests for SSL connections`, `Total Files Transferred`, `Total Method Requests`
### `Web Service Cache`
Single-instance.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Active Flushed Entries` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Current File Cache Memory Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Current Files Cached` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Current Metadata Cached` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Current URIs Cached` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `File Cache Flushes` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `File Cache Hits` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `File Cache Misses` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Kernel: Current URIs Cached` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Kernel: Total Flushed URIs` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Kernel: Total URIs Cached` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Kernel: URI Cache Flushes` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Kernel: URI Cache Hits` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Kernel: URI Cache Misses` | `PERF_COUNTER_RAWCOUNT` | 85 | |
| `Maximum File Cache Memory Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Metadata Cache Flushes` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Metadata Cache Hits` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Metadata Cache Misses` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Output Cache Current Flushed Items` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Output Cache Current Items` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Output Cache Current Memory Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Output Cache Total Flushed Items` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Output Cache Total Flushes` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Output Cache Total Hits` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Output Cache Total Misses` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Files Cached` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Flushed Files` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Flushed Metadata` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Flushed URIs` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total Metadata Cached` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Total URIs Cached` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `URI Cache Flushes` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `URI Cache Hits` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `URI Cache Misses` | `PERF_COUNTER_RAWCOUNT` | 0 | |
Not read by the collector:
- `PERF_COUNTER_COUNTER`: `Kernel: Uri Cache Hits/sec`
- `PERF_RAW_FRACTION`: `File Cache Hits %`, `Kernel: URI Cache Hits %`, `Metadata Cache Hits %`, `URI Cache Hits %`
- `PERF_SAMPLE_FRACTION`: `Output Cache Current Hits %`
internal/collector/logical_disk/AGENTS.md
+72
View File
@@ -0,0 +1,72 @@
# `logical_disk` collector
The collector reads the `LogicalDisk` PDH object with `pdh.CounterTypeRaw`.
The object exists on every Windows host; no role is needed. It is
multi-instance. These notes were recorded on a Windows Server 2025
(build 26100) Hyper-V guest.
- Instances are drive letters (`C:`), `HarddiskVolumeN` for volumes without a
drive letter (here `HarddiskVolume1` and `HarddiskVolume4`) and the
aggregate `_Total`. `internal/pdh` drops `_Total` because the collector
asks for `pdh.InstancesAll`. The other instances pass through the volume
include and exclude regular expressions, and the instance name is the `volume` label.
- `% Free Space` is `PERF_RAW_FRACTION`. Its raw value equals
`Free Megabytes` (49907) and its base is the volume size in megabytes
(129254). The collector reads the base (`,secondvalue`) as the size in MB.
Both values are in units of 1,048,576 bytes per the help text.
- The time counters share one raw value. `% Disk Read Time`,
`Avg. Disk Read Queue Length` and the first value of `Avg. Disk sec/Read`
were all 9858832; the write counters were all 11319205, and
`Avg. Disk sec/Transfer` (21178037) is their sum. The raw value is the
cumulative busy time in 100 ns ticks. `internal/pdh` converts the
`PERF_PRECISION_100NS_TIMER` counters to seconds. The queue length and
`PERF_AVERAGE_TIMER` values arrive in ticks and need the 1e-7 factor; the
counter time base is 10 MHz here.
- `Avg. Disk sec/Read`, `/Write` and `/Transfer` are `PERF_AVERAGE_TIMER`.
Their base is the operation count and equals `Disk Reads/sec` (3073),
`Disk Writes/sec` (1698) and their sum (4771).
- `% Idle Time` is a cumulative 100 ns timer as well, not a percentage.
On `C:` it was 115960642 ticks, about 11.6 seconds.
- `Disk Read Bytes/sec` and `Disk Write Bytes/sec` (`PERF_COUNTER_BULK_COUNT`)
and the `PERF_COUNTER_COUNTER` rates are cumulative counts since boot.
- `Current Disk Queue Length` is an instantaneous snapshot (gauge) and was 0.
- `Free Megabytes` is a gauge. The collector code notes that Windows caches
it; the volume is queried directly when possible.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `LogicalDisk`
Multi-instance. Instances: `_Total`, `C:`, `HarddiskVolume1`, `HarddiskVolume4`. Sample instance: `C:`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `% Disk Read Time` | `PERF_PRECISION_100NS_TIMER` | 9858832 | |
| `% Disk Write Time` | `PERF_PRECISION_100NS_TIMER` | 11319205 | |
| `% Free Space` | `PERF_RAW_FRACTION` | 49907 | 129254 |
| `% Idle Time` | `PERF_PRECISION_100NS_TIMER` | 115960642 | |
| `Avg. Disk Read Queue Length` | `PERF_COUNTER_100NS_QUEUELEN_TYPE` | 9858832 | |
| `Avg. Disk sec/Read` | `PERF_AVERAGE_TIMER` | 9858832 | 3073 |
| `Avg. Disk sec/Transfer` | `PERF_AVERAGE_TIMER` | 21178037 | 4771 |
| `Avg. Disk sec/Write` | `PERF_AVERAGE_TIMER` | 11319205 | 1698 |
| `Avg. Disk Write Queue Length` | `PERF_COUNTER_100NS_QUEUELEN_TYPE` | 11319205 | |
| `Current Disk Queue Length` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Disk Read Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 131518976 | |
| `Disk Reads/sec` | `PERF_COUNTER_COUNTER` | 3073 | |
| `Disk Write Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 139952640 | |
| `Disk Writes/sec` | `PERF_COUNTER_COUNTER` | 1698 | |
| `Free Megabytes` | `PERF_COUNTER_RAWCOUNT` | 49907 | |
| `Split IO/Sec` | `PERF_COUNTER_COUNTER` | 134 | |
Not read by the collector:
- `PERF_AVERAGE_BULK`: `Avg. Disk Bytes/Read`, `Avg. Disk Bytes/Transfer`, `Avg. Disk Bytes/Write`
- `PERF_COUNTER_100NS_QUEUELEN_TYPE`: `Avg. Disk Queue Length`
- `PERF_COUNTER_BULK_COUNT`: `Disk Bytes/sec`
- `PERF_COUNTER_COUNTER`: `Disk Transfers/sec`
- `PERF_PRECISION_100NS_TIMER`: `% Disk Time`
internal/collector/memory/AGENTS.md
+82
View File
@@ -0,0 +1,82 @@
# `memory` collector
The collector reads the single-instance PDH object `Memory` with
`pdh.CounterTypeRaw`. The object exists on every Windows host, so no role is
needed. It also calls `GlobalMemoryStatusEx` for the physical and virtual
totals, which do not come from PDH. These notes were recorded on Windows
Server 2025 (build 26100).
- Every `PERF_COUNTER_LARGE_RAWCOUNT` counter of this object is a gauge in
bytes, except `Available KBytes` and `Available MBytes`.
`Cache Bytes Peak` is the highest cache size since boot. In the sample,
`Available Bytes` equals `Available KBytes` times 1024, and
`Available MBytes` is the truncated value.
- `Available Bytes` equals the sum of `Free & Zero Page List Bytes` and the
three `Standby Cache ... Bytes` counters (exact in the sample).
`Cache Bytes` and `System Cache Resident Bytes` are the same value; the help
text says they are equivalent.
- Every `/sec` counter is `PERF_COUNTER_COUNTER`; its raw value is a count
since boot. `Pages/sec` equals `Pages Input/sec` plus `Pages Output/sec`
(exact in the sample) and counts pages. `Page Reads/sec` and
`Page Writes/sec` count disk operations, regardless of how many pages each
operation moved.
