diff --git a/AGENTS.md b/AGENTS.md index 2ef6b303..4ace6ef5 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -186,6 +186,25 @@ go build -o windows_exporter.dev.exe ./cmd/windows_exporter/ Adjust the collector list for the change. Leave the existing exporter instance running unless the user requests changes to it. +To check a collector's metric types against Windows, list each counter of the +PDH object with its type and raw value. Windows PowerShell 5.1 can do this +through .NET; `RawValue` and `BaseValue` are what `pdh.CounterTypeRaw` returns +as first and second value: + +```powershell +$cat = [System.Diagnostics.PerformanceCounterCategory]'DirectoryServices' +$cat.GetCounters('NTDS') | ForEach-Object { + $s = $_.NextSample() + '{0} | {1} | raw={2} base={3}' -f $_.CounterName, $_.CounterType, $s.RawValue, $s.BaseValue +} +``` + +Every PDH-based collector except `exchange`, `smtp` and `vmware` has such a +dump in the `AGENTS.md` of its directory, including roles that are rarely +available on development machines (AD DS, AD CS, AD FS, DFSR, Hyper-V, IIS, +SQL Server, NPS, RemoteFX sessions). Check a type or unit question there +first. + ## Dashboards, rules and runbooks Read [`contrib/mixin/README.md`](contrib/mixin/README.md) and diff --git a/internal/collector/ad/AGENTS.md b/internal/collector/ad/AGENTS.md new file mode 100644 index 00000000..6bd35adf --- /dev/null +++ b/internal/collector/ad/AGENTS.md @@ -0,0 +1,311 @@ +# `ad` collector + +The collector reads the PDH object `DirectoryServices` (instance `NTDS`, the +only instance) with `pdh.CounterTypeRaw`. The object exists only on a domain +controller, so most development machines and CI runners cannot read it. The +notes below were recorded on a Windows Server 2025 DC (forest with one DC, +light lab traffic) so that changes can be checked without one. Re-check them on +a DC when one is available. + +## Raw counter types + +`pdh.CounterTypeRaw` returns the raw first value and, for fractions, the base +as second value. On this object the raw value of every type is either a +cumulative count or an instantaneous value: + +- `PERF_COUNTER_COUNTER` (`RateOfCountsPerSecond32`): every counter whose name + ends in `/sec`, plus `Transitive operations milliseconds run` and + `DirSync session throttling rate`. The raw value is a cumulative count since + NTDS start; publish it as a counter. +- `PERF_RAW_FRACTION` (`RawFraction`): the 23 `DS % {Reads,Searches,Writes} + {from DRA,KCC,LDAP,LSA,NSPI,NTDSAPI,SAM}` and `DS % ... Other` counters (no + `DS % Reads from LDAP` exists). The raw value is a cumulative count of + operations from that origin; the base equals the raw value of + `DS Directory Reads/sec`, `DS Directory Searches/sec` or + `DS Directory Writes/sec`. Publish the numerator as a counter. +- `PERF_SAMPLE_FRACTION` (`SampleFraction`): `DS Name Cache hit rate`. Raw is + cumulative hits, base (`,secondvalue`) is cumulative lookups; both counters. +- `PERF_COUNTER_LARGE_RAWCOUNT` (`NumberOfItems64`): + `PDC successful password update notifications` and + `PDC failed password update notifications`, both cumulative. +- `PERF_COUNTER_RAWCOUNT` (`NumberOfItems32`): everything else. The type does + not say whether the value is a gauge, so go by the name: + - Cumulative since NTDS start: every name ending in `since boot` + (`DRA ... Since Boot` bytes, `DRA number of ... NC replication calls`, + `DRA total time of ...` (milliseconds), `DRA total number of + {Busy,MissingParent,NotEnoughAttrs/MissingObject,Preempted} failures`, + `RID Pool request successes/failures`, `RID Pool invalidations`, + `{Info,Warning,Error} eventlogs`, `{Warning,Error,Fatal} events`), + `DRA Sync Requests Made`, `DRA Sync Requests Successful`, + `DRA Sync Failures on Schema Mismatch`, `LDAP {Add,Modify,Modify DN,Delete} + Operations`, `LDAP Outbound Bytes`, `LDAP busy retries`, `Links added`, + `Links visited`, `Logical link deletes`, `Physical link deletes`, + `Objects visited`, `Objects returned`, `Replicate Single Object operations`, + and the `DRA Highest USN {Committed,Issued} ({High,Low} part)` pairs + (monotonic, combine as `high<<32 + low`). + - Instantaneous: thread counts (`DS Threads in Use`, `ATQ Threads + {LDAP,Other,Total}`, `LDAP Active Threads`, `LDAP Threads Sleeping on + BUSY`, `DRA Threads Getting NC Changes [Holding Semaphore]`), sessions + (`LDAP Client Sessions`, `AB Client Sessions`, `DirSync sessions in + progress`), queue and list sizes (`DS Monitor List Size`, + `DS Notify Queue Size`, `ATQ Outstanding Queued Requests`, + `DS Security Descriptor Propagations Events`, + `DS Security Descriptor Propagator Runtime Queue`, + `DRA Pending Replication Operations/Synchronizations`, + `DRA Inbound ... Remaining [in Packet]`, `LDAP batch slots available`, + `LDAP Page Search Cache size/entries count`), `Approximate highest DNT`, + and latencies in milliseconds: `ATQ Estimated Queue Delay`, + `ATQ Request Latency`, `ATQ Queue Latency`, `LDAP Bind Time` (last + successful bind), `SAM Account/Resource Group Evaluation Latency` (mean of + the last 100 evaluations) and + `DS Security Descriptor Propagator Average Exclusion Time`. + +Most `X` / `X/sec` pairs report the same raw value (for example +`LDAP Add Operations` and `LDAP Add Operations/sec`). `Objects visited/sec` and +`Objects returned/sec` do not: they stayed 0 while `Objects visited` and +`Objects returned` counted. Read the plain counter for those. + +## Sample + +Raw values from the DC, about one hour after NTDS start: + +```text +LDAP Searches/sec 1968 DS Directory Searches/sec 1524 +LDAP Successful Binds/sec 213 DS % Searches from LDAP 1231 / 1524 +Negotiated Binds/sec 209 DS % Writes from LSA 12 / 228 +NTLM Binds/sec 2 DS % Searches from LSA 9 / 1524 +LDAP New Connections/sec 233 DS Name Cache hit rate 69119 / 90091 +LDAP Client Sessions 12 DRA Highest USN Committed 61682 (high 0) +DS Monitor List Size 24 Approximate highest DNT 5376 +ATQ Threads Total 6 LDAP batch slots available 192 +LDAP Outbound Bytes 5706176 Warning events since boot 8256 +``` + +The DC had no replication partner, so all `DRA` counters were 0. + +## Checking a change without a DC + +`ad_test.go` skips when `DirectoryServices` is missing, so a passing test on a +machine without AD DS checks nothing. To check emitted +values, build `perfDataCounterValues` rows by hand from the types above (a +fraction's base goes into the `,secondvalue` field) and gather the metrics +through a registry. The mapping from struct field to metric and label is the +part most likely to be wrong: compare each `MustNewConstMetric` call with the +`perfdata` tag of the field it reads. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `DirectoryServices` + +Multi-instance. Instances: `NTDS`. Sample instance: `NTDS`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `AB ANR/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `AB Browses/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `AB Client Sessions` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `AB Matches/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `AB Property Reads/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `AB Proxy Lookups/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `AB Searches/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Approximate highest DNT` | `PERF_COUNTER_RAWCOUNT` | 5376 | | +| `ATQ Estimated Queue Delay` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `ATQ Outstanding Queued Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `ATQ Queue Latency` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `ATQ Request Latency` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `ATQ Threads LDAP` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `ATQ Threads Other` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `ATQ Threads Total` | `PERF_COUNTER_RAWCOUNT` | 6 | | +| `Base searches/sec` | `PERF_COUNTER_COUNTER` | 1081 | | +| `Database adds/sec` | `PERF_COUNTER_COUNTER` | 71 | | +| `Database deletes/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Database modifys/sec` | `PERF_COUNTER_COUNTER` | 157 | | +| `Database recycles/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Digest Binds/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DirSync session throttling rate` | `PERF_COUNTER_COUNTER` | 0 | | +| `DirSync sessions in progress` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Highest USN Committed (High part)` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Highest USN Committed (Low part)` | `PERF_COUNTER_RAWCOUNT` | 61683 | | +| `DRA Highest USN Issued (High part)` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Highest USN Issued (Low part)` | `PERF_COUNTER_RAWCOUNT` | 61683 | | +| `DRA Inbound Bytes Compressed (Between Sites, After Compression) Since Boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Inbound Bytes Compressed (Between Sites, After Compression)/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Inbound Bytes Compressed (Between Sites, Before Compression) Since Boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Inbound Bytes Compressed (Between Sites, Before Compression)/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Inbound Bytes Not Compressed (Within Site) Since Boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Inbound Bytes Not Compressed (Within Site)/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Inbound Bytes Total Since Boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Inbound Bytes Total/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Inbound Full Sync Objects Remaining` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Inbound Link Value Updates Remaining in Packet` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Inbound Link Values/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Inbound Object Updates Remaining in Packet` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Inbound Objects Applied/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Inbound Objects Filtered/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Inbound Objects/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Inbound Properties Applied/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Inbound Properties Filtered/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Inbound Properties Total/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Inbound Sync Link Deletion/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Inbound Total Updates Remaining in Packet` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Inbound Values (DNs only)/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Inbound Values Total/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA number of NC replication calls since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA number of successful NC replication calls since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Outbound Bytes Compressed (Between Sites, After Compression) Since Boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Outbound Bytes Compressed (Between Sites, After Compression)/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Outbound Bytes Compressed (Between Sites, Before Compression) Since Boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Outbound Bytes Compressed (Between Sites, Before Compression)/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Outbound Bytes Not Compressed (Within Site) Since Boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Outbound Bytes Not Compressed (Within Site)/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Outbound Bytes Total Since Boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Outbound Bytes Total/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Outbound Objects Filtered/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Outbound Objects/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Outbound Properties/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Outbound Values (DNs only)/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Outbound Values Total/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `DRA Pending Replication Operations` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Pending Replication Synchronizations` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Sync Failures on Schema Mismatch` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Sync Requests Made` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Sync Requests Successful` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Threads Getting NC Changes` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA Threads Getting NC Changes Holding Semaphore` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA total number of Busy failures since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA total number of MissingParent failures since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA total number of NotEnoughAttrs/MissingObject failures since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA total number of Preempted failures since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA total time of applying replication package since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA total time of NC replication calls since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA total time of successful NC replication calls since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA total time of successfully applying replication package since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA total time on waiting async replication packages since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DRA total time on waiting sync replication packages since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DS % Reads from DRA` | `PERF_RAW_FRACTION` | 0 | 2227 | +| `DS % Reads from KCC` | `PERF_RAW_FRACTION` | 80 | 2227 | +| `DS % Reads from LSA` | `PERF_RAW_FRACTION` | 70 | 2227 | +| `DS % Reads from NSPI` | `PERF_RAW_FRACTION` | 0 | 2227 | +| `DS % Reads from NTDSAPI` | `PERF_RAW_FRACTION` | 0 | 2227 | +| `DS % Reads from SAM` | `PERF_RAW_FRACTION` | 1977 | 2227 | +| `DS % Reads Other` | `PERF_RAW_FRACTION` | 100 | 2227 | +| `DS % Searches from DRA` | `PERF_RAW_FRACTION` | 0 | 2003 | +| `DS % Searches from KCC` | `PERF_RAW_FRACTION` | 28 | 2003 | +| `DS % Searches from LDAP` | `PERF_RAW_FRACTION` | 1637 | 2003 | +| `DS % Searches from LSA` | `PERF_RAW_FRACTION` | 9 | 2003 | +| `DS % Searches from NSPI` | `PERF_RAW_FRACTION` | 0 | 2003 | +| `DS % Searches from NTDSAPI` | `PERF_RAW_FRACTION` | 161 | 2003 | +| `DS % Searches from SAM` | `PERF_RAW_FRACTION` | 95 | 2003 | +| `DS % Searches Other` | `PERF_RAW_FRACTION` | 73 | 2003 | +| `DS % Writes from DRA` | `PERF_RAW_FRACTION` | 0 | 228 | +| `DS % Writes from KCC` | `PERF_RAW_FRACTION` | 0 | 228 | +| `DS % Writes from LDAP` | `PERF_RAW_FRACTION` | 115 | 228 | +| `DS % Writes from LSA` | `PERF_RAW_FRACTION` | 12 | 228 | +| `DS % Writes from NSPI` | `PERF_RAW_FRACTION` | 0 | 228 | +| `DS % Writes from NTDSAPI` | `PERF_RAW_FRACTION` | 9 | 228 | +| `DS % Writes from SAM` | `PERF_RAW_FRACTION` | 91 | 228 | +| `DS % Writes Other` | `PERF_RAW_FRACTION` | 1 | 228 | +| `DS Client Binds/sec` | `PERF_COUNTER_COUNTER` | 136 | | +| `DS Client Name Translations/sec` | `PERF_COUNTER_COUNTER` | 81 | | +| `DS Directory Reads/sec` | `PERF_COUNTER_COUNTER` | 2227 | | +| `DS Directory Searches/sec` | `PERF_COUNTER_COUNTER` | 2003 | | +| `DS Directory Writes/sec` | `PERF_COUNTER_COUNTER` | 228 | | +| `DS Monitor List Size` | `PERF_COUNTER_RAWCOUNT` | 24 | | +| `DS Name Cache hit rate` | `PERF_SAMPLE_FRACTION` | 80335 | 101578 | +| `DS Notify Queue Size` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DS Search sub-operations/sec` | `PERF_COUNTER_COUNTER` | 10617 | | +| `DS Security Descriptor Propagations Events` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DS Security Descriptor Propagator Average Exclusion Time` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DS Security Descriptor Propagator Runtime Queue` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `DS Security Descriptor sub-operations/sec` | `PERF_COUNTER_COUNTER` | 17 | | +| `DS Server Binds/sec` | `PERF_COUNTER_COUNTER` | 1 | | +| `DS Server Name Translations/sec` | `PERF_COUNTER_COUNTER` | 13 | | +| `DS Threads in Use` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Error eventlogs since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Error events since boot` | `PERF_COUNTER_RAWCOUNT` | 46 | | +| `External Binds/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Fast Binds/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Fatal events since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Info eventlogs since boot` | `PERF_COUNTER_RAWCOUNT` | 18 | | +| `LDAP Active Threads` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `LDAP Add Operations` | `PERF_COUNTER_RAWCOUNT` | 66 | | +| `LDAP Add Operations/sec` | `PERF_COUNTER_COUNTER` | 66 | | +| `LDAP batch slots available` | `PERF_COUNTER_RAWCOUNT` | 192 | | +| `LDAP Bind Time` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `LDAP busy retries` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `LDAP busy retries/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `LDAP Client Sessions` | `PERF_COUNTER_RAWCOUNT` | 8 | | +| `LDAP Closed Connections/sec` | `PERF_COUNTER_COUNTER` | 269 | | +| `LDAP Delete Operations` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `LDAP Delete Operations/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `LDAP Modify DN Operations` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `LDAP Modify DN Operations/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `LDAP Modify Operations` | `PERF_COUNTER_RAWCOUNT` | 45 | | +| `LDAP Modify Operations/sec` | `PERF_COUNTER_COUNTER` | 45 | | +| `LDAP New Connections/sec` | `PERF_COUNTER_COUNTER` | 277 | | +| `LDAP New SSL Connections/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `LDAP Outbound Bytes` | `PERF_COUNTER_RAWCOUNT` | 6254589 | | +| `LDAP Outbound Bytes/sec` | `PERF_COUNTER_COUNTER` | 6254589 | | +| `LDAP Page Search Cache entries count` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `LDAP Page Search Cache size` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `LDAP Searches/sec` | `PERF_COUNTER_COUNTER` | 2482 | | +| `LDAP Successful Binds/sec` | `PERF_COUNTER_COUNTER` | 257 | | +| `LDAP Threads Sleeping on BUSY` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `LDAP UDP operations/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `LDAP Writes/sec` | `PERF_COUNTER_COUNTER` | 111 | | +| `Link Values Cleaned/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Links added` | `PERF_COUNTER_RAWCOUNT` | 3 | | +| `Links added/sec` | `PERF_COUNTER_COUNTER` | 3 | | +| `Links visited` | `PERF_COUNTER_RAWCOUNT` | 2550 | | +| `Links visited/sec` | `PERF_COUNTER_COUNTER` | 2550 | | +| `Logical link deletes` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Logical link deletes/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Negotiated Binds/sec` | `PERF_COUNTER_COUNTER` | 253 | | +| `NTLM Binds/sec` | `PERF_COUNTER_COUNTER` | 2 | | +| `Objects returned` | `PERF_COUNTER_RAWCOUNT` | 24196 | | +| `Objects returned/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Objects visited` | `PERF_COUNTER_RAWCOUNT` | 31489 | | +| `Objects visited/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Onelevel searches/sec` | `PERF_COUNTER_COUNTER` | 287 | | +| `PDC failed password update notifications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `PDC password update notifications/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `PDC successful password update notifications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Phantoms Cleaned/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Phantoms Visited/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Physical link deletes` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Physical link deletes/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Replicate Single Object operations` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Replicate Single Object operations/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `RID Pool invalidations since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `RID Pool request failures since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `RID Pool request successes since boot` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `SAM Account Group Evaluation Latency` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `SAM Display Information Queries/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `SAM Domain Local Group Membership Evaluations/sec` | `PERF_COUNTER_COUNTER` | 1002 | | +| `SAM Enumerations/sec` | `PERF_COUNTER_COUNTER` | 6 | | +| `SAM GC Evaluations/sec` | `PERF_COUNTER_COUNTER` | 1 | | +| `SAM Global Group Membership Evaluations/sec` | `PERF_COUNTER_COUNTER` | 160 | | +| `SAM Machine Creation Attempts/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `SAM Membership Changes/sec` | `PERF_COUNTER_COUNTER` | 7 | | +| `SAM Non-Transitive Membership Evaluations/sec` | `PERF_COUNTER_COUNTER` | 4700 | | +| `SAM Password Changes/sec` | `PERF_COUNTER_COUNTER` | 1 | | +| `SAM Resource Group Evaluation Latency` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `SAM Successful Computer Creations/sec: Includes all requests` | `PERF_COUNTER_COUNTER` | 0 | | +| `SAM Successful User Creations/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `SAM Transitive Membership Evaluations/sec` | `PERF_COUNTER_COUNTER` | 1498 | | +| `SAM Universal Group Membership Evaluations/sec` | `PERF_COUNTER_COUNTER` | 336 | | +| `SAM User Creation Attempts/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Simple Binds/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Subtree searches/sec` | `PERF_COUNTER_COUNTER` | 635 | | +| `Tombstones Garbage Collected/sec` | `PERF_COUNTER_COUNTER` | 37 | | +| `Tombstones Visited/sec` | `PERF_COUNTER_COUNTER` | 41 | | +| `Transitive operations milliseconds run` | `PERF_COUNTER_COUNTER` | 0 | | +| `Transitive operations/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Transitive suboperations/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Warning eventlogs since boot` | `PERF_COUNTER_RAWCOUNT` | 5 | | +| `Warning events since boot` | `PERF_COUNTER_RAWCOUNT` | 10302 | | diff --git a/internal/collector/adcs/AGENTS.md b/internal/collector/adcs/AGENTS.md new file mode 100644 index 00000000..1fae8bc2 --- /dev/null +++ b/internal/collector/adcs/AGENTS.md @@ -0,0 +1,55 @@ +# `adcs` collector + +The collector reads the PDH object `Certification Authority` with +`pdh.CounterTypeRaw`. It exists only on a server running Active Directory +Certificate Services (`CertSvc`). These notes were recorded on a Windows +Server 2025 enterprise root CA so that changes can be checked without one. + +- Instances are certificate template names, plus `_Total`. An enterprise CA + has the default templates loaded, so the object has instances even before + any request was made, for example `Administrator`, `DirectoryEmailReplication`, + `DomainController`, `DomainControllerAuthentication`, `EFS`, `EFSRecovery`, + `KerberosAuthentication`, `Machine`, `SubCA`, `User` and `WebServer`. The + collector publishes them as `cert_template` and drops `_Total`. +- All 13 counters exist on every instance: + - `Requests/sec`, `Retrievals/sec`, `Failed Requests/sec`, + `Issued Requests/sec`, `Pending Requests/sec`, `Challenge Responses/sec` + and `Signed Certificate Timestamp Lists/sec` are `PERF_COUNTER_COUNTER` + (`RateOfCountsPerSecond32`); the raw value is a cumulative count since + CertSvc start. + - The six `... processing time (ms)` / `... signing time (ms)` counters are + `PERF_COUNTER_RAWCOUNT` (`NumberOfItems32`): the duration of the last + operation in milliseconds, a gauge. +- The separate object `Certification Authority Connections` (instance + `_Total`) has one counter, `Active connections` (`NumberOfItems32`). The + collector does not read it. +- A fresh CA reports 0 for every counter. Issuing a certificate changes the + CA database, so do not request certificates on a shared machine just to get + non-zero values. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `Certification Authority` + +Multi-instance. Instances: `_Total`, `Administrator`, `DirectoryEmailReplication`, `DomainController`, `DomainControllerAuthentication`, `EFS`, `EFSRecovery`, `KerberosAuthentication`, ... (12 in total). Sample instance: `Administrator`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Challenge Response processing time (ms)` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Challenge Responses/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Failed Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Issued Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Pending Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Request cryptographic signing time (ms)` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Request policy module processing time (ms)` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Request processing time (ms)` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Retrieval processing time (ms)` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Retrievals/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Signed Certificate Timestamp List processing time (ms)` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Signed Certificate Timestamp Lists/sec` | `PERF_COUNTER_COUNTER` | 0 | | diff --git a/internal/collector/adfs/AGENTS.md b/internal/collector/adfs/AGENTS.md new file mode 100644 index 00000000..20b52919 --- /dev/null +++ b/internal/collector/adfs/AGENTS.md @@ -0,0 +1,117 @@ +# `adfs` collector + +The collector reads the single-instance PDH object `AD FS` with +`pdh.CounterTypeRaw`. It exists only on a server running the AD FS service +(`adfssrv`). These notes were recorded on a Windows Server 2025 AD FS farm with +one node (WID configuration database) so that changes can be checked without +one. + +## Raw counter types + +- Each event has a cumulative counter of type `PERF_COUNTER_LARGE_RAWCOUNT` + (`NumberOfItems64`), for example `Token Requests`, and most have a twin with + a `/Sec` suffix of type `PERF_COUNTER_BULK_COUNT` + (`RateOfCountsPerSecond64`) with the same raw value. Read the plain name and + publish it as a counter. Some failure counters have no `/Sec` twin, and some + twins differ in spelling (`OAuth Client Authentications Failures` vs. + `OAuth Client Authentication Failures/Sec`), so copy names from a counter + dump, not from the twin. +- `Average Config Database Query Time`, `Average Artifact Database Query Time` + and `Average Search Latency for Alternate Login ID` are + `PERF_AVERAGE_TIMER` (`AverageTimer32`). The raw value is the summed + duration in ticks of the counter's time base (`PdhGetCounterTimeBase`, + 10 MHz on the test host, same as `QueryPerformanceFrequency`); the base + (`,secondvalue`) is the number of operations. `pdh.CounterTypeRaw` does not + convert this type, and `internal/pdh` reads the time base only for + `PERF_ELAPSED_TIME`. Seconds are `raw / time base`; do not hardcode a scale + factor. +- Sample after about one hour: `Average Config Database Query Time` raw + 11521176, base 306, which is 1.152 s in total, 3.8 ms per query. + `Federation Metadata Requests` was 1, all authentication counters 0. + +## Counters + +The object has about 150 counters on Server 2025. Besides the ones in +`types.go`, it has (each with `/Sec` twin unless noted): `Additional +Authentications` (MFA), `Device Authentication Failures`, `Federated +Authentication Failures`, `Microsoft Passport Authentication Failures`, +`Microsoft Passport Request [Failures]`, `Primary Device Authentications` and +`... Failures`, `Azure Primary Authentications` and `... Failures`, +`Alternate Login Id Authentications`, `Artifact Resolution Requests`, +`MSIS HTTP Token Requests`, `OAuth On Behalf Of Token Requests` and +`... Request Failures`, `OAuth VPN Certificate Token Requests` and +`... Request Failures`, `OAuth Device Flow {successful,failed} {device code, +usercode retrieval} requests`, `WebFinger Requests [Failures]`, +`UserInfo Requests [Failures]`, `Windows Hello Certificate Request [Failures]`, +`Token Requests/Sec`, the `Token Binding Requests ...