- `Long-Term Average Standby Cache Lifetime (s)` is a gauge in seconds.
- `Pool Paged Allocs` and `Pool Nonpaged Allocs` are `PERF_COUNTER_RAWCOUNT`.
The help text calls them the number of allocation calls; both were 0 on this
host, so their behavior could not be checked.
- `System Code Total Bytes` (8192) was smaller than
`System Code Resident Bytes` in the sample, although the help text calls the
resident value a component of the total. `Standby Cache Core Bytes` was 0.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `Memory`
Single-instance.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Available Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 6625095680 | |
| `Available KBytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 6469820 | |
| `Available MBytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 6318 | |
| `Cache Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 401428480 | |
| `Cache Bytes Peak` | `PERF_COUNTER_LARGE_RAWCOUNT` | 558510080 | |
| `Cache Faults/sec` | `PERF_COUNTER_COUNTER` | 13400536 | |
| `Commit Limit` | `PERF_COUNTER_LARGE_RAWCOUNT` | 19728846848 | |
| `Committed Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 11770671104 | |
| `Demand Zero Faults/sec` | `PERF_COUNTER_COUNTER` | 49162751 | |
| `Free & Zero Page List Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 602169344 | |
| `Long-Term Average Standby Cache Lifetime (s)` | `PERF_COUNTER_RAWCOUNT` | 547 | |
| `Modified Page List Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 23617536 | |
| `Page Faults/sec` | `PERF_COUNTER_COUNTER` | 130811351 | |
| `Page Reads/sec` | `PERF_COUNTER_COUNTER` | 1012866 | |
| `Page Writes/sec` | `PERF_COUNTER_COUNTER` | 8667 | |
| `Pages Input/sec` | `PERF_COUNTER_COUNTER` | 8156926 | |
| `Pages Output/sec` | `PERF_COUNTER_COUNTER` | 244196 | |
| `Pages/sec` | `PERF_COUNTER_COUNTER` | 8401122 | |
| `Pool Nonpaged Allocs` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Pool Nonpaged Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 523558912 | |
| `Pool Paged Allocs` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Pool Paged Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 697995264 | |
| `Pool Paged Resident Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 673656832 | |
| `Standby Cache Core Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Standby Cache Normal Priority Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 5178191872 | |
| `Standby Cache Reserve Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 844734464 | |
| `System Cache Resident Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 401428480 | |
| `System Code Resident Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 11939840 | |
| `System Code Total Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 8192 | |
| `System Driver Resident Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 60264448 | |
| `System Driver Total Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 27291648 | |
| `Transition Faults/sec` | `PERF_COUNTER_COUNTER` | 63418925 | |
| `Transition Pages RePurposed/sec` | `PERF_COUNTER_COUNTER` | 10022193 | |
| `Write Copies/sec` | `PERF_COUNTER_COUNTER` | 1722840 | |
Not read by the collector:
- `PERF_COUNTER_RAWCOUNT`: `Free System Page Table Entries`
- `PERF_RAW_FRACTION`: `% Committed Bytes In Use`
internal/collector/msmq/AGENTS.md
+36
View File
@@ -0,0 +1,36 @@
# `msmq` collector
The collector reads the PDH object `MSMQ Queue` with `pdh.CounterTypeRaw`. The
object exists only where the Message Queuing feature (MSMQ service) is
installed. It is multi-instance. These notes were recorded on Windows Server
2025 (build 26100) with no application queues.
- All four counters are `PERF_COUNTER_LARGE_RAWCOUNT` and are gauges: the help
text says they count messages or bytes that "currently reside" in the queue.
`Bytes ...` counters are bytes.
- Instances: `Computer Queues` plus one instance per queue, named
`<computer>\private$\<queue>` in lower case. A fresh install already has the
internal queues `server2025\private$\admin_queue$` and
`server2025\private$\order_queue$`. The collector uses the instance name
unchanged as the `name` label.
- For `Computer Queues`, `Messages/Bytes in Queue` is the dead-letter queue
and `Messages/Bytes in Journal Queue` is the computer journal.
- All values were 0 on the recording host.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `MSMQ Queue`
Multi-instance. Instances: `Computer Queues`, `server2025\private$\admin_queue$`, `server2025\private$\order_queue$`. Sample instance: `Computer Queues`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Bytes in Journal Queue` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Bytes in Queue` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Messages in Journal Queue` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Messages in Queue` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
internal/collector/mssql/AGENTS.md
+443
View File
@@ -0,0 +1,443 @@
# `mssql` collector
The collector reads the SQL Server performance objects (`Access Methods`,
`Buffer Manager`, `Databases`, `Locks`, `Wait Statistics` and others) with
`pdh.CounterTypeRaw`, one PDH collector per SQL Server instance. It needs a
SQL Server Database Engine; CI does not provision one. These notes were
recorded on Windows Server 2025 (build 26100) with SQL Server 2022 Developer
Edition (`PatchLevel` 16.0.1000.6), named instance `NONDEFAULT`.
- Instance discovery: each value name under
`HKLM\Software\Microsoft\Microsoft SQL Server\Instance Names\SQL` is an
instance; its data (here `MSSQL16.NONDEFAULT`) names the `Setup` key with
`PatchLevel` and `Edition`. The `mssql_instance` label is the part after
the first dot (`NONDEFAULT`).
- Object names: the value name `MSSQLSERVER` (default instance) gives
`SQLServer:<object>`; every other instance gives `MSSQL$<name>:<object>`,
for example `MSSQL$NONDEFAULT:Buffer Manager`. The tables below write
`MSSQL$<instance>`.
- The Windows Internal Database on this host publishes
`MSSQL$MICROSOFT##WID:<object>` objects, but it is not listed under
`Instance Names\SQL`, so the collector does not read it.
- `pdh` drops `_Total` because the collector does not request it. On a host
without Always On availability groups, `Availability Replica` and
`Database Replica` have only `_Total`, so they emit no series.
- `Active parallel redo threads` is read through a second `Databases`
collector that exists only for SQL Server 2019 (major version 15) and later.
- Instance labels: `Databases` instances are database names, including
`mssqlsystemresource`, `model_msdb` and `model_replicatedmaster`. `Locks`
instances are lock resource types (`Key`, `RID`, `Page`, `Object`, ...),
15 including `_Total`. `SQL Errors` instances are error classes
(`User Errors`, `Info Errors`, `Kill Connection Errors`,
`DB Offline Errors`); `_Total` equalled their sum (38 = 34 + 4).
- `Wait Statistics` is unusual: every counter is a wait class and every
instance is a statistic, `Average wait time (ms)`,
`Cumulative wait time (ms) per second`, `Waits in progress` and
`Waits started per second`. All counters are
`PERF_COUNTER_LARGE_RAWCOUNT`, so the meaning comes from the instance name.
All values stayed 0 over 10 seconds on this idle instance.
- Every `.../sec` counter, and several counters without `/sec` (for example
`Mars Deadlocks`, the `SOAP ...` and `Lob...Count` counters,
`Log Flush Wait Time`, `Group Commit Time`, `Transaction Delay`,
`Database Flow Control Delay`), is `PERF_COUNTER_BULK_COUNT`: a cumulative
count since the instance started.
- `PERF_COUNTER_LARGE_RAWCOUNT` counters that are cumulative by their help
text: `Log Truncations`, `Log Growths` and `Log Shrinks` ("Total number of
..."). Sizes, queues and "active"/"current" counts (`Active Transactions`,
`Processes blocked`, `Snapshot Transactions`, `Version Store unit count`,
...) are gauges. The help text of `Version Store unit creation` and
`unit truncation` does not say which; both were 2 and 0.
- Units from the help text:
- KB: every `(KB)` counter, `Bulk Copy Throughput/sec`,
`Version Generation/Cleanup rate (KB/s)`, and in `Database Replica` the
`Recovery Queue`, `Log Send Queue`, `Total Log requiring undo`,
`Log remaining for undo` and `Redo Bytes Remaining` counters.
- Bytes: `Log Bytes Flushed/sec`, `Log Pool Total Active Log Size`,
`Log Pool Total Shared Pool Size`, `Log Bytes Compressed/sec` and
`Log Bytes Decompressed/sec`.
- Milliseconds: `Log Flush Wait Time`, `Log Flush Write Time (ms)`,
`Lock Wait Time (ms)`, `Average Wait Time (ms)`, `Transaction Delay`,
`Flow Control Time (ms/sec)`.
- Microseconds: `Readahead time/sec`, `Group Commit Time/sec` (Databases),
`Group Commit Time` and `Database Flow Control Delay` (Database Replica),
`XTP Controller DLC Latency/Fetch` and `XTP Controller DLC Peak Latency`.
- Seconds: `Page life expectancy`, `Extension page unreferenced time`,
`Longest Transaction Running Time`.
- Pages (8 KB): `Database pages`, `Target pages`, `Extension ... pages`.
- `Integral Controller Slope` and `External benefit of memory` are scaled
by 10 billion.
- Fractions and averages: the base is a separate counter in PDH
(`Buffer cache hit ratio base`, `Worktables From Cache Base`,
`Log Cache Hit Ratio Base`, `Average Wait Time Base`,
`Update conflict ratio base`, `XTP Controller DLC Latency Base`) and
`pdh.CounterTypeRaw` returns it as `,secondvalue`.
- `Locks` `Average Wait Time (ms)` is `PERF_AVERAGE_BULK`: the raw value is
cumulative lock wait milliseconds and equalled `Lock Wait Time (ms)`
(499); the base is the cumulative number of waits (3).
- `Buffer cache hit ratio` (`PERF_LARGE_RAW_FRACTION`) had equal value and
base, and both grew from 56 to 175 within 10 seconds while
`Page lookups/sec` grew by 247. They are not the lookup counter and not a
fixed sample.
- The dump below and the 10 second check above were taken at different
times. The counters had reset in between (`Page lookups/sec` fell from
92847 to 11432), so raw values differ.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `MSSQL$<instance>:Access Methods`
Single-instance.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `AU cleanup batches/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `AU cleanups/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `By-reference Lob Create Count` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `By-reference Lob Use Count` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Count Lob Readahead` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Count Pull In Row` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Count Push Off Row` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Deferred dropped AUs` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Deferred Dropped rowsets` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Dropped rowset cleanups/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Dropped rowsets skipped/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Extent Deallocations/sec` | `PERF_COUNTER_BULK_COUNT` | 2 | |
| `Extents Allocated/sec` | `PERF_COUNTER_BULK_COUNT` | 8 | |
| `Failed AU cleanup batches/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Failed leaf page cookie` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Failed tree page cookie` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Forwarded Records/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `FreeSpace Page Fetches/sec` | `PERF_COUNTER_BULK_COUNT` | 7 | |
| `FreeSpace Scans/sec` | `PERF_COUNTER_BULK_COUNT` | 7 | |
| `Full Scans/sec` | `PERF_COUNTER_BULK_COUNT` | 254 | |
| `Index Searches/sec` | `PERF_COUNTER_BULK_COUNT` | 44003 | |
| `InSysXact waits/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `LobHandle Create Count` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `LobHandle Destroy Count` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `LobSS Provider Create Count` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `LobSS Provider Destroy Count` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `LobSS Provider Truncation Count` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Mixed page allocations/sec` | `PERF_COUNTER_BULK_COUNT` | 6 | |
| `Page compression attempts/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Page Deallocations/sec` | `PERF_COUNTER_BULK_COUNT` | 4 | |
| `Page Splits/sec` | `PERF_COUNTER_BULK_COUNT` | 9 | |
| `Pages Allocated/sec` | `PERF_COUNTER_BULK_COUNT` | 14 | |
| `Pages compressed/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Probe Scans/sec` | `PERF_COUNTER_BULK_COUNT` | 15454 | |
| `Range Scans/sec` | `PERF_COUNTER_BULK_COUNT` | 27655 | |
| `Scan Point Revalidations/sec` | `PERF_COUNTER_BULK_COUNT` | 3 | |
| `Skipped Ghosted Records/sec` | `PERF_COUNTER_BULK_COUNT` | 7 | |
| `Table Lock Escalations/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Used leaf page cookie` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Used tree page cookie` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Workfiles Created/sec` | `PERF_COUNTER_BULK_COUNT` | 32 | |
| `Worktables Created/sec` | `PERF_COUNTER_BULK_COUNT` | 21 | |
| `Worktables From Cache Ratio` | `PERF_LARGE_RAW_FRACTION` | 0 | 0 |
### `MSSQL$<instance>:Availability Replica`
Multi-instance. Instances: `_Total`. Sample instance: `_Total`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Bytes Received from Replica/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Bytes Sent to Replica/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Bytes Sent to Transport/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Flow Control Time (ms/sec)` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Flow Control/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Receives from Replica/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Resent Messages/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Sends to Replica/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Sends to Transport/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
### `MSSQL$<instance>:Buffer Manager`
Single-instance.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Background writer pages/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Buffer cache hit ratio` | `PERF_LARGE_RAW_FRACTION` | 56 | 56 |
| `Checkpoint pages/sec` | `PERF_COUNTER_BULK_COUNT` | 3 | |
| `Database pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 2838 | |
| `Extension allocated pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Extension free pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Extension in use as percentage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Extension outstanding IO counter` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Extension page evictions/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Extension page reads/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Extension page unreferenced time` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Extension page writes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Free list stalls/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Integral Controller Slope` | `PERF_COUNTER_LARGE_RAWCOUNT` | 10 | |
| `Lazy writes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Page life expectancy` | `PERF_COUNTER_LARGE_RAWCOUNT` | 3273 | |
| `Page lookups/sec` | `PERF_COUNTER_BULK_COUNT` | 92847 | |
| `Page reads/sec` | `PERF_COUNTER_BULK_COUNT` | 2840 | |
| `Page writes/sec` | `PERF_COUNTER_BULK_COUNT` | 15 | |
| `Readahead pages/sec` | `PERF_COUNTER_BULK_COUNT` | 128 | |
| `Readahead time/sec` | `PERF_COUNTER_BULK_COUNT` | 872 | |
| `Target pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 32751616 | |
Not read by the collector:
- `PERF_LARGE_RAW_FRACTION`: `RBPEX cache hit ratio`
### `MSSQL$<instance>:Database Replica`
Multi-instance. Instances: `_Total`. Sample instance: `_Total`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Database Flow Control Delay` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Database Flow Controls/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `File Bytes Received/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Group Commit Time` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Group Commits/Sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Log Apply Pending Queue` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Log Apply Ready Queue` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Log Bytes Compressed/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Log Bytes Decompressed/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Log Bytes Received/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Log Compression Cache hits/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Log Compression Cache misses/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Log Compressions/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Log Decompressions/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Log remaining for undo` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Log Send Queue` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Mirrored Write Transactions/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Recovery Queue` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Redo blocked/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Redo Bytes Remaining` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Redone Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Redones/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Total Log requiring undo` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Transaction Delay` | `PERF_COUNTER_BULK_COUNT` | 0 | |
### `MSSQL$<instance>:Databases`
Multi-instance. Instances: `_Total`, `master`, `model`, `model_msdb`, `model_replicatedmaster`, `msdb`, `mssqlsystemresource`, `tempdb`. Sample instance: `master`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Active parallel redo threads` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Active Transactions` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Backup/Restore Throughput/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Bulk Copy Rows/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Bulk Copy Throughput/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Commit table entries` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Data File(s) Size (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 4096 | |
| `DBCC Logical Scan Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Group Commit Time/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Log Bytes Flushed/sec` | `PERF_COUNTER_BULK_COUNT` | 204800 | |
| `Log Cache Hit Ratio` | `PERF_LARGE_RAW_FRACTION` | 0 | 0 |