` counters and the +`WIA` evaluation counters (no `/Sec` twins). + +Other AD FS objects (`AD FS Domain Connection Counters`, `AD FS Attribute Store +Counters`, `AD FS Local Claims Provider Connections`, `AD FS Cryptographic +Counters`, `AD FS External Authentication Provider Counters`, `AD FS Inter-node +Communication Counters`) are multi-instance and had no instances on the +one-node farm. Their counters are `AverageTimer32` averages with +`NumberOfItems64` failure counts. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `AD FS` + +Single-instance. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `AD Login Connection Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Artifact Database Connection Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Average Artifact Database Query Time` | `PERF_AVERAGE_TIMER` | 0 | 0 | +| `Average Config Database Query Time` | `PERF_AVERAGE_TIMER` | 11893699 | 333 | +| `Certificate Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Configuration Database Connection Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Device Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `External Authentication Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `External Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Extranet Account Lockouts` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Federated Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Federation Metadata Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1 | | +| `Microsoft Passport Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `OAuth AuthZ Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `OAuth Client Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `OAuth Client Authentications Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `OAuth Client Credentials Request Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `OAuth Client Credentials Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `OAuth Client Private Key Jwt Authentication Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `OAuth Client Private Key Jwt Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `OAuth Client Secret Basic Authentication Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `OAuth Client Secret Basic Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `OAuth Client Secret Post Authentication Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `OAuth Client Secret Post Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `OAuth Client Windows Integrated Authentication Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `OAuth Client Windows Integrated Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `OAuth Logon Certificate Request Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `OAuth Logon Certificate Token Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `OAuth Password Grant Request Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `OAuth Password Grant Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `OAuth Token Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Passive Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Password Change Failed Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Password Change Successful Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `SAML-P Token Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `SSO Authentication Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `SSO Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Token Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `U/P Authentication Failures` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `U/P Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Windows Integrated Authentications` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `WS-Fed Token Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `WS-Trust Token Requests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | + +Not read by the collector: + +- `PERF_AVERAGE_TIMER`: `Average Search Latency for Alternate Login ID` +- `PERF_COUNTER_BULK_COUNT`: `Additional Authentications/Sec`, `Alternate Login Id Authentications/Sec`, `Artifact Resolution Requests/Sec`, `Azure Primary Authentication Failures/Sec`, `Azure Primary Authentications/Sec`, `Certificate Authentications/Sec`, `Device Authentications/Sec`, `External Authentications/Sec`, `Federated Authentications/Sec`, `Federation Metadata Requests/Sec`, `Microsoft Passport Authentications Failures/Sec`, `Microsoft Passport Authentications/Sec`, `Microsoft Passport Request Failures/Sec`, `Microsoft Passport Request/Sec`, `MSIS HTTP Token Requests/Sec`, `OAuth AuthZ Requests/Sec`, `OAuth Client Authentication Failures/Sec`, `OAuth Client Authentications/Sec`, `OAuth Client Credentials Request Failures/Sec`, `OAuth Client Credentials Requests/Sec`, `OAuth Client Private Key Jwt Authentication Failures/Sec`, `OAuth Client Private Key Jwt Authentications/Sec`, `OAuth Client Secret Basic Authentication Failures/Sec`, `OAuth Client Secret Basic Authentications/Sec`, `OAuth Client Secret Post Authentication Failures/Sec`, `OAuth Client Secret Post Authentications/Sec`, `OAuth Client Windows Integrated Authentication Failures/Sec`, `OAuth Client Windows Integrated Authentications/Sec`, `OAuth Device Flow failed device code requests/sec`, `OAuth Device Flow failed usercode retrieval requests/sec`, `OAuth Device Flow successful device code requests/sec`, `OAuth Device Flow successful usercode retrieval requests/sec`, `OAuth Logon Certificate Request Failures/Sec`, `OAuth Logon Certificate Token Requests/Sec`, `OAuth On Behalf Of Request Failures/Sec`, `OAuth On Behalf Of Token Requests/Sec`, `OAuth Password Grant Requests Failures/Sec`, `OAuth Password Grant Requests/Sec`, `OAuth Token Requests/Sec`, `OAuth VPN Certificate Request Failures/Sec`, `OAuth VPN Certificate Token Requests/Sec`, `Passive Requests/Sec`, `Primary Device Authentications/Sec`, `SAML-P Token Requests/Sec`, `SSO Authentications/Sec`, `Token Requests/Sec`, `U/P Authentication Failures/Sec`, `U/P Authentications/Sec`, `UserInfo Requests Failures/Sec`, `UserInfo Requests/Sec`, `WebFinger Requests Failures/Sec`, `WebFinger Requests/Sec`, `Windows Hello Certificate Request Failures/Sec`, `Windows Hello Certificate Request/Sec`, `Windows Integrated Authentications/Sec`, `WS-Fed Token Requests/Sec`, `WS-Trust Token Requests/Sec` +- `PERF_COUNTER_LARGE_RAWCOUNT`: `Additional Authentications`, `Alternate Login Id Authentications`, `Artifact Resolution Requests`, `Azure Primary Authentication Failures`, `Azure Primary Authentications`, `Device Authentication Failures`, `Failed WIA Evaluation Requests`, `Federated Authentication Failures`, `Microsoft Passport Authentication Failures`, `Microsoft Passport Request Failures`, `Microsoft Passport Request`, `MSIS HTTP Token Requests`, `OAuth Device Flow failed device code requests`, `OAuth Device Flow failed usercode retrieval requests`, `OAuth Device Flow successful device code requests`, `OAuth Device Flow successful usercode retrieval requests`, `OAuth On Behalf Of Request Failures`, `OAuth On Behalf Of Token Requests`, `OAuth VPN Certificate Request Failures`, `OAuth VPN Certificate Token Requests`, `Primary Device Authentication Failures`, `Primary Device Authentications`, `Token Binding Requests Received with a Provided Binding ID`, `Token Binding Requests Received with a Referred Binding ID`, `Token Binding Requests Received`, `Token Binding Requests that contain an invalid token binding in a federated request scenario`, `Token Binding Requests that contain an invalid token binding in a non-federated request scenario`, `Token Binding Requests that failed due to invalid binding`, `Total WIA Evaluation Requests`, `UserInfo Requests Failures`, `UserInfo Requests`, `WebFinger Requests Failures`, `WebFinger Requests`, `WIA Cookied Requests`, `WIA No Cookied Requests`, `WIA Yes Cookied Requests`, `Windows Hello Certificate Request Failures`, `Windows Hello Certificate Request` diff --git a/internal/collector/cache/AGENTS.md b/internal/collector/cache/AGENTS.md new file mode 100644 index 00000000..9203099c --- /dev/null +++ b/internal/collector/cache/AGENTS.md @@ -0,0 +1,69 @@ +# `cache` collector + +The collector reads the single-instance PDH object `Cache` (file system cache) +with `pdh.CounterTypeRaw`. The object exists on every Windows host, so no role +is needed. These notes were recorded on Windows Server 2025 (build 26100). + +- Every `PERF_COUNTER_COUNTER` (`/sec`) counter is a cumulative count since + boot. In the sample, each `Sync ...` plus `Async ...` pair adds up exactly to + its total: `Copy Reads/sec`, `Data Maps/sec`, `Fast Reads/sec`, + `MDL Reads/sec` and `Pin Reads/sec`. +- The four `... Hits %` counters are `PERF_SAMPLE_FRACTION`. The raw value is + the cumulative hit count, not a percentage. The base (`,secondvalue`) is the + cumulative count of attempts and equals the raw value of the matching + `/sec` counter: `Copy Read Hits %` with `Copy Reads/sec`, `Data Map Hits %` + with `Data Maps/sec`, `MDL Read Hits %` with `MDL Reads/sec` and + `Pin Read Hits %` with `Pin Reads/sec`. The hit ratio is + rate(raw) / rate(base). +- `Data Map Pins/sec` is also `PERF_SAMPLE_FRACTION`, despite its name. Its raw + value is the cumulative count of data maps that pinned a page; its base is + `Data Maps/sec`. +- `Data Flushes/sec` and `Lazy Write Flushes/sec` count write operations; + `Data Flush Pages/sec` and `Lazy Write Pages/sec` count pages. One operation + can move more than one page. +- `Dirty Pages` and `Dirty Page Threshold` are gauges in pages, not bytes. +- `Async Fast Reads/sec`, `Async MDL Reads/sec` and + `Fast Read Resource Misses/sec` stayed 0 on this host. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `Cache` + +Single-instance. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Async Copy Reads/sec` | `PERF_COUNTER_COUNTER` | 35778 | | +| `Async Data Maps/sec` | `PERF_COUNTER_COUNTER` | 2 | | +| `Async Fast Reads/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Async MDL Reads/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Async Pin Reads/sec` | `PERF_COUNTER_COUNTER` | 12297 | | +| `Copy Read Hits %` | `PERF_SAMPLE_FRACTION` | 1607787 | 3347074 | +| `Copy Reads/sec` | `PERF_COUNTER_COUNTER` | 3347074 | | +| `Data Flush Pages/sec` | `PERF_COUNTER_COUNTER` | 9099373 | | +| `Data Flushes/sec` | `PERF_COUNTER_COUNTER` | 655879 | | +| `Data Map Hits %` | `PERF_SAMPLE_FRACTION` | 67204750 | 67331258 | +| `Data Map Pins/sec` | `PERF_SAMPLE_FRACTION` | 12144215 | 67331258 | +| `Data Maps/sec` | `PERF_COUNTER_COUNTER` | 67331258 | | +| `Dirty Page Threshold` | `PERF_COUNTER_LARGE_RAWCOUNT` | 2097010 | | +| `Dirty Pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 175 | | +| `Fast Read Not Possibles/sec` | `PERF_COUNTER_COUNTER` | 206860 | | +| `Fast Read Resource Misses/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Fast Reads/sec` | `PERF_COUNTER_COUNTER` | 2861445 | | +| `Lazy Write Flushes/sec` | `PERF_COUNTER_COUNTER` | 276157 | | +| `Lazy Write Pages/sec` | `PERF_COUNTER_COUNTER` | 5836457 | | +| `MDL Read Hits %` | `PERF_SAMPLE_FRACTION` | 1958 | 1959 | +| `MDL Reads/sec` | `PERF_COUNTER_COUNTER` | 1959 | | +| `Pin Read Hits %` | `PERF_SAMPLE_FRACTION` | 3216022 | 3671006 | +| `Pin Reads/sec` | `PERF_COUNTER_COUNTER` | 3671006 | | +| `Read Aheads/sec` | `PERF_COUNTER_COUNTER` | 2012322 | | +| `Sync Copy Reads/sec` | `PERF_COUNTER_COUNTER` | 3311296 | | +| `Sync Data Maps/sec` | `PERF_COUNTER_COUNTER` | 67331256 | | +| `Sync Fast Reads/sec` | `PERF_COUNTER_COUNTER` | 2861445 | | +| `Sync MDL Reads/sec` | `PERF_COUNTER_COUNTER` | 1959 | | +| `Sync Pin Reads/sec` | `PERF_COUNTER_COUNTER` | 3658709 | | diff --git a/internal/collector/cpu/AGENTS.md b/internal/collector/cpu/AGENTS.md new file mode 100644 index 00000000..196a7449 --- /dev/null +++ b/internal/collector/cpu/AGENTS.md @@ -0,0 +1,77 @@ +# `cpu` collector + +The