| `Log Cache Reads/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Log File(s) Size (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1272 | |
| `Log File(s) Used Size (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 664 | |
| `Log Flush Wait Time` | `PERF_COUNTER_BULK_COUNT` | 1 | |
| `Log Flush Waits/sec` | `PERF_COUNTER_BULK_COUNT` | 23 | |
| `Log Flush Write Time (ms)` | `PERF_COUNTER_BULK_COUNT` | 1 | |
| `Log Flushes/sec` | `PERF_COUNTER_BULK_COUNT` | 23 | |
| `Log Growths` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Log Pool Cache Misses/sec` | `PERF_COUNTER_BULK_COUNT` | 3 | |
| `Log Pool Disk Reads/sec` | `PERF_COUNTER_BULK_COUNT` | 2 | |
| `Log Pool Hash Deletes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Log Pool Hash Inserts/sec` | `PERF_COUNTER_BULK_COUNT` | 3 | |
| `Log Pool Invalid Hash Entry/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Log Pool Log Scan Pushes/sec` | `PERF_COUNTER_BULK_COUNT` | 3 | |
| `Log Pool LogWriter Pushes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Log Pool Push Empty FreePool/sec` | `PERF_COUNTER_BULK_COUNT` | 3 | |
| `Log Pool Push Low Memory/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Log Pool Push No Free Buffer/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Log Pool Req. Behind Trunc/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Log Pool Requests Old VLF/sec` | `PERF_COUNTER_BULK_COUNT` | 4 | |
| `Log Pool Requests/sec` | `PERF_COUNTER_BULK_COUNT` | 8 | |
| `Log Pool Total Active Log Size` | `PERF_COUNTER_LARGE_RAWCOUNT` | 446464 | |
| `Log Pool Total Shared Pool Size` | `PERF_COUNTER_LARGE_RAWCOUNT` | 12288 | |
| `Log Shrinks` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Log Truncations` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Percent Log Used` | `PERF_COUNTER_LARGE_RAWCOUNT` | 52 | |
| `Repl. Pending Xacts` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Repl. Trans. Rate` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Shrink Data Movement Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Tracked transactions/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Transactions/sec` | `PERF_COUNTER_BULK_COUNT` | 151 | |
| `Write Transactions/sec` | `PERF_COUNTER_BULK_COUNT` | 23 | |
| `XTP Controller DLC Latency/Fetch` | `PERF_AVERAGE_BULK` | 0 | 0 |
| `XTP Controller DLC Peak Latency` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `XTP Controller Log Processed/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `XTP Memory Used (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
Not read by the collector:
- `PERF_AVERAGE_BULK`: `Avg Dist From EOL/LP Request`
- `PERF_COUNTER_BULK_COUNT`: `PVS in-row diff generated/sec`, `PVS in-row diff retrieved/sec`, `PVS off-row pages allocated/sec`, `PVS off-row pages deleted/sec`, `PVS off-row record generated/sec`, `PVS off-row record retrieved/sec`, `Tail Log Cache Deletes/sec`, `Tail Log Cache Misses/sec`, `TLC LogWriter Pushes/sec`, `TLC Req. Behind Trunc/sec`
- `PERF_COUNTER_LARGE_RAWCOUNT`: `WPR add lsn bucket miss`, `WPR bucket swaps`, `WPR stale check bucket miss`
### `MSSQL$<instance>:General Statistics`
Single-instance.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Active Temp Tables` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Connection Reset/sec` | `PERF_COUNTER_BULK_COUNT` | 75 | |
| `Event Notifications Delayed Drop` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `HTTP Authenticated Requests` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Logical Connections` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Logins/sec` | `PERF_COUNTER_BULK_COUNT` | 5 | |
| `Logouts/sec` | `PERF_COUNTER_BULK_COUNT` | 5 | |
| `Mars Deadlocks` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Non-atomic yield rate` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Processes blocked` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `SOAP Empty Requests` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `SOAP Method Invocations` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `SOAP Session Initiate Requests` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `SOAP Session Terminate Requests` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `SOAP SQL Requests` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `SOAP WSDL Requests` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `SQL Trace IO Provider Lock Waits` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Temp Tables Creation Rate` | `PERF_COUNTER_BULK_COUNT` | 2 | |
| `Temp Tables For Destruction` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Tempdb recovery unit id` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Tempdb rowset id` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Trace Event Notification Queue` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Transactions` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `User Connections` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
### `MSSQL$<instance>:Locks`
Multi-instance. Instances: `_Total`, `AllocUnit`, `Application`, `Database`, `Extent`, `File`, `HoBT`, `Key`, ... (15 in total). Sample instance: `AllocUnit`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Average Wait Time (ms)` | `PERF_AVERAGE_BULK` | 0 | 0 |
| `Lock Requests/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Lock Timeouts (timeout > 0)/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Lock Timeouts/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Lock Wait Time (ms)` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Lock Waits/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Number of Deadlocks/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
### `MSSQL$<instance>:Memory Manager`
Single-instance.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Connection Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 2024 | |
| `Database Cache Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 22704 | |
| `External benefit of memory` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Free Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 7776 | |
| `Granted Workspace Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Lock Blocks` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Lock Blocks Allocated` | `PERF_COUNTER_LARGE_RAWCOUNT` | 3050 | |
| `Lock Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 768 | |
| `Lock Owner Blocks` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Lock Owner Blocks Allocated` | `PERF_COUNTER_LARGE_RAWCOUNT` | 5550 | |
| `Log Pool Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 4376 | |
| `Maximum Workspace Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 4500240 | |
| `Memory Grants Outstanding` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Memory Grants Pending` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Optimizer Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1024 | |
| `Reserved Server Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `SQL Cache Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1720 | |
| `Stolen Server Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 297616 | |
| `Target Server Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 5988752 | |
| `Total Server Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 328096 | |
Not read by the collector:
- `PERF_COUNTER_BULK_COUNT`: `Decommit Memory (KB)/sec`
### `MSSQL$<instance>:SQL Errors`
Multi-instance. Instances: `_Total`, `DB Offline Errors`, `Info Errors`, `Kill Connection Errors`, `User Errors`. Sample instance: `DB Offline Errors`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Errors/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
### `MSSQL$<instance>:SQL Statistics`
Single-instance.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Auto-Param Attempts/sec` | `PERF_COUNTER_BULK_COUNT` | 35 | |
| `Batch Requests/sec` | `PERF_COUNTER_BULK_COUNT` | 160 | |
| `Failed Auto-Params/sec` | `PERF_COUNTER_BULK_COUNT` | 27 | |
| `Forced Parameterizations/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Guided plan executions/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Misguided plan executions/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Safe Auto-Params/sec` | `PERF_COUNTER_BULK_COUNT` | 2 | |
| `SQL Attention rate` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `SQL Compilations/sec` | `PERF_COUNTER_BULK_COUNT` | 83 | |
| `SQL Re-Compilations/sec` | `PERF_COUNTER_BULK_COUNT` | 2 | |
| `Unsafe Auto-Params/sec` | `PERF_COUNTER_BULK_COUNT` | 6 | |
### `MSSQL$<instance>:Transactions`
Single-instance.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Free Space in tempdb (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 62528 | |
| `Longest Transaction Running Time` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `NonSnapshot Version Transactions` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Snapshot Transactions` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Transactions` | `PERF_COUNTER_LARGE_RAWCOUNT` | 6 | |
| `Update conflict ratio` | `PERF_AVERAGE_BULK` | 0 | 0 |
| `Update Snapshot Transactions` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Version Cleanup rate (KB/s)` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Version Generation rate (KB/s)` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Version Store Size (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Version Store unit count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 2 | |
| `Version Store unit creation` | `PERF_COUNTER_LARGE_RAWCOUNT` | 2 | |
| `Version Store unit truncation` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
### `MSSQL$<instance>:Wait Statistics`
Multi-instance. Instances: `Average wait time (ms)`, `Cumulative wait time (ms) per second`, `Waits in progress`, `Waits started per second`. Sample instance: `Average wait time (ms)`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Lock waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Log buffer waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Log write waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Memory grant queue waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Network IO waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Non-Page latch waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Page IO latch waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Page latch waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Thread-safe memory objects waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Transaction ownership waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Wait for the worker` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Workspace synchronization waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
internal/collector/net/AGENTS.md
+61
View File
@@ -0,0 +1,61 @@
# `net` collector
The collector reads the `Network Interface` PDH object with
`pdh.CounterTypeRaw`. The object exists on every Windows host; no role is
needed. It is multi-instance. These notes were recorded on a Windows Server
2025 (build 26100) Hyper-V guest that also runs the Hyper-V role.
- Instances are adapter descriptions with `(`, `)`, `#`, `/` and `\`
replaced by `[`, `]`, `_`, `_` and `_`. The collector applies the same
replacement to the adapter description for the `nic` label of the info
metrics. There is no `_Total` instance.
- On this host `Network Interface` had only one instance,
`Microsoft Hyper-V Network Adapter`, although `Get-NetAdapter` also listed
the Hyper-V switch adapters `Hyper-V Virtual Ethernet Adapter` and
`Hyper-V Virtual Ethernet Adapter #2`. Those appear only in the
`Network Adapter` object (as `Hyper-V Virtual Ethernet Adapter _2` for the
second one), which the collector does not read.
- `Current Bandwidth` is in bits per second per the help text; the raw value
was 10000000000 for a 10 Gbps link. The collector divides it by 8 for
`current_bandwidth_bytes`.
- `Output Queue Length` is a gauge. The help text says it is always 0
because NDIS queues the requests.
- The `Packets ... Discarded`, `Packets ... Errors` and
`Packets Received Unknown` counters are `PERF_COUNTER_LARGE_RAWCOUNT` but
cumulative counts of packets. All were 0 here.
- The `/sec` counters are `PERF_COUNTER_BULK_COUNT`, cumulative since the
adapter started. `Bytes Total/sec` is the sum of `Bytes Received/sec` and
`Bytes Sent/sec`, and `Packets/sec` is the sum of `Packets Received/sec`
and `Packets Sent/sec` (exact in the sample).
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `Network Interface`
Multi-instance. Instances: `Microsoft Hyper-V Network Adapter`. Sample instance: `Microsoft Hyper-V Network Adapter`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Bytes Received/sec` | `PERF_COUNTER_BULK_COUNT` | 6363880254 | |
| `Bytes Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 82374607 | |
| `Bytes Total/sec` | `PERF_COUNTER_BULK_COUNT` | 6446254861 | |
| `Current Bandwidth` | `PERF_COUNTER_LARGE_RAWCOUNT` | 10000000000 | |
| `Output Queue Length` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Packets Outbound Discarded` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Packets Outbound Errors` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Packets Received Discarded` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Packets Received Errors` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Packets Received Unknown` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Packets Received/sec` | `PERF_COUNTER_BULK_COUNT` | 4526889 | |
| `Packets Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 538207 | |
| `Packets/sec` | `PERF_COUNTER_BULK_COUNT` | 5065096 | |
Not read by the collector:
- `PERF_COUNTER_BULK_COUNT`: `Packets Received Non-Unicast/sec`, `Packets Received Unicast/sec`, `Packets Sent Non-Unicast/sec`, `Packets Sent Unicast/sec`, `TCP RSC Coalesced Packets/sec`, `TCP RSC Exceptions/sec`
- `PERF_COUNTER_LARGE_RAWCOUNT`: `Offloaded Connections`, `TCP Active RSC Connections`, `TCP RSC Average Packet Size`
internal/collector/nps/AGENTS.md
+74
View File
@@ -0,0 +1,74 @@
# `nps` collector
The collector reads the single-instance PDH objects `NPS Authentication Server`
and `NPS Accounting Server` with `pdh.CounterTypeRaw`. They exist only where
the Network Policy Server role (service `IAS`) is installed. These notes were
recorded on Windows Server 2025 (build 26100) with almost no RADIUS traffic.
- Every counter that the collector reads is `PERF_COUNTER_RAWCOUNT`. All of
them except the two time counters are cumulative packet counts since the
NPS service started.
- `Server Up Time` and `Server Reset Time` are elapsed times. The help text
says "in hundredths of a second", but the raw value is seconds: 303 about
304 s after the `IAS` service started. Both objects report the same values.
- Each `X / sec.` twin (`PERF_COUNTER_COUNTER`, not read) has the same raw
value as `X` (`Packets Received / sec.` 1 = `Packets Received` 1).
- `No Record` exists only on `NPS Accounting Server`;
`Access-Accepts/Challenges/Rejects/Requests` only on
`NPS Authentication Server`.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `NPS Accounting Server`
Single-instance.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Accounting-Requests` | `PERF_COUNTER_RAWCOUNT` | 1 | |
| `Accounting-Responses` | `PERF_COUNTER_RAWCOUNT` | 1 | |
| `Bad Authenticators` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Dropped Packets` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Invalid Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Malformed Packets` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `No Record` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Packets Received` | `PERF_COUNTER_RAWCOUNT` | 1 | |
| `Packets Sent` | `PERF_COUNTER_RAWCOUNT` | 1 | |
| `Server Reset Time` | `PERF_COUNTER_RAWCOUNT` | 3275 | |
| `Server Up Time` | `PERF_COUNTER_RAWCOUNT` | 3275 | |
| `Unknown Type` | `PERF_COUNTER_RAWCOUNT` | 0 | |
Not read by the collector:
- `PERF_COUNTER_COUNTER`: `Accounting-Requests / sec.`, `Accounting-Responses / sec.`, `Bad Authenticators / sec.`, `Dropped Packets / sec.`, `Invalid Requests / sec.`, `Malformed Packets / sec.`, `No Record / sec.`, `Packets Received / sec.`, `Packets Sent / sec.`, `Unknown Type / sec.`
### `NPS Authentication Server`
Single-instance.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Access-Accepts` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Access-Challenges` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Access-Rejects` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Access-Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Bad Authenticators` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Dropped Packets` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Invalid Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Malformed Packets` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Packets Received` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Packets Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Server Reset Time` | `PERF_COUNTER_RAWCOUNT` | 3275 | |
| `Server Up Time` | `PERF_COUNTER_RAWCOUNT` | 3275 | |
| `Unknown Type` | `PERF_COUNTER_RAWCOUNT` | 0 | |
Not read by the collector:
- `PERF_COUNTER_COUNTER`: `Access-Accepts / sec.`, `Access-Challenges / sec.`, `Access-Rejects / sec.`, `Access-Requests / sec.`, `Bad Authenticators / sec.`, `Dropped Packets / sec.`, `Invalid Requests / sec.`, `Malformed Packets / sec.`, `Packets Received / sec.`, `Packets Sent / sec.`, `Unknown Type / sec.`
internal/collector/pagefile/AGENTS.md
+37
View File
@@ -0,0 +1,37 @@
# `pagefile` collector
The collector reads the multi-instance PDH object `Paging File` with
`pdh.CounterTypeRaw`. The object exists on every Windows host with a page
file, so no role is needed. It also uses `GetPerformanceInfo` for the page
size and `os.Stat` for the file size. These notes were recorded on Windows
Server 2025 (build 26100) with one page file.