collector reads the multi-instance PDH object `Processor Information` +with `pdh.CounterTypeRaw`. The object exists on every Windows host, so no role +is needed. These notes were recorded on Windows Server 2025 (build 26100), a +Hyper-V guest with 12 logical processors in one processor group. + +- Instances are `,`, for example `0,0` to `0,11`. Besides + `_Total` the object has one aggregate per processor group, `,_Total` + (here `0,_Total`). `pdh.IsTotalInstance` treats both as totals, so with + `pdh.InstancesAll` they are dropped and only per-processor rows remain. The + `core` label is the raw instance name, e.g. `0,3`. +- `% C1/C2/C3 Time`, `% DPC Time`, `% Idle Time`, `% Interrupt Time`, + `% Privileged Time` and `% User Time` are `PERF_100NSEC_TIMER`. Their raw + value is cumulative 100 ns ticks; `internal/pdh` scales them to seconds. +- `% Processor Time` and `% Priority Time` are `PERF_100NSEC_TIMER_INV`. The + raw value is cumulative idle (non-busy) time in 100 ns ticks, not busy time, + and `internal/pdh` does not scale this type to seconds. In the sample, the + raw value of `% Processor Time` equals `% Idle Time`. +- `% Processor Utility`, `% Processor Performance` and `% Privileged Utility` + are `PERF_AVERAGE_BULK`. Raw and base are both cumulative. The displayed + value is delta raw / delta base and is already a percentage (it can exceed + 100). A 2 s sample on core `0,0` gave 63.4 for utility and 121.9 for + performance. The raw values of utility and performance are almost equal; + their bases differ. `% Processor Utility` and `% Privileged Utility` have + nearly equal bases that grew about 630 000 per second; the performance + base grew about 330 000 per second. +- `Interrupts/sec`, `DPCs Queued/sec` and `Clock Interrupts/sec` + (`PERF_COUNTER_COUNTER`) and `C1/C2/C3 Transitions/sec`, + `Idle Break Events/sec` (`PERF_COUNTER_BULK_COUNT`) are cumulative counts. +- `Processor Frequency` is a gauge in MHz (3700 here). `Parking Status` is a + gauge, 0 when the processor is not parked. `% Performance Limit` is a gauge + percentage (100 here). `% C3 Time` and `C3 Transitions/sec` stayed 0 on this + virtual machine. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `Processor Information` + +Multi-instance. Instances: `_Total`, `0,_Total`, `0,0`, `0,1`, `0,10`, `0,11`, `0,2`, `0,3`, ... (14 in total). Sample instance: `0,0`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `% C1 Time` | `PERF_100NSEC_TIMER` | 3366958649 | | +| `% C2 Time` | `PERF_100NSEC_TIMER` | 21091589064 | | +| `% C3 Time` | `PERF_100NSEC_TIMER` | 0 | | +| `% DPC Time` | `PERF_100NSEC_TIMER` | 185312500 | | +| `% Idle Time` | `PERF_100NSEC_TIMER` | 25109218750 | | +| `% Interrupt Time` | `PERF_100NSEC_TIMER` | 257812500 | | +| `% Performance Limit` | `PERF_COUNTER_RAWCOUNT` | 100 | | +| `% Priority Time` | `PERF_100NSEC_TIMER_INV` | 26964687500 | | +| `% Privileged Time` | `PERF_100NSEC_TIMER` | 4745937500 | | +| `% Privileged Utility` | `PERF_AVERAGE_BULK` | 35875675583 | 2142017948 | +| `% Processor Performance` | `PERF_AVERAGE_BULK` | 80044724120 | 669031135 | +| `% Processor Time` | `PERF_100NSEC_TIMER_INV` | 25109218750 | | +| `% Processor Utility` | `PERF_AVERAGE_BULK` | 80044725697 | 2142017679 | +| `% User Time` | `PERF_100NSEC_TIMER` | 4394687500 | | +| `C1 Transitions/sec` | `PERF_COUNTER_BULK_COUNT` | 2303708 | | +| `C2 Transitions/sec` | `PERF_COUNTER_BULK_COUNT` | 2337838 | | +| `C3 Transitions/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Clock Interrupts/sec` | `PERF_COUNTER_COUNTER` | 1571877 | | +| `DPCs Queued/sec` | `PERF_COUNTER_COUNTER` | 561134 | | +| `Idle Break Events/sec` | `PERF_COUNTER_BULK_COUNT` | 4641550 | | +| `Interrupts/sec` | `PERF_COUNTER_COUNTER` | 7795204 | | +| `Parking Status` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Processor Frequency` | `PERF_COUNTER_RAWCOUNT` | 3700 | | + +Not read by the collector: + +- `PERF_AVERAGE_BULK`: `Actual Frequency` +- `PERF_COUNTER_RAWCOUNT`: `% of Maximum Frequency`, `DPC Rate`, `Performance Limit Flags`, `Processor State Flags` +- `PERF_PRECISION_100NS_TIMER`: `Average Idle Time` diff --git a/internal/collector/dfsr/AGENTS.md b/internal/collector/dfsr/AGENTS.md new file mode 100644 index 00000000..5cf08998 --- /dev/null +++ b/internal/collector/dfsr/AGENTS.md @@ -0,0 +1,103 @@ +# `dfsr` collector + +The collector reads three PDH objects with `pdh.CounterTypeRaw`: +`DFS Replication Connections`, `DFS Replicated Folders` and +`DFS Replication Service Volumes`. They exist only where the DFS Replication +service runs, for example on every domain controller (SYSVOL). CI does not +provision DFSR. These notes were recorded on a single Windows Server 2025 DC. + +- Every counter of the three objects is `PERF_COUNTER_LARGE_RAWCOUNT` + (`NumberOfItems64`). The type does not say whether the value is cumulative, + so go by the counter help text: + - Cumulative since service start: the `... Generated`, `... Cleaned up`, + `... Received`, `File Installs ...`, `Updates Dropped`, `Database Commits`, + `Database Lookups` and `USN Journal Records Read/Accepted` counters. + - Gauges: `Staging/Conflict/Deleted Space In Use` (bytes), + `USN Journal Unread Percentage`, connection `Bytes Received Per Second`, + and `Bandwidth Savings Using DFS Replication`, which is a percentage + ("a value of 20 indicates ... 20% less bandwidth"), not bytes. +- Instances: folders are `-{}`, for example + `SYSVOL Share-{DD658FCA-D7AE-487D-8E75-67481CEBE108}`; volumes are drive + letters (`C:`). A DC without replication partner has no instance of + `DFS Replication Connections`, so connection metrics are not exercised there. +- Sample from the DC (volume `C:`): `USN Journal Records Read` 1932712, + `Database Commits` 800998, `Database Lookups` 1058283, + `USN Journal Records Accepted` 0, `USN Journal Unread Percentage` 0. All + folder counters of SYSVOL were 0. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `DFS Replicated Folders` + +Multi-instance. Instances: `SYSVOL Share-{DD658FCA-D7AE-487D-8E75-67481CEBE108}`. Sample instance: `SYSVOL Share-{DD658FCA-D7AE-487D-8E75-67481CEBE108}`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Bandwidth Savings Using DFS Replication` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Compressed Size of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Conflict Bytes Cleaned up` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Conflict Bytes Generated` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Conflict Files Cleaned up` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Conflict Files Generated` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Conflict Folder Cleanups Completed` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Conflict Space In Use` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Deleted Bytes Cleaned up` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Deleted Bytes Generated` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Deleted Files Cleaned up` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Deleted Files Generated` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Deleted Space In Use` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `File Installs Retried` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `File Installs Succeeded` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `RDC Bytes Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `RDC Compressed Size of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `RDC Number of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `RDC Size of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Size of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Staging Bytes Cleaned up` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Staging Bytes Generated` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Staging Files Cleaned up` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Staging Files Generated` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Staging Space In Use` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Total Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Updates Dropped` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | + +### `DFS Replication Connections` + +Multi-instance. No instances on the recording host, so the table has types only. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Bandwidth Savings Using DFS Replication` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `Compressed Size of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `RDC Bytes Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `RDC Compressed Size of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `RDC Number of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `RDC Size of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `Size of Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `Total Bytes Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `Total Files Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | + +Not read by the collector: + +- `PERF_COUNTER_LARGE_RAWCOUNT`: `Bytes Received Per Second` + +### `DFS Replication Service Volumes` + +Multi-instance. Instances: `C:`. Sample instance: `C:`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Database Commits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 802516 | | +| `Database Lookups` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1060537 | | +| `USN Journal Records Accepted` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `USN Journal Records Read` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1936015 | | +| `USN Journal Unread Percentage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | diff --git a/internal/collector/dhcp/AGENTS.md b/internal/collector/dhcp/AGENTS.md new file mode 100644 index 00000000..66dc622d --- /dev/null +++ b/internal/collector/dhcp/AGENTS.md @@ -0,0 +1,64 @@ +# `dhcp` collector + +The server metrics come from the single-instance PDH object `DHCP Server`, +read with `pdh.CounterTypeRaw`. It exists only where the DHCP Server role is +installed. These notes were recorded on Windows Server 2025 (build 26100) +with a DHCP server that served no clients. + +- Every `.../sec` counter is `PERF_COUNTER_COUNTER`. Its raw value is a + cumulative count since the DHCP service started; publish it as a counter. +- `PERF_COUNTER_RAWCOUNT` counters, by help text: + - Gauges: `Active Queue Length`, `Conflict Check Queue Length`, + `Offer Queue Length` (packets in a queue) and + `Failover: BndUpd pending in outbound queue.` + - Cumulative: `Denied due to match.`, `Denied due to nonmatch.`, + `Failover: BndUpd Dropped.` and the three + `Failover: Transitions to ... state.` counters. + - `Milliseconds per packet (Avg).` (not read) is an average in + milliseconds, not paired with a base. +- Many counter names end in a period, and some failover names in `/sec.`. + The `perfdata` tags must keep it. +- Only `Packets Received/sec` was nonzero on the recording host. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `DHCP Server` + +Single-instance. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Acks/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Active Queue Length` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Conflict Check Queue Length` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Declines/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Denied due to match.` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Denied due to nonmatch.` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Discovers/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Duplicates Dropped/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Failover: BndAck received/sec.` | `PERF_COUNTER_COUNTER` | 0 | | +| `Failover: BndAck sent/sec.` | `PERF_COUNTER_COUNTER` | 0 | | +| `Failover: BndUpd Dropped.` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Failover: BndUpd pending in outbound queue.` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Failover: BndUpd received/sec.` | `PERF_COUNTER_COUNTER` | 0 | | +| `Failover: BndUpd sent/sec.` | `PERF_COUNTER_COUNTER` | 0 | | +| `Failover: Transitions to COMMUNICATION-INTERRUPTED state.` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Failover: Transitions to PARTNER-DOWN state.` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Failover: Transitions to RECOVER state.` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Informs/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Nacks/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Offer Queue Length` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Offers/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Packets Expired/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Packets Received/sec` | `PERF_COUNTER_COUNTER` | 59 | | +| `Releases/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | | + +Not read by the collector: + +- `PERF_COUNTER_RAWCOUNT`: `Milliseconds per packet (Avg).