- Instances are the page file paths, here `C:\pagefile.sys`, plus `_Total`.
`_Total` is dropped because the collector does not request it. The
instance name had no `\??\` prefix on this host. The `file` label is the
instance name with any `\??\` prefix removed.
- `% Usage` and `% Usage Peak` are `PERF_RAW_FRACTION`. Despite the `%`, the
raw value is the number of pages in use (a gauge) and the base
(`,secondvalue`) is the page file size in pages. With 4096-byte pages, the
base 622592 matched the file size of 2550136832 bytes from `os.Stat` and
the 2432 MB `AllocatedBaseSize` of `Win32_PageFileUsage`.
- `% Usage` was 128462 pages in the dump and 0 in a later live sample.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `Paging File`
Multi-instance. Instances: `_Total`, `C:\pagefile.sys`. Sample instance: `C:\pagefile.sys`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `% Usage` | `PERF_RAW_FRACTION` | 128462 | 622592 |
Not read by the collector:
- `PERF_RAW_FRACTION`: `% Usage Peak`
internal/collector/physical_disk/AGENTS.md
+62
View File
@@ -0,0 +1,62 @@
# `physical_disk` collector
The collector reads the `PhysicalDisk` PDH object with `pdh.CounterTypeRaw`.
The object exists on every Windows host; no role is needed. It is
multi-instance. These notes were recorded on a Windows Server 2025
(build 26100) Hyper-V guest, so the disks are virtual Hyper-V disks.
- Instances are the disk number, followed by the drive letters of its
volumes when it has any: `0 C:`, `1`, `2`, `3`, `4`, plus the aggregate
`_Total`. `internal/pdh` drops `_Total` because the collector asks for
`pdh.InstancesAll`. The collector matches the include and exclude regular expressions
against the full instance name and then labels the metrics with the part
before the first space (`0`).
- The time counters share one raw value. `% Disk Read Time` and the first
value of `Avg. Disk sec/Read` were both 7370439057; the write pair was
9150445263, and `Avg. Disk sec/Transfer` (16520884320) is their sum. The
value is the cumulative busy time in 100 ns ticks.
- `internal/pdh` converts the `PERF_PRECISION_100NS_TIMER` counters
(`% Disk Read Time`, `% Disk Write Time`, `% Idle Time`) to seconds.
`PERF_AVERAGE_TIMER` values arrive in ticks of the 10 MHz counter time base
and need the 1e-7 factor.
- The `PERF_AVERAGE_TIMER` base is the operation count: it equals
`Disk Reads/sec` (781613), `Disk Writes/sec` (940802) and their sum
(1722415).
- `Disk Read Bytes/sec`, `Disk Write Bytes/sec` (`PERF_COUNTER_BULK_COUNT`,
bytes) and the `PERF_COUNTER_COUNTER` rates are cumulative counts since
boot.
- `Current Disk Queue Length` is an instantaneous snapshot (gauge) and was 0.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `PhysicalDisk`
Multi-instance. Instances: `_Total`, `0 C:`, `1`, `2`, `3`, `4`. Sample instance: `0 C:`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `% Disk Read Time` | `PERF_PRECISION_100NS_TIMER` | 7370439057 | |
| `% Disk Write Time` | `PERF_PRECISION_100NS_TIMER` | 9150445263 | |
| `% Idle Time` | `PERF_PRECISION_100NS_TIMER` | 28962791306 | |
| `Avg. Disk sec/Read` | `PERF_AVERAGE_TIMER` | 7370439057 | 781613 |
| `Avg. Disk sec/Transfer` | `PERF_AVERAGE_TIMER` | 16520884320 | 1722415 |
| `Avg. Disk sec/Write` | `PERF_AVERAGE_TIMER` | 9150445263 | 940802 |
| `Current Disk Queue Length` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Disk Read Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 44064459264 | |
| `Disk Reads/sec` | `PERF_COUNTER_COUNTER` | 781613 | |
| `Disk Write Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 55022156288 | |
| `Disk Writes/sec` | `PERF_COUNTER_COUNTER` | 940802 | |
| `Split IO/Sec` | `PERF_COUNTER_COUNTER` | 75848 | |
Not read by the collector:
- `PERF_AVERAGE_BULK`: `Avg. Disk Bytes/Read`, `Avg. Disk Bytes/Transfer`, `Avg. Disk Bytes/Write`
- `PERF_COUNTER_100NS_QUEUELEN_TYPE`: `Avg. Disk Queue Length`, `Avg. Disk Read Queue Length`, `Avg. Disk Write Queue Length`
- `PERF_COUNTER_BULK_COUNT`: `Disk Bytes/sec`
- `PERF_COUNTER_COUNTER`: `Disk Transfers/sec`
- `PERF_PRECISION_100NS_TIMER`: `% Disk Time`
internal/collector/remote_fx/AGENTS.md
+86
View File
@@ -0,0 +1,86 @@
# `remote_fx` collector
The collector reads `RemoteFX Network` and `RemoteFX Graphics` with
`pdh.CounterTypeRaw`. Instances exist only while an RDP session is connected,
so most local runs see none. These notes were recorded on Windows Server 2025
with one active RDP session over TCP.
- Instance names differ in case between the objects: `RDP-tcp 0` in
`RemoteFX Network`, `RDP-Tcp 0` in `RemoteFX Graphics`.
`normalizeSessionName` makes both `RDP-Tcp 0`, which is also the
`session_name` of `windows_terminal_services_session_info`. The console and
services sessions have no instance.
- `RemoteFX Network` counter types and units (from the counter help text):
- `Current TCP/UDP Bandwidth`: `NumberOfItems32`, kbit/s (1000 bit/s).
- `Base/Current TCP/UDP RTT`: `NumberOfItems32`, milliseconds. They stayed
0 for the whole TCP-only session; they appear to be measured only with UDP
transport.
- `Total Sent Bytes`, `Total Received Bytes`: `NumberOfItems32`, cumulative
bytes.
- `Total/TCP/UDP Sent Rate`, `Total/TCP/UDP Received Rate` and
`Sent Rate P0`..`P3`: `RateOfCountsPerSecond32`, cumulative **bits**
(`Total Sent Rate` raw was 8 × `Total Sent Bytes`).
- `UDP Packets Sent/sec`, `UDP Packets Received/sec`:
`RateOfCountsPerSecond32`, cumulative packets.
- `Loss Rate`, `Retransmission Rate`, `FEC Rate`: `SampleFraction`; raw is a
cumulative numerator and the base (`,secondvalue`) the matching total.
Neither value alone is a percentage. Both were 0 on TCP.
- `RemoteFX Graphics`: `Input/Output/Source Frames/Second` and the three
`Frames Skipped/Second - Insufficient {Client,Network,Server} Resources`
counters are `RateOfCountsPerSecond32` (cumulative frames);
`Frame Quality` (percent), `Graphics Compression ratio` and
`Average Encoding Time` (milliseconds) are `NumberOfItems32` gauges.
- Sample: `Input Frames/Second` raw 27086, `Output Frames/Second` 26142,
`Source Frames/Second` 0, `Frame Quality` 100, `Current TCP Bandwidth`
151159, `Total Sent Bytes` 29262741, `Total Received Bytes` 3920173.
- `RemoteFX Root GPU Management` exists but has no instances without GPU
partitioning; the collector does not read it.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `RemoteFX Graphics`
Multi-instance. Instances: `RDP-Tcp 0`. Sample instance: `RDP-Tcp 0`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Average Encoding Time` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Frame Quality` | `PERF_COUNTER_RAWCOUNT` | 100 | |
| `Frames Skipped/Second - Insufficient Client Resources` | `PERF_COUNTER_COUNTER` | 0 | |
| `Frames Skipped/Second - Insufficient Network Resources` | `PERF_COUNTER_COUNTER` | 0 | |
| `Frames Skipped/Second - Insufficient Server Resources` | `PERF_COUNTER_COUNTER` | 0 | |
| `Graphics Compression ratio` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Input Frames/Second` | `PERF_COUNTER_COUNTER` | 27104 | |
| `Output Frames/Second` | `PERF_COUNTER_COUNTER` | 26157 | |
| `Source Frames/Second` | `PERF_COUNTER_COUNTER` | 0 | |
### `RemoteFX Network`
Multi-instance. Instances: `RDP-tcp 0`. Sample instance: `RDP-tcp 0`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Base TCP RTT` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Base UDP RTT` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Current TCP Bandwidth` | `PERF_COUNTER_RAWCOUNT` | 151159 | |
| `Current TCP RTT` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Current UDP Bandwidth` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Current UDP RTT` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `FEC Rate` | `PERF_SAMPLE_FRACTION` | 0 | 0 |
| `Loss Rate` | `PERF_SAMPLE_FRACTION` | 0 | 0 |
| `Retransmission Rate` | `PERF_SAMPLE_FRACTION` | 0 | 0 |
| `Total Received Bytes` | `PERF_COUNTER_RAWCOUNT` | 3922173 | |
| `Total Sent Bytes` | `PERF_COUNTER_RAWCOUNT` | 29288171 | |
| `UDP Packets Received/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `UDP Packets Sent/sec` | `PERF_COUNTER_COUNTER` | 0 | |
Not read by the collector:
- `PERF_COUNTER_COUNTER`: `Sent Rate P0`, `Sent Rate P1`, `Sent Rate P2`, `Sent Rate P3`, `TCP Received Rate`, `TCP Sent Rate`, `Total Received Rate`, `Total Sent Rate`, `UDP Received Rate`, `UDP Sent Rate`
internal/collector/smb/AGENTS.md
+55
View File
@@ -0,0 +1,55 @@
# `smb` collector
The collector reads the `SMB Server Shares` PDH object with
`pdh.CounterTypeRaw`. The object comes with the SMB server (`LanmanServer`)
and is multi-instance, one instance per share. These notes were recorded on a
Windows Server 2025 (build 26100) domain controller running as a Hyper-V
guest.
- Instance names are UNC paths with `*` as the host, for example
`\\*\IPC$`, `\\*\SYSVOL` and `\\*\NETLOGON`. Scoped shares use the scope
name instead, here `\\MSCLUSTER\ClusterStorage$`. There is also an
aggregate `_Total`, which `internal/pdh` drops because the collector asks
for `pdh.InstancesAll`. The instance name is the `share` label.
- `Current Open File Count` and `Tree Connect Count` are gauges: the help
text calls them the handles "currently open" and "the current number of
tree connects". With one test client connected, `\\*\SmbClientTest` had
`Tree Connect Count` 1 and `Current Open File Count` 1.
- The `/sec` counters (`PERF_COUNTER_BULK_COUNT` and
`PERF_COUNTER_COUNTER`) are cumulative. `Files Opened/sec` was 28 on
`\\*\SYSVOL` while its open file count was 0.
- `Received Bytes/sec` and `Sent Bytes/sec` are bytes and include SMB
protocol data such as packet headers, per the help text.
- The sample instance `\\*\ADMIN$` had no traffic, so all its values are 0.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `SMB Server Shares`
Multi-instance. Instances: `\\*\ADMIN$`, `\\*\C$`, `\\*\IPC$`, `\\*\MSCLUSTER`, `\\*\NETLOGON`, `\\*\SmbClientTest`, `\\*\SYSVOL`, `\\MSCLUSTER\ClusterStorage$`, ... (9 in total). Sample instance: `\\*\ADMIN$`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Current Open File Count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Files Opened/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Metadata Requests/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Read Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Received Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Sent Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Tree Connect Count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | |
| `Write Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | |
Not read by the collector:
- `PERF_AVERAGE_BULK`: `Avg. Bytes/Read`, `Avg. Bytes/Write`, `Avg. Data Bytes/Request`
- `PERF_AVERAGE_TIMER`: `Avg. sec/Data Request`, `Avg. sec/Read`, `Avg. sec/Request`, `Avg. sec/Write`
- `PERF_COUNTER_100NS_QUEUELEN_TYPE`: `Avg. Data Queue Length`, `Avg. Read Queue Length`, `Avg. Write Queue Length`
- `PERF_COUNTER_BULK_COUNT`: `Attempted Compressed Responses/sec`, `Bytes Compressed/sec`, `Compressed Requests/sec`, `Data Bytes/sec`, `Read Bytes transmitted ByPassCSV/sec`, `Read Bytes transmitted via SMB Direct/sec`, `Read Bytes/sec`, `Requests/sec`, `Successful Compressed Responses/sec`, `Transferred Bytes/sec`, `Write Bytes transmitted ByPassCSV/sec`, `Write Bytes transmitted via SMB Direct/sec`, `Write Bytes/sec`
- `PERF_COUNTER_COUNTER`: `Data Requests/sec`, `Read Requests transmitted via BypassCSV/sec`, `Read Requests transmitted via SMB Direct/sec`, `Write Requests transmitted via BypassCSV/sec`, `Write Requests transmitted via SMB Direct/sec`
- `PERF_COUNTER_LARGE_RAWCOUNT`: `Current Bypass Open File Count`, `Current Data Queue Length`, `Current Durable Open File Count`, `Current Pending Requests`, `Total Durable Handle Reopen Count`, `Total Failed Durable Handle Reopen Count`, `Total Failed Persistent Handle Reopen Count`, `Total Failed Resilient Handle Reopen Count`, `Total File Open Count`, `Total Persistent Handle Reopen Count`, `Total Resilient Handle Reopen Count`
- `PERF_LARGE_RAW_FRACTION`: `% Persistent Handles`, `% Resilient Handles`
internal/collector/smbclient/AGENTS.md
+63
View File
@@ -0,0 +1,63 @@
# `smbclient` collector
The collector reads the `SMB Client Shares` PDH object with
`pdh.CounterTypeRaw`. It is multi-instance, with one instance per share the
host has connected to. These notes were recorded on a Windows Server 2025
(build 26100) Hyper-V guest that had mapped one share of its own SMB server.