` diff --git a/internal/collector/dns/AGENTS.md b/internal/collector/dns/AGENTS.md new file mode 100644 index 00000000..3705eae2 --- /dev/null +++ b/internal/collector/dns/AGENTS.md @@ -0,0 +1,131 @@ +# `dns` collector + +The collector reads the single-instance PDH object `DNS` with +`pdh.CounterTypeRaw`, plus the `MicrosoftDNS_Statistic` class +(`Error Stats` collection) through MI. Both exist only where the DNS Server +role is installed. These notes were recorded on Windows Server 2025 +(build 26100) on a domain controller that hosts AD-integrated zones and has no +secondary server, so zone transfer counters stayed 0. + +- The type does not tell the kind. Every `X` counter that has an `X/sec` twin + is `PERF_COUNTER_RAWCOUNT` and cumulative, and the twin + (`PERF_COUNTER_COUNTER`) has the same raw value (`Total Query Received` 830 + = `Total Query Received/sec` 830, `Dynamic Update Received` 165 = its + `/sec` twin). The help text calls the plain counters "the total number of". +- `WINS Reverse Lookup Received/sec` is `PERF_COUNTER_RAWCOUNT` despite its + name. +- Gauges: the `... Memory` counters ("total ... memory used by DNS server") + and `Total Remote Inflight Queries`. The help text gives no unit for the + memory counters. +- `Total Query Received` equals `UDP Query Received` + `TCP Query Received` + (830 = 820 + 10); `Total Response Sent` likewise (825 = 815 + 10). +- `Recursive Send TimeOuts` and `Recursive TimeOut/sec` are a twin pair with + different names; the collector reads the `/sec` one. +- Eleven counters of the object have names that belong to other objects and + no help text: `% User Time`, `Async Fast Reads/sec`, + `Fast Read Not Possibles/sec`, `Fast Read Resource Misses/sec`, + `Lazy Write Flushes/sec`, `Lazy Write Pages/sec`, `Data Flushes/sec`, + `Data Flush Pages/sec`, `Level 2 TLB Fills/sec`, `Enumerations Server/sec` + and `Virtual Bytes`. `Get-Counter -ListSet DNS` also lists a counter named + `176`. All of them stayed 0; the collector ignores them (`_` fields). + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `DNS` + +Single-instance. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `% User Time` | `PERF_COUNTER_COUNTER` | 0 | | +| `Async Fast Reads/sec` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `AXFR Request Received` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `AXFR Request Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `AXFR Response Received` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `AXFR Success Received` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `AXFR Success Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Caching Memory` | `PERF_COUNTER_RAWCOUNT` | 14216 | | +| `Data Flush Pages/sec` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Data Flushes/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Database Node Memory` | `PERF_COUNTER_RAWCOUNT` | 21958 | | +| `Dynamic Update NoOperation` | `PERF_COUNTER_RAWCOUNT` | 118 | | +| `Dynamic Update NoOperation/sec` | `PERF_COUNTER_COUNTER` | 118 | | +| `Dynamic Update Queued` | `PERF_COUNTER_RAWCOUNT` | 110 | | +| `Dynamic Update Received` | `PERF_COUNTER_RAWCOUNT` | 165 | | +| `Dynamic Update Received/sec` | `PERF_COUNTER_COUNTER` | 165 | | +| `Dynamic Update Rejected` | `PERF_COUNTER_RAWCOUNT` | 34 | | +| `Dynamic Update TimeOuts` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Dynamic Update Written to Database` | `PERF_COUNTER_RAWCOUNT` | 21 | | +| `Dynamic Update Written to Database/sec` | `PERF_COUNTER_COUNTER` | 21 | | +| `Enumerations Server/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Fast Read Not Possibles/sec` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Fast Read Resource Misses/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `IXFR Request Received` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `IXFR Request Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `IXFR Response Received` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `IXFR Success Received` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `IXFR Success Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `IXFR TCP Success Received` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `IXFR UDP Success Received` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Lazy Write Flushes/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Lazy Write Pages/sec` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Level 2 TLB Fills/sec` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Nbstat Memory` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Notify Received` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Notify Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Query Dropped Bad Socket` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Query Dropped Bad Socket/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Query Dropped By Policy` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Query Dropped By Policy/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Query Dropped By Response Rate Limiting` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Query Dropped By Response Rate Limiting/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Query Dropped Send` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Query Dropped Send/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Query Dropped Total` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Query Dropped Total/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Record Flow Memory` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Recursive Queries` | `PERF_COUNTER_RAWCOUNT` | 85 | | +| `Recursive Queries/sec` | `PERF_COUNTER_COUNTER` | 85 | | +| `Recursive Query Failure` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Recursive Query Failure/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Recursive Send TimeOuts` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Recursive TimeOut/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Responses Suppressed` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Responses Suppressed/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Secure Update Failure` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Secure Update Received` | `PERF_COUNTER_RAWCOUNT` | 8 | | +| `Secure Update Received/sec` | `PERF_COUNTER_COUNTER` | 8 | | +| `TCP Message Memory` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `TCP Query Received` | `PERF_COUNTER_RAWCOUNT` | 10 | | +| `TCP Query Received/sec` | `PERF_COUNTER_COUNTER` | 10 | | +| `TCP Response Sent` | `PERF_COUNTER_RAWCOUNT` | 10 | | +| `TCP Response Sent/sec` | `PERF_COUNTER_COUNTER` | 10 | | +| `Total Query Received` | `PERF_COUNTER_RAWCOUNT` | 830 | | +| `Total Query Received/sec` | `PERF_COUNTER_COUNTER` | 830 | | +| `Total Remote Inflight Queries` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Response Sent` | `PERF_COUNTER_RAWCOUNT` | 825 | | +| `Total Response Sent/sec` | `PERF_COUNTER_COUNTER` | 825 | | +| `UDP Message Memory` | `PERF_COUNTER_RAWCOUNT` | 447529584 | | +| `UDP Query Received` | `PERF_COUNTER_RAWCOUNT` | 820 | | +| `UDP Query Received/sec` | `PERF_COUNTER_COUNTER` | 820 | | +| `UDP Response Sent` | `PERF_COUNTER_RAWCOUNT` | 815 | | +| `UDP Response Sent/sec` | `PERF_COUNTER_COUNTER` | 815 | | +| `Unmatched Responses Received` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Virtual Bytes` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `WINS Lookup Received` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `WINS Lookup Received/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `WINS Response Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `WINS Response Sent/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `WINS Reverse Lookup Received` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `WINS Reverse Lookup Received/sec` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `WINS Reverse Response Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `WINS Reverse Response Sent/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Zone Transfer Failure` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Zone Transfer Request Received` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Zone Transfer SOA Request Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Zone Transfer Success` | `PERF_COUNTER_RAWCOUNT` | 0 | | diff --git a/internal/collector/gpu/AGENTS.md b/internal/collector/gpu/AGENTS.md new file mode 100644 index 00000000..953e41e2 --- /dev/null +++ b/internal/collector/gpu/AGENTS.md @@ -0,0 +1,110 @@ +# `gpu` collector + +The collector reads five PDH objects with `pdh.CounterTypeRaw`: +`GPU Engine`, `GPU Adapter Memory`, `GPU Local Adapter Memory`, +`GPU Non Local Adapter Memory` and `GPU Process Memory`. WDDM (dxgkrnl) +provides them, so they exist on any host with a WDDM display driver, including +the Microsoft Basic Render Driver on VMs without a GPU. These notes were +recorded on a Windows 11 workstation with an NVIDIA GeForce GTX 1070 +(driver 32.0.15.8266). + +- All counters the collector reads are `PERF_COUNTER_LARGE_RAWCOUNT` + (`NumberOfItems64`), so the raw value is the value: + - `Running Time` is cumulative engine busy time in 100 ns units. The + collector divides it by 10,000,000 for `engine_time_seconds`. + - The memory counters are gauges in bytes. +- `Utilization Percentage` is `PERF_100NSEC_TIMER` and has the same raw value + as `Running Time`; Task Manager derives the percentage from two samples. + The collector exports the counter instead, so `rate()` of + `engine_time_seconds` gives the utilization. +- Instance names encode the labels, see `parseGPUCounterInstanceString`: + - Engine: `pid__luid_0x_0x_phys__eng__engtype_`. + Types seen: `3D`, `Copy`, `LegacyOverlay`, `Security`, `VideoDecode`, + `VideoEncode`, `VR`. Other vendors append an index (`Compute_0`), which is + why `engtype` keeps everything after the key. + - Adapter memory: `luid_..._phys_`. Local and non local adapter memory + may append `_part_`, but not consistently: on the recording host the + NVIDIA adapter had a local instance without `part` and a non local + instance with `part_0`, while the second adapter had only a local + instance with `part_0`. + - Process memory: `pid__luid_..._phys_`. +- The recording host had two LUIDs: `0x00000000_0x0001120B` (the GTX 1070, + 9 engines per process) and `0x00000000_0x0001241E`, which has no PnP display + device and 25 engines, all `3D`. The second one is presumably the Microsoft + Basic Render Driver (inferred, not verified). +- Engine instances are per process and engine: 510 instances across 40 + processes on an ordinary desktop, 48 process memory instances. Every + process that opens a D3D device gets a full set of engine instances, so the + engine metric has high cardinality. + +## Counter reference + +Recorded on Windows 11 Pro (build 26300). `Raw` and `Base` are the first and +second values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `GPU Engine` + +Multi-instance. 510 instances. Sample instance: +`pid_1064_luid_0x00000000_0x0001120B_phys_0_eng_0_engtype_3D` (`dwm`). + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Running Time` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1660393259 | | + +Not read by the collector: + +- `PERF_100NSEC_TIMER`: `Utilization Percentage` + +### `GPU Adapter Memory` + +Multi-instance. Instances: `luid_0x00000000_0x0001120B_phys_0`, +`luid_0x00000000_0x0001241E_phys_0`. Sample instance: +`luid_0x00000000_0x0001120B_phys_0`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Dedicated Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1641607168 | | +| `Shared Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 87773184 | | +| `Total Committed` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1962553344 | | + +### `GPU Local Adapter Memory` + +Multi-instance. Instances: `luid_0x00000000_0x0001120B_phys_0`, +`luid_0x00000000_0x0001241E_phys_0_part_0`. Sample instance: +`luid_0x00000000_0x0001120B_phys_0`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Local Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 903745536 | | + +### `GPU Non Local Adapter Memory` + +Multi-instance. Instances: `luid_0x00000000_0x0001120B_phys_0_part_0`. +Sample instance: `luid_0x00000000_0x0001120B_phys_0_part_0`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Non Local Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 87773184 | | + +### `GPU Process Memory` + +Multi-instance. 48 instances. Sample instance: +`pid_1064_luid_0x00000000_0x0001120B_phys_0` (`dwm`). + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Dedicated Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1126207488 | | +| `Local Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 314675200 | | +| `Non Local Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 4931584 | | +| `Shared Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 4931584 | | +| `Total Committed` | `PERF_COUNTER_LARGE_RAWCOUNT` | 717426688 | | diff --git a/internal/collector/hyperv/AGENTS.md b/internal/collector/hyperv/AGENTS.md new file mode 100644 index 00000000..1fcb83f2 --- /dev/null +++ b/internal/collector/hyperv/AGENTS.md @@ -0,0 +1,522 @@ +# `hyperv` collector + +The collector reads 16 `Hyper-V ...` PDH objects with `pdh.CounterTypeRaw` +from its sub-collectors, plus HCS, WMI and `virtdisk.dll` data. The objects +exist only where the Hyper-V role is installed; CI does not provision it. +Almost all objects are multi-instance; `Hyper-V Virtual Machine Health Summary` +is single-instance. These notes were recorded on Windows Server 2025 build +26100 with one running Generation 2 VM (`ubuntu`, 6 vCPUs, 2 GiB static +memory) on a host with 12 logical processors. + +- `pdh.InstancesAll` drops the `_Total` instance, so the processor objects + return `Hv LP 0`..`Hv LP 11`, `Root VP 0`..`Root VP 11` and + `ubuntu:Hv VP 0`..`ubuntu:Hv VP 5`. The host logical processor count is the + number of `Hv LP` instances (12 here). +- Hypervisor processor objects: every `%` counter and `CPU Wait Time Per + Dispatch` is `PERF_PRECISION_100NS_TIMER`. The raw value is cumulative time + in 100 ns ticks. On a logical processor `% Idle Time` + `% Total Run Time` + equals the time since boot (453 s after a 452.7 s uptime), and + `% Total Run Time` is about `% Guest Run Time` + `% Hypervisor Run Time`. + The help text of `CPU Wait Time Per Dispatch` and `I/O TLB Flush Cost` says + "average time (in nanoseconds)", but the raw value is cumulative 100 ns + ticks. +- `Hyper-V Hypervisor Root Partition` is read for the instance `Root` only. + All its non-`/sec` counters are `PERF_COUNTER_LARGE_RAWCOUNT`. Page counts + and sizes are gauges; by the help text `Skipped Timer Ticks` and + `Device Interrupt Throttle Events` count events. +- Dynamic Memory: memory counters are in MB (`Physical Memory` and + `Guest Visible Physical Memory` are 2048 for the 2 GiB VM). `Added Memory` + and `Removed Memory` are cumulative MB, `Memory Add/Remove Operations` are + cumulative counts. Pressure counters are percentages and exceed 100 + (145 here). The VM instance exists even with Dynamic Memory disabled. + Instances are VM names; VMs of the Host Compute Service (WSL 2) have an + empty instance name. +- `Hyper-V DataStore`: instances are ` ` with the kinds + `configuration file`, `runtime file`, `worker process configuration` and + `worker process runtime state`. Every counter is + `PERF_COUNTER_LARGE_RAWCOUNT` and the help text only repeats the name. The + `... count` counters are cumulative. The `... latency microseconds` + counters are not cumulative: `Commit operation latency microseconds` of the + configuration file dropped from 6659 to 5213 while `Commit operation count` + stayed 1. +- `Hyper-V VM Vid Partition`: pages are 4 KiB. The 2 GiB VM had 526336 + `Physical Pages Allocated`. +- `Hyper-V Virtual Storage Device`: instances are the disk path with `\` + replaced by `-` and `(...)` by `[...]`, for example + `C:-ProgramData-Microsoft-Windows-Virtual Hard Disks-ubuntu.vhdx`; a `\\?\` + prefix becomes `--?-` (the `.vmgs` guest state file). A DVD drive shows up + as `ISO`. Only running VMs have instances. + - `Latency`, `Lower Latency`, `Queue Length` and `Lower Queue Length` all + had the same raw value (56686): the sum of IO latencies in 100 ns ticks. + The base of `Latency` (10) equals the raw `Throughput` and + `Read Count` + `Write Count` (6 + 4). + - `Throughput` (`PERF_COUNTER_COUNTER`) counts IO transfers. + `Normalized Throughput` (`PERF_COUNTER_BULK_COUNT`) counts 8 KB IO + transfers by its help text. Both raw values are cumulative. + - `Read Count`, `Write Count` and `Error Count` are + `PERF_COUNTER_RAWCOUNT` but cumulative ("total number of ..."). +- `Hyper-V Virtual Switch` and `Hyper-V Virtual Network Adapter`: all + `/sec` counters are `PERF_COUNTER_BULK_COUNT`, so the raw value is a + cumulative count. `Bytes/sec` is `Bytes Received/sec` + `Bytes Sent/sec` + and `Packets/sec` is `Packets Received/sec` + `Packets Sent/sec` in the + samples. Switch instances are the switch names (`External`, `Internal`). + VM adapter instances are `__--`. Host side + instances look like `Internal_`, `Ethernet_`, + `DrPort _` and + `Microsoft Hyper-V Network Adapter__DEVICE_{}`. The collector uses + them unchanged as `adapter`. +- `Hyper-V Virtual Network Adapter Drop Reasons` has the same instances as + `Hyper-V Virtual Network Adapter`. Every counter is a cumulative + `PERF_COUNTER_LARGE_RAWCOUNT`; only `Outgoing NotReady` was non-zero (9). +- `Hyper-V Replica VM` exists but had no instance (no replication). + By the help text `Replication Latency` and `Average Replication Latency` + are in seconds, the size counters in bytes, and `Replication Count`, + `Network Bytes Sent/Recv` and `Resynchronized Bytes` are cumulative since + VMMS start. +- `Hyper-V Virtual SMB` and `Hyper-V Legacy Network Adapter` had no + instances (no SMB-backed VM storage, no legacy adapter). In Virtual SMB, + `Tree Connect Count` is `PERF_COUNTER_COUNTER` but its help text says + "the current number of Tree Connects". +- `Hyper-V Virtual Machine Health Summary` counts VMs: `Health Ok` was 1 for + the one VM. +- The `wmi_health`, `virtual_hard_disk` and host VM processor metrics do not + come from PDH, so the table below does not cover them. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `Hyper-V DataStore` + +Multi-instance. Instances: `2F713ADB-4A60-4959-8986-949D88D9D6AC configuration file`, `2F713ADB-4A60-4959-8986-949D88D9D6AC runtime file`, `2F713ADB-4A60-4959-8986-949D88D9D6AC worker process configuration`, `2F713ADB-4A60-4959-8986-949D88D9D6AC worker process runtime state`. Sample instance: `2F713ADB-4A60-4959-8986-949D88D9D6AC configuration file`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Cache update operation count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Cache update operation latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Commit byte count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 12210 | | +| `Commit byte latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Commit count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Commit operation count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1 | | +| `Commit operation latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 6659 | | +| `Compact operation count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Compact operation latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Current replay logSize` | `PERF_COUNTER_LARGE_RAWCOUNT` | 32768 | | +| `Data alignment` | `PERF_COUNTER_LARGE_RAWCOUNT` | 4096 | | +| `Data end` | `PERF_COUNTER_LARGE_RAWCOUNT` | 77824 | | +| `Disconnect count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `File data size in bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Fragmentation ratio` | `PERF_COUNTER_LARGE_RAWCOUNT` | 12 | | +| `Load file operation count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1 | | +| `Load file operation latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 4350 | | +| `Names size in bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 4500 | | +| `Number of available entries inside object tables` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Number of empty entries inside object tables` | `PERF_COUNTER_LARGE_RAWCOUNT` | 218 | | +| `Number of file objects` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Number of free bytes inside key tables` | `PERF_COUNTER_LARGE_RAWCOUNT` | 6974 | | +| `Number of key tables` | `PERF_COUNTER_LARGE_RAWCOUNT` | 8 | | +| `Number of keys` | `PERF_COUNTER_LARGE_RAWCOUNT` | 361 | | +| `Number of object tables` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1 | | +| `Query size operation count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 208 | | +| `Query size operation latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 3 | | +| `Read from file byte count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 51356 | | +| `Read from file byte latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 9 | | +| `Read from file count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 236 | | +| `Read from storage byte count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 18470 | | +| `Read from storage byte latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1 | | +| `Read from storage count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 490 | | +| `Reconnect latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Remove operation count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Remove operation latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Sector size` | `PERF_COUNTER_LARGE_RAWCOUNT` | 512 | | +| `Set operation count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 5 | | +| `Set operation latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 6 | | +| `Table data size in bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 21247 | | +| `Write to file byte count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 4234 | | +| `Write to file byte latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 12 | | +| `Write to file count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 8 | | +| `Write to storage byte count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 58 | | +| `Write to storage byte latency microseconds` | `PERF_COUNTER_LARGE_RAWCOUNT` | 6 | | +| `Write to storage count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 5 | | + +Not read by the collector: + +- `PERF_COUNTER_LARGE_RAWCOUNT`: `File lock acquire latency microseconds`, `File lock count`, `File lock release latency microseconds`, `Get operation count`, `Get operation latency microseconds`, `Storage lock acquire latency microseconds`, `Storage lock count`, `Storage lock release latency microseconds` + +### `Hyper-V Dynamic Memory Balancer` + +Multi-instance. Instances: `System Balancer`. Sample instance: `System Balancer`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Available Memory` | `PERF_COUNTER_RAWCOUNT` | 4240 | | +| `Available Memory For Balancing` | `PERF_COUNTER_RAWCOUNT` | 4240 | | +| `Average Pressure` | `PERF_COUNTER_RAWCOUNT` | 145 | | +| `System Current Pressure` | `PERF_COUNTER_RAWCOUNT` | 100 | | + +### `Hyper-V Dynamic Memory VM` + +Multi-instance. Instances: `ubuntu`. Sample instance: `ubuntu`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Added Memory` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Average Pressure` | `PERF_COUNTER_RAWCOUNT` | 146 | | +| `Current Pressure` | `PERF_COUNTER_RAWCOUNT` | 145 | | +| `Guest Available Memory` | `PERF_COUNTER_RAWCOUNT` | 1025 | | +| `Guest Visible Physical Memory` | `PERF_COUNTER_RAWCOUNT` | 2048 | | +| `Maximum Pressure` | `PERF_COUNTER_RAWCOUNT` | 149 | | +| `Memory Add Operations` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Memory Remove Operations` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Minimum Pressure` | `PERF_COUNTER_RAWCOUNT` | 143 | | +| `Physical Memory` | `PERF_COUNTER_RAWCOUNT` | 2048 | | +| `Removed Memory` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | + +Not read by the collector: + +- `PERF_COUNTER_RAWCOUNT`: `Smart Paging Working Set Size` + +### `Hyper-V Hypervisor Logical Processor` + +Multi-instance. Instances: `_Total`, `Hv LP 0`, `Hv LP 1`, `Hv LP 10`, `Hv LP 11`, `Hv LP 2`, `Hv LP 3`, `Hv LP 4`, ... (13 in total). Sample instance: `Hv LP 0`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `% Guest Run Time` | `PERF_PRECISION_100NS_TIMER` | 9270346767 | | +| `% Hypervisor Run Time` | `PERF_PRECISION_100NS_TIMER` | 1438355934 | | +| `% Idle Time` | `PERF_PRECISION_100NS_TIMER` | 23500462022 | | +| `% Total Run Time` | `PERF_PRECISION_100NS_TIMER` | 10708658352 | | +| `Context Switches/sec` | `PERF_COUNTER_BULK_COUNT` | 9299560 | | + +Not read by the collector: + +- `PERF_COUNTER_BULK_COUNT`: `C1 Transitions/sec`, `C2 Transitions/sec`, `C3 Transitions/sec`, `CPPC Request Context Switches/sec`, `Hardware Interrupts/sec`, `Hypervisor Branch Predictor Flushes/sec`, `Hypervisor Immediate L1 Data Cache Flushes/sec`, `Hypervisor L1 Data Cache Flushes/sec`, `Hypervisor Microarchitectural Buffer Flushes/sec`, `Inter-Processor Interrupts Sent/sec`, `Inter-Processor Interrupts/sec`, `Performance Monitoring Interrupts/sec`, `Posted Interrupt Notifications/sec`, `Scheduler Interrupts/sec`, `Timer Interrupts/sec`, `Total Interrupts/sec` +- `PERF_COUNTER_LARGE_RAWCOUNT`: `Monitor Transition Cost`, `Reserve Group Id`, `Root Vp Index`, `Running Priority`, `Scheduler Local Run List Size` +- `PERF_PRECISION_100NS_TIMER`: `% C1 Time`, `% C2 Time`, `% C3 Time` + +### `Hyper-V Hypervisor Root Partition` + +Multi-instance. Instances: `_Total`, `Root`. Sample instance: `Root`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `1G device pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `1G GPA pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 11 | | +| `2M device pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `2M GPA pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 2461 | | +| `4K device pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `4K GPA pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 51200 | | +| `Address Spaces` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Attached Devices` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Deposited Pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 29667 | | +| `Device DMA Errors` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Device Interrupt Errors` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Device Interrupt Mappings` | `PERF_COUNTER_LARGE_RAWCOUNT` | 2 | | +| `Device Interrupt Throttle Events` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `GPA Pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `GPA Space Modifications/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `I/O TLB Flush Cost` | `PERF_PRECISION_100NS_TIMER` | 0 | | +| `I/O TLB Flushes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Recommended Virtual TLB Size` | `PERF_COUNTER_LARGE_RAWCOUNT` | 64 | | +| `Skipped Timer Ticks` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Virtual TLB Flush Entires/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Virtual TLB Pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 64 | | + +Not read by