- Instance names have a single leading backslash: `\SERVER2025\SmbClientTest`.
The collector splits the name at `\` and uses the two parts as the `server`
and `share` labels. The aggregate `_Total` is dropped by `internal/pdh`
because the collector asks for `pdh.InstancesAll`.
- The mapped share was idle, so every counter of the sample instance was 0.
- `Current Data Queue Length` is the only gauge ("the current number of read
or write requests outstanding"). The `/sec` counters are cumulative counts.
- `Avg. Data/Read/Write Queue Length` are `PERF_COUNTER_100NS_QUEUELEN_TYPE`:
the raw value is accumulated queue time in 100 ns ticks. `internal/pdh` does
not convert this type, so the collector applies the 1e-7 factor.
- `Avg. sec/Read`, `Avg. sec/Write` and `Avg. sec/Data Request` are
`PERF_AVERAGE_TIMER`. The first value is the summed latency in ticks of the
10 MHz counter time base and the base is the request count; the collector
reads only the first value.
- `Data Bytes/sec`, `Read Bytes/sec` and `Write Bytes/sec` are bytes
(`PERF_COUNTER_BULK_COUNT`).
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `SMB Client Shares`
Multi-instance. Instances: `\SERVER2025\SmbClientTest`, `_Total`. Sample instance: `\SERVER2025\SmbClientTest`.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Avg. Data Queue Length` | `PERF_COUNTER_100NS_QUEUELEN_TYPE` | 0 | |
| `Avg. Read Queue Length` | `PERF_COUNTER_100NS_QUEUELEN_TYPE` | 0 | |
| `Avg. sec/Data Request` | `PERF_AVERAGE_TIMER` | 0 | 0 |
| `Avg. sec/Read` | `PERF_AVERAGE_TIMER` | 0 | 0 |
| `Avg. sec/Write` | `PERF_AVERAGE_TIMER` | 0 | 0 |
| `Avg. Write Queue Length` | `PERF_COUNTER_100NS_QUEUELEN_TYPE` | 0 | |
| `Credit Stalls/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Current Data Queue Length` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Data Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Data Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Metadata Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Read Bytes transmitted via SMB Direct/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Read Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Read Requests transmitted via SMB Direct/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Read Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Turbo I/O Reads/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Turbo I/O Writes/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Write Bytes transmitted via SMB Direct/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Write Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `Write Requests transmitted via SMB Direct/sec` | `PERF_COUNTER_COUNTER` | 0 | |
| `Write Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | |
Not read by the collector:
- `PERF_AVERAGE_BULK`: `Avg. Bytes/Read`, `Avg. Bytes/Write`, `Avg. Data Bytes/Request`
- `PERF_COUNTER_COUNTER`: `Attempted Compressed Requests/sec`, `Compressed Bytes Sent/sec`, `Compressed Responses/sec`, `Successful Compressed Requests /sec`
internal/collector/system/AGENTS.md
+45
View File
@@ -0,0 +1,45 @@
# `system` collector
The collector reads the single-instance PDH object `System` with
`pdh.CounterTypeRaw`. The object exists on every Windows host, so no role is
needed. The boot time comes from `ntdll`, not from the PDH counter
`System Up Time`. These notes were recorded on Windows Server 2025
(build 26100).
- `Context Switches/sec`, `Exception Dispatches/sec` and `System Calls/sec`
are `PERF_COUNTER_COUNTER`. The raw value is a cumulative count since boot.
The type has a 32-bit raw value, so a busy host wraps it at 2^32; a scraper
sees the wrap as a counter reset. `System Calls/sec` was already 345 million
in the sample.
- `Processes`, `Threads` and `Processor Queue Length` are
`PERF_COUNTER_RAWCOUNT` gauges. The help text calls `Processes` and
`Threads` instantaneous counts. `Processor Queue Length` counts ready
threads in the single queue shared by all processors, so per-processor load
needs a division by the processor count. It was 0 in the sample.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `System`
Single-instance.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Context Switches/sec` | `PERF_COUNTER_COUNTER` | 50992231 | |
| `Exception Dispatches/sec` | `PERF_COUNTER_COUNTER` | 321946 | |
| `Processes` | `PERF_COUNTER_RAWCOUNT` | 200 | |
| `Processor Queue Length` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `System Calls/sec` | `PERF_COUNTER_COUNTER` | 345210165 | |
| `Threads` | `PERF_COUNTER_RAWCOUNT` | 2894 | |
Not read by the collector:
- `PERF_COUNTER_BULK_COUNT`: `File Control Bytes/sec`, `File Read Bytes/sec`, `File Write Bytes/sec`
- `PERF_COUNTER_COUNTER`: `Alignment Fixups/sec`, `File Control Operations/sec`, `File Data Operations/sec`, `File Read Operations/sec`, `File Write Operations/sec`, `Floating Emulations/sec`
- `PERF_ELAPSED_TIME`: `System Up Time`
- `PERF_RAW_FRACTION`: `% Registry Quota In Use`
internal/collector/time/AGENTS.md
+41
View File
@@ -0,0 +1,41 @@
# `time` collector
The collector reads the single-instance PDH object `Windows Time Service` with
`pdh.CounterTypeRaw`. The object needs the W32Time service. These notes were
recorded on Windows Server 2025 (build 26100), a domain controller and
Hyper-V guest.
- `Computed Time Offset` (`PERF_COUNTER_LARGE_RAWCOUNT`) and
`NTP Roundtrip Delay` (`PERF_COUNTER_RAWCOUNT`) are gauges in microseconds,
per the help text. The offset is absolute, so it is never negative.
- `Clock Frequency Adjustment` is a gauge in nominal clock units;
`Clock Frequency Adjustment (PPB)` is the same adjustment in parts per
billion. In the sample they were 0 and 600.
- The struct tag spells the counter `Clock Frequency Adjustment (ppb)`, but
Windows names it `(PPB)`. The name lookup is case-insensitive, and the
counter was read on this host.
- `NTP Server Incoming Requests` and `NTP Server Outgoing Responses` are
`PERF_COUNTER_BULK_COUNT`; the raw value is a cumulative count.
- `NTP Client Time Source Count`, `NTP Roundtrip Delay` and both NTP server
counters were 0 on this host.
## Counter reference
Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second
values that `pdh.CounterTypeRaw` returns for the sample instance.
### `Windows Time Service`
Single-instance.
Counters the collector reads:
| Counter | Type | Raw | Base |
|---|---|---|---|
| `Clock Frequency Adjustment` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `Clock Frequency Adjustment (PPB)` | `PERF_COUNTER_RAWCOUNT` | 600 | |
| `Computed Time Offset` | `PERF_COUNTER_LARGE_RAWCOUNT` | 83 | |
| `NTP Client Time Source Count` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `NTP Roundtrip Delay` | `PERF_COUNTER_RAWCOUNT` | 0 | |
| `NTP Server Incoming Requests` | `PERF_COUNTER_BULK_COUNT` | 0 | |
| `NTP Server Outgoing Responses` | `PERF_COUNTER_BULK_COUNT` | 0 | |