the collector: + +- `PERF_COUNTER_BULK_COUNT`: `Nested TLB Trimmed Pages/sec`, `Pages Recombined/sec`, `Pages Shattered/sec` +- `PERF_COUNTER_LARGE_RAWCOUNT`: `Nested TLB Free List Size`, `Nested TLB Size`, `Recommended Nested TLB Size`, `Virtual Processors` +- `PERF_COUNTER_LARGE_RAWCOUNT_HEX`: `CPPC Requested Performance Level` + +### `Hyper-V Hypervisor Root Virtual Processor` + +Multi-instance. Instances: `_Total`, `Root VP 0`, `Root VP 1`, `Root VP 10`, `Root VP 11`, `Root VP 2`, `Root VP 3`, `Root VP 4`, ... (13 in total). Sample instance: `Root VP 0`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `% Guest Run Time` | `PERF_PRECISION_100NS_TIMER` | 9150616357 | | +| `% Hypervisor Run Time` | `PERF_PRECISION_100NS_TIMER` | 1260894784 | | +| `% Remote Run Time` | `PERF_PRECISION_100NS_TIMER` | 0 | | +| `% Total Run Time` | `PERF_PRECISION_100NS_TIMER` | 10411471300 | | +| `CPU Wait Time Per Dispatch` | `PERF_PRECISION_100NS_TIMER` | 290865977 | | + +Not read by the collector: + +- `PERF_COUNTER_BULK_COUNT`: `Address Domain Flushes/sec`, `Address Space Evictions/sec`, `Address Space Flushes/sec`, `Address Space Switches/sec`, `APIC EOI Accesses/sec`, `APIC IPIs Sent/sec`, `APIC MMIO Accesses/sec`, `APIC Self IPIs Sent/sec`, `APIC TPR Accesses/sec`, `Bus Lock Acquisitions/sec`, `Control Register Accesses Forwarded/sec`, `Control Register Accesses/sec`, `CPPC Request Context Switches/sec`, `CPU Group Hypercalls/sec`, `CPUID Instructions Forwarded/sec`, `CPUID Instructions/sec`, `Debug Register Accesses Forwarded/sec`, `Debug Register Accesses/sec`, `Deposit Hypercalls/sec`, `Device Domain Hypercalls/sec`, `Emulated Instructions Forwarded/sec`, `Emulated Instructions/sec`, `Event Log Hypercalls/sec`, `Extended Hypercall Intercept Messages/sec`, `Extended Hypercalls/sec`, `External Interrupts Forwarded/sec`, `External Interrupts/sec`, `Flush Physical Address List Hypercalls/sec`, `Flush Physical Address Space Hypercalls/sec`, `GIF Instruction Emulation Intercepts/sec`, `Global GVA Range Flushes/sec`, `Global I/O TLB Flushes/sec`, `GPA Space Hypercalls/sec`, `Guest Page Table Maps/sec`, `Hardware Interrupts/sec`, `HLT Instructions Forwarded/sec`, `HLT Instructions/sec`, `Hypercalls Forwarded/sec`, `Hypercalls/sec`, `InvEpt All Context Emulation Intercepts/sec`, `InvEpt Single Context Emulation Intercepts/sec`, `InvVpid All Context Emulation Intercepts/sec`, `InvVpid Single Address Emulation Intercepts/sec`, `InvVpid Single Context Emulation Intercepts/sec`, `IO Instructions Forwarded/sec`, `IO Instructions/sec`, `IO Intercept Messages/sec`, `IOMMU Hypercalls/sec`, `Large Page TLB Fills/sec`, `Local Flushed GVA Ranges/sec`, `Local I/O TLB Flushes/sec`, `Logical Processor Dispatches/sec`, `Logical Processor Hypercalls/sec`, `Logical Processor Migrations/sec`, `Long Spin Wait Hypercalls/sec`, `MBEC Nested Page Table Switches/sec`, `Memory Intercept Messages/sec`, `MSR Accesses Forwarded/sec`, `MSR Accesses/sec`, `MWAIT Instructions Forwarded/sec`, `MWAIT Instructions/sec`, `Nested Page Fault Intercepts/sec`, `Nested SLAT Hard Page Faults/sec`, `Nested SLAT Soft Page Faults/sec`, `Nested TLB Page Table Evictions/sec`, `Nested TLB Page Table Reclamations/sec`, `Nested VM Entries/sec`, `Other Hypercalls/sec`, `Other Intercepts Forwarded/sec`, `Other Intercepts/sec`, `Other Messages/sec`, `Other Reflected Guest Exceptions/sec`, `Page Fault Intercepts Forwarded/sec`, `Page Fault Intercepts/sec`, `Page Invalidations Forwarded/sec`, `Page Invalidations/sec`, `Page Scans/sec`, `Page Table Allocations/sec`, `Page Table Evictions/sec`, `Page Table Reclamations/sec`, `Page Table Resets/sec`, `Page Table Validations/sec`, `Page Table Write Intercepts/sec`, `Pending Interrupts Forwarded/sec`, `Pending Interrupts/sec`, `Performance Monitoring Interrupts/sec`, `Performance Monitoring IPT MSR Accesses/sec`, `Performance Monitoring LBR MSR Accesses/sec`, `Performance Monitoring vPMU MSR Accesses/sec`, `Posted Interrupt Notifications/sec`, `Posted Interrupt Scans/sec`, `RDPMC Instructions/sec`, `Reflected Guest Page Faults/sec`, `Small Page TLB Fills/sec`, `SVM Hypercalls/sec`, `Synthetic Interrupt Hypercalls/sec`, `Synthetic Interrupts/sec`, `Total Intercepts/sec`, `Total Messages/sec`, `Total Virtualization Instructions Emulated/sec`, `Virtual Interrupt Hypercalls/sec`, `Virtual Interrupts/sec`, `Virtual MMU Hypercalls/sec`, `Virtual Processor Hypercalls/sec`, `VMCLEAR Emulation Intercepts/sec`, `VMLOAD Emulation Intercepts/sec`, `VMPTRLD Emulation Intercepts/sec`, `VMPTRST Emulation Intercepts/sec`, `VMREAD Emulation Intercepts/sec`, `VMSAVE Emulation Intercepts/sec`, `VMWRITE Emulation Intercepts/sec`, `VMXOFF Emulation Intercepts/sec`, `VMXON Emulation Intercepts/sec`, `VSM Hypercalls/sec`, `VTL1 Dispatches/sec`, `VTL2 Dispatches/sec` +- `PERF_COUNTER_LARGE_RAWCOUNT`: `Scheduling Priority` +- `PERF_PRECISION_100NS_TIMER`: `% Guest-Relative Utilization`, `% Total Core Run Time`, `% VTL1 Run Time`, `% VTL2 Run Time`, `Control Register Accesses Cost`, `Control Register Accesses Forwarding Cost`, `CPU Contention Time Per Dispatch`, `CPU Wake Up Time Per Dispatch`, `CPUID Instructions Cost`, `CPUID Instructions Forwarding Cost`, `Debug Register Accesses Cost`, `Debug Register Accesses Forwarding Cost`, `Emulated Instructions Cost`, `Emulated Instructions Forwarding Cost`, `External Interrupts Cost`, `GIF Instruction Emulation Cost`, `Global I/O TLB Flush Cost`, `HLT Instructions Cost`, `HLT Instructions Forwarding Cost`, `Hypercalls Cost`, `Hypercalls Forwarding Cost`, `InvEpt All Context Instruction Emulation Cost`, `InvEpt Single Context Instruction Emulation Cost`, `InvVpid All Context Instruction Emulation Cost`, `InvVpid Single Address Instruction Emulation Cost`, `InvVpid Single Context Instruction Emulation Cost`, `IO Instructions Cost`, `IO Instructions Forwarding Cost`, `Local I/O TLB Flush Cost`, `MSR Accesses Cost`, `MSR Accesses Forwarding Cost`, `MWAIT Instructions Cost`, `MWAIT Instructions Forwarding Cost`, `Nested Page Fault Intercepts Cost`, `Nested SLAT Hard Page Faults Cost`, `Nested SLAT Soft Page Faults Cost`, `Nested VM Entries Cost`, `Other Intercepts Cost`, `Other Intercepts Forwarding Cost`, `Page Fault Intercepts Cost`, `Page Fault Intercepts Forwarding Cost`, `Page Invalidations Cost`, `Page Invalidations Forwarding Cost`, `Pending Interrupts Cost`, `Pending Interrupts Forwarding Cost`, `RDPMC Instructions Cost`, `Total Intercepts Cost`, `Total Virtualization Instructions Emulation Cost`, `VMCLEAR Instruction Emulation Cost`, `VMLOAD Instruction Emulation Cost`, `VMPTRLD Instruction Emulation Cost`, `VMPTRST Instruction Emulation Cost`, `VMREAD Instruction Emulation Cost`, `VMSAVE Instruction Emulation Cost`, `VMWRITE Instruction Emulation Cost`, `VMXOFF Instruction Emulation Cost`, `VMXON Instruction Emulation Cost`, `VTL1 Average Run Time`, `VTL2 Average Run Time` + +### `Hyper-V Hypervisor Virtual Processor` + +Multi-instance. Instances: `_Total`, `ubuntu:Hv VP 0`, `ubuntu:Hv VP 1`, `ubuntu:Hv VP 2`, `ubuntu:Hv VP 3`, `ubuntu:Hv VP 4`, `ubuntu:Hv VP 5`. Sample instance: `ubuntu:Hv VP 0`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `% Guest Run Time` | `PERF_PRECISION_100NS_TIMER` | 2198066669 | | +| `% Hypervisor Run Time` | `PERF_PRECISION_100NS_TIMER` | 982721208 | | +| `% Remote Run Time` | `PERF_PRECISION_100NS_TIMER` | 0 | | +| `% Total Run Time` | `PERF_PRECISION_100NS_TIMER` | 3180787877 | | +| `CPU Wait Time Per Dispatch` | `PERF_PRECISION_100NS_TIMER` | 1217187193 | | + +Not read by the collector: + +- `PERF_COUNTER_BULK_COUNT`: `Address Domain Flushes/sec`, `Address Space Evictions/sec`, `Address Space Flushes/sec`, `Address Space Switches/sec`, `APIC EOI Accesses/sec`, `APIC IPIs Sent/sec`, `APIC MMIO Accesses/sec`, `APIC Self IPIs Sent/sec`, `APIC TPR Accesses/sec`, `Bus Lock Acquisitions/sec`, `Control Register Accesses Forwarded/sec`, `Control Register Accesses/sec`, `CPPC Request Context Switches/sec`, `CPU Group Hypercalls/sec`, `CPUID Instructions Forwarded/sec`, `CPUID Instructions/sec`, `Debug Register Accesses Forwarded/sec`, `Debug Register Accesses/sec`, `Deposit Hypercalls/sec`, `Device Domain Hypercalls/sec`, `Emulated Instructions Forwarded/sec`, `Emulated Instructions/sec`, `Event Log Hypercalls/sec`, `Extended Hypercall Intercept Messages/sec`, `Extended Hypercalls/sec`, `External Interrupts Forwarded/sec`, `External Interrupts/sec`, `Flush Physical Address List Hypercalls/sec`, `Flush Physical Address Space Hypercalls/sec`, `GIF Instruction Emulation Intercepts/sec`, `Global GVA Range Flushes/sec`, `Global I/O TLB Flushes/sec`, `GPA Space Hypercalls/sec`, `Guest Page Table Maps/sec`, `Hardware Interrupts/sec`, `HLT Instructions Forwarded/sec`, `HLT Instructions/sec`, `Hypercalls Forwarded/sec`, `Hypercalls/sec`, `InvEpt All Context Emulation Intercepts/sec`, `InvEpt Single Context Emulation Intercepts/sec`, `InvVpid All Context Emulation Intercepts/sec`, `InvVpid Single Address Emulation Intercepts/sec`, `InvVpid Single Context Emulation Intercepts/sec`, `IO Instructions Forwarded/sec`, `IO Instructions/sec`, `IO Intercept Messages/sec`, `IOMMU Hypercalls/sec`, `Large Page TLB Fills/sec`, `Local Flushed GVA Ranges/sec`, `Local I/O TLB Flushes/sec`, `Logical Processor Dispatches/sec`, `Logical Processor Hypercalls/sec`, `Logical Processor Migrations/sec`, `Long Spin Wait Hypercalls/sec`, `MBEC Nested Page Table Switches/sec`, `Memory Intercept Messages/sec`, `MSR Accesses Forwarded/sec`, `MSR Accesses/sec`, `MWAIT Instructions Forwarded/sec`, `MWAIT Instructions/sec`, `Nested Page Fault Intercepts/sec`, `Nested SLAT Hard Page Faults/sec`, `Nested SLAT Soft Page Faults/sec`, `Nested TLB Page Table Evictions/sec`, `Nested TLB Page Table Reclamations/sec`, `Nested VM Entries/sec`, `Other Hypercalls/sec`, `Other Intercepts Forwarded/sec`, `Other Intercepts/sec`, `Other Messages/sec`, `Other Reflected Guest Exceptions/sec`, `Page Fault Intercepts Forwarded/sec`, `Page Fault Intercepts/sec`, `Page Invalidations Forwarded/sec`, `Page Invalidations/sec`, `Page Scans/sec`, `Page Table Allocations/sec`, `Page Table Evictions/sec`, `Page Table Reclamations/sec`, `Page Table Resets/sec`, `Page Table Validations/sec`, `Page Table Write Intercepts/sec`, `Pending Interrupts Forwarded/sec`, `Pending Interrupts/sec`, `Performance Monitoring Interrupts/sec`, `Performance Monitoring IPT MSR Accesses/sec`, `Performance Monitoring LBR MSR Accesses/sec`, `Performance Monitoring vPMU MSR Accesses/sec`, `Posted Interrupt Notifications/sec`, `Posted Interrupt Scans/sec`, `RDPMC Instructions/sec`, `Reflected Guest Page Faults/sec`, `Small Page TLB Fills/sec`, `SVM Hypercalls/sec`, `Synthetic Interrupt Hypercalls/sec`, `Synthetic Interrupts/sec`, `Total Intercepts/sec`, `Total Messages/sec`, `Total Virtualization Instructions Emulated/sec`, `Virtual Interrupt Hypercalls/sec`, `Virtual Interrupts/sec`, `Virtual MMU Hypercalls/sec`, `Virtual Processor Hypercalls/sec`, `VMCLEAR Emulation Intercepts/sec`, `VMLOAD Emulation Intercepts/sec`, `VMPTRLD Emulation Intercepts/sec`, `VMPTRST Emulation Intercepts/sec`, `VMREAD Emulation Intercepts/sec`, `VMSAVE Emulation Intercepts/sec`, `VMWRITE Emulation Intercepts/sec`, `VMXOFF Emulation Intercepts/sec`, `VMXON Emulation Intercepts/sec`, `VSM Hypercalls/sec`, `VTL1 Dispatches/sec`, `VTL2 Dispatches/sec` +- `PERF_COUNTER_LARGE_RAWCOUNT`: `Scheduling Priority` +- `PERF_PRECISION_100NS_TIMER`: `% Guest-Relative Utilization`, `% Total Core Run Time`, `% VTL1 Run Time`, `% VTL2 Run Time`, `Control Register Accesses Cost`, `Control Register Accesses Forwarding Cost`, `CPU Contention Time Per Dispatch`, `CPU Wake Up Time Per Dispatch`, `CPUID Instructions Cost`, `CPUID Instructions Forwarding Cost`, `Debug Register Accesses Cost`, `Debug Register Accesses Forwarding Cost`, `Emulated Instructions Cost`, `Emulated Instructions Forwarding Cost`, `External Interrupts Cost`, `GIF Instruction Emulation Cost`, `Global I/O TLB Flush Cost`, `HLT Instructions Cost`, `HLT Instructions Forwarding Cost`, `Hypercalls Cost`, `Hypercalls Forwarding Cost`, `InvEpt All Context Instruction Emulation Cost`, `InvEpt Single Context Instruction Emulation Cost`, `InvVpid All Context Instruction Emulation Cost`, `InvVpid Single Address Instruction Emulation Cost`, `InvVpid Single Context Instruction Emulation Cost`, `IO Instructions Cost`, `IO Instructions Forwarding Cost`, `Local I/O TLB Flush Cost`, `MSR Accesses Cost`, `MSR Accesses Forwarding Cost`, `MWAIT Instructions Cost`, `MWAIT Instructions Forwarding Cost`, `Nested Page Fault Intercepts Cost`, `Nested SLAT Hard Page Faults Cost`, `Nested SLAT Soft Page Faults Cost`, `Nested VM Entries Cost`, `Other Intercepts Cost`, `Other Intercepts Forwarding Cost`, `Page Fault Intercepts Cost`, `Page Fault Intercepts Forwarding Cost`, `Page Invalidations Cost`, `Page Invalidations Forwarding Cost`, `Pending Interrupts Cost`, `Pending Interrupts Forwarding Cost`, `RDPMC Instructions Cost`, `Total Intercepts Cost`, `Total Virtualization Instructions Emulation Cost`, `VMCLEAR Instruction Emulation Cost`, `VMLOAD Instruction Emulation Cost`, `VMPTRLD Instruction Emulation Cost`, `VMPTRST Instruction Emulation Cost`, `VMREAD Instruction Emulation Cost`, `VMSAVE Instruction Emulation Cost`, `VMWRITE Instruction Emulation Cost`, `VMXOFF Instruction Emulation Cost`, `VMXON Instruction Emulation Cost`, `VTL1 Average Run Time`, `VTL2 Average Run Time` + +### `Hyper-V Legacy Network Adapter` + +Multi-instance. No instances on the recording host, so the table has types only. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Bytes Dropped` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `Bytes Received/sec` | `PERF_COUNTER_BULK_COUNT` | | | +| `Bytes Sent/sec` | `PERF_COUNTER_BULK_COUNT` | | | +| `Frames Dropped` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `Frames Received/sec` | `PERF_COUNTER_BULK_COUNT` | | | +| `Frames Sent/sec` | `PERF_COUNTER_BULK_COUNT` | | | + +### `Hyper-V Replica VM` + +Multi-instance. No instances on the recording host, so the table has types only. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Average Replication Latency` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `Average Replication Size` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `Compression Efficiency` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `Last Replication Size` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `Network Bytes Recv` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `Network Bytes Sent` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `Replication Count` | `PERF_COUNTER_RAWCOUNT` | | | +| `Replication Latency` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `Resynchronized Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | + +### `Hyper-V Virtual Machine Health Summary` + +Single-instance. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Health Critical` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Health Ok` | `PERF_COUNTER_RAWCOUNT` | 1 | | + +### `Hyper-V Virtual Network Adapter` + +Multi-instance. Instances: `DrPort 700EF58F-56E7-4982-9DC4-4BCD5FC2C56F_B3548C76-D68D-4199-B45F-5C9DE21BD03C`, `Ethernet_700EF58F-56E7-4982-9DC4-4BCD5FC2C56E`, `Internal_FDECB3D5-AD64-4B6A-B96C-6AFD1616F33A`, `Microsoft Hyper-V Network Adapter__DEVICE_{9FE7CB58-7B03-4A3F-814F-9CD52BF15705}`, `ubuntu_Network Adapter_2F713ADB-4A60-4959-8986-949D88D9D6AC--F28DA7DA-095C-4544-B094-97085584E17D`. Sample instance: `DrPort 700EF58F-56E7-4982-9DC4-4BCD5FC2C56F_B3548C76-D68D-4199-B45F-5C9DE21BD03C`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Broadcast Packets Received/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Broadcast Packets Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 18 | | +| `Bytes Received/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Bytes Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 1708 | | +| `Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 1708 | | +| `Directed Packets Received/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Directed Packets Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Dropped Packets Incoming/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Dropped Packets Outgoing/sec` | `PERF_COUNTER_BULK_COUNT` | 21 | | +| `Extensions Dropped Packets Incoming/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Extensions Dropped Packets Outgoing/sec` | `PERF_COUNTER_BULK_COUNT` | 30 | | +| `Multicast Packets Received/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Multicast Packets Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 12 | | +| `Packets Received/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Packets Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 30 | | +| `Packets/sec` | `PERF_COUNTER_BULK_COUNT` | 30 | | + +Not read by the collector: + +- `PERF_COUNTER_BULK_COUNT`: `IPsec offload Bytes Receive/sec`, `IPsec offload Bytes Sent/sec`, `Packets Failed Software IP Rx CSO/sec`, `Packets Failed Software Rx CSO Parsing/sec`, `Packets Failed Software TCP Rx CSO/sec`, `Packets Failed Software UDP Rx CSO/sec`, `Packets Passed Software IP Rx CSO/sec`, `Packets Passed Software TCP Rx CSO/sec`, `Packets Passed Software UDP Rx CSO/sec`, `Packets With Software IP Tx CSO/sec`, `Packets With Software TCP Tx CSO/sec`, `Packets With Software UDP Tx CSO/sec` +- `PERF_COUNTER_LARGE_RAWCOUNT`: `Packets Failed Software IP Rx CSO`, `Packets Failed Software TCP Rx CSO`, `Packets Failed Software UDP Rx CSO`, `RSC Coalesce Events`, `RSC Coalesced Bytes`, `RSC Coalesced Event Bucket 1 (0To1)`, `RSC Coalesced Event Bucket 2 (2To3)`, `RSC Coalesced Event Bucket 3 (4To7)`, `RSC Coalesced Event Bucket 4 (8To15)`, `RSC Coalesced Event Bucket 5 (16To31)`, `RSC Coalesced Event Bucket 6 (32To63)`, `RSC Coalesced Packet Bucket 1 (0To1)`, `RSC Coalesced Packet Bucket 2 (2To3)`, `RSC Coalesced Packet Bucket 3 (4To7)`, `RSC Coalesced Packet Bucket 4 (8To15)`, `RSC Coalesced Packet Bucket 5 (16To31)`, `RSC Coalesced Packet Bucket 6 (32To63)`, `RSC Coalesced Packets`, `RSC Packets Processed` + +### `Hyper-V Virtual Network Adapter Drop Reasons` + +Multi-instance. Instances: `DrPort 700EF58F-56E7-4982-9DC4-4BCD5FC2C56F_B3548C76-D68D-4199-B45F-5C9DE21BD03C`, `Ethernet_700EF58F-56E7-4982-9DC4-4BCD5FC2C56E`, `Internal_FDECB3D5-AD64-4B6A-B96C-6AFD1616F33A`, `Microsoft Hyper-V Network Adapter__DEVICE_{9FE7CB58-7B03-4A3F-814F-9CD52BF15705}`, `ubuntu_Network Adapter_2F713ADB-4A60-4959-8986-949D88D9D6AC--F28DA7DA-095C-4544-B094-97085584E17D`. Sample instance: `DrPort 700EF58F-56E7-4982-9DC4-4BCD5FC2C56F_B3548C76-D68D-4199-B45F-5C9DE21BD03C`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Incoming BridgeReserved` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming Busy` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming DhcpGuard` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming Disconnected` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming FailedPvlanSetting` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming FailedSecurityPolicy` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming Filtered` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming FilteredVLAN` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming InvalidConfig` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming InvalidData` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming InvalidPacket` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming Ipsec` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming MacSpoofing` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming MTUMismatch` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming NativeFwdingReq` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming NotAccepted` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming NotReady` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming Qos` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming RequiredExtensionMissing` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming Resources` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming RouterGuard` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming UnauthorizedMAC` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming UnauthorizedVLAN` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming Unknown` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Incoming VirtualSubnetId` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing BridgeReserved` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing Busy` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing DhcpGuard` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing Disconnected` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing FailedPvlanSetting` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing FailedSecurityPolicy` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing Filtered` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing FilteredVLAN` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing InvalidConfig` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing InvalidData` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing InvalidPacket` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing Ipsec` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing MacSpoofing` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing MTUMismatch` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing NativeFwdingReq` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing NotAccepted` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing NotReady` | `PERF_COUNTER_LARGE_RAWCOUNT` | 9 | | +| `Outgoing Qos` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing RequiredExtensionMissing` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing Resources` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing RouterGuard` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing UnauthorizedMAC` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing UnauthorizedVLAN` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing Unknown` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Outgoing VirtualSubnetId` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | + +Not read by the collector: + +- `PERF_COUNTER_LARGE_RAWCOUNT`: `Incoming FailedDestinationListUpdate`, `Incoming FailedPacketFilter`, `Incoming FilteredIsolationUntagged`, `Incoming InjectedIcmp`, `Incoming InvalidDestMac`, `Incoming InvalidFirstNBTooSmall`, `Incoming InvalidPDQueue`, `Incoming InvalidSourceMac`, `Incoming InvalidVlanFormat`, `Incoming LowPowerPacketFilter`, `Incoming NicDisabled`, `Incoming StormLimit`, `Incoming SwitchDataFlowDisabled`, `Outgoing FailedDestinationListUpdate`, `Outgoing FailedPacketFilter`, `Outgoing FilteredIsolationUntagged`, `Outgoing InjectedIcmp`, `Outgoing InvalidDestMac`, `Outgoing InvalidFirstNBTooSmall`, `Outgoing InvalidPDQueue`, `Outgoing InvalidSourceMac`, `Outgoing InvalidVlanFormat`, `Outgoing LowPowerPacketFilter`, `Outgoing NicDisabled`, `Outgoing StormLimit`, `Outgoing SwitchDataFlowDisabled` + +### `Hyper-V Virtual SMB` + +Multi-instance. No instances on the recording host, so the table has types only. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Current Open File Count` | `PERF_COUNTER_RAWCOUNT` | | | +| `Current Pending Requests` | `PERF_COUNTER_RAWCOUNT` | | | +| `Direct-Mapped Pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `Direct-Mapped Sections` | `PERF_COUNTER_RAWCOUNT` | | | +| `Flush Requests/sec` | `PERF_COUNTER_COUNTER` | | | +| `Read Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | | | +| `Read Bytes/sec (RDMA)` | `PERF_COUNTER_BULK_COUNT` | | | +| `Read Requests/sec` | `PERF_COUNTER_COUNTER` | | | +| `Read Requests/sec (RDMA)` | `PERF_COUNTER_COUNTER` | | | +| `Received Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | | | +| `Requests/sec` | `PERF_COUNTER_COUNTER` | | | +| `Sent Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | | | +| `Tree Connect Count` | `PERF_COUNTER_COUNTER` | | | +| `Write Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | | | +| `Write Bytes/sec (RDMA)` | `PERF_COUNTER_BULK_COUNT` | | | +| `Write Requests/sec` | `PERF_COUNTER_COUNTER` | | | +| `Write Requests/sec (RDMA)` | `PERF_COUNTER_COUNTER` | | | + +Not read by the collector: + +- `PERF_AVERAGE_TIMER`: `Avg. sec/Request` + +### `Hyper-V Virtual Storage Device` + +Multi-instance. Instances: `--?-C:-ProgramData-Microsoft-Windows-Hyper-V-Virtual Machines-2F713ADB-4A60-4959-8986-949D88D9D6AC.vmgs`, `C:-ProgramData-Microsoft-Windows-Virtual Hard Disks-ubuntu.vhdx`, `ISO`. Sample instance: `--?-C:-ProgramData-Microsoft-Windows-Hyper-V-Virtual Machines-2F713ADB-4A60-4959-8986-949D88D9D6AC.vmgs`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Error Count` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Io Quota Replenishment Rate` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Latency` | `PERF_AVERAGE_TIMER` | 56686 | 10 | +| `Lower Latency` | `PERF_AVERAGE_TIMER` | 56686 | 10 | +| `Lower Queue Length` | `PERF_COUNTER_LARGE_QUEUELEN_TYPE` | 56686 | | +| `Normalized Throughput` | `PERF_COUNTER_BULK_COUNT` | 95 | | +| `Queue Length` | `PERF_COUNTER_LARGE_QUEUELEN_TYPE` | 56686 | | +| `Read Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 252416 | | +| `Read Count` | `PERF_COUNTER_RAWCOUNT` | 6 | | +| `Throughput` | `PERF_COUNTER_COUNTER` | 10 | | +| `Write Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 468992 | | +| `Write Count` | `PERF_COUNTER_RAWCOUNT` | 4 | | + +Not read by the collector: + +- `PERF_COUNTER_BULK_COUNT`: `Byte Quota Replenishment Rate` +- `PERF_COUNTER_COUNTER`: `Read Operations/Sec`, `Write Operations/Sec` +- `PERF_COUNTER_LARGE_RAWCOUNT`: `Maximum Bandwidth`, `Maximum IO Rate`, `Minimum IO Rate` +- `PERF_COUNTER_RAWCOUNT`: `Adapter Open Channel Count`, `Flush Count`, `Maximum Adapter Worker Count` + +### `Hyper-V Virtual Switch` + +Multi-instance. Instances: `External`, `Internal`. Sample instance: `External`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Broadcast Packets Received/sec` | `PERF_COUNTER_BULK_COUNT` | 208 | | +| `Broadcast Packets Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 190 | | +| `Bytes Received/sec` | `PERF_COUNTER_BULK_COUNT` | 6209983540 | | +| `Bytes Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 6209976573 | | +| `Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 12419960113 | | +| `Directed Packets Received/sec` | `PERF_COUNTER_BULK_COUNT` | 1035024 | | +| `Directed Packets Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 1035024 | | +| `Dropped Packets Incoming/sec` | `PERF_COUNTER_BULK_COUNT` | 23 | | +| `Dropped Packets Outgoing/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Extensions Dropped Packets Incoming/sec` | `PERF_COUNTER_BULK_COUNT` | 96 | | +| `Extensions Dropped Packets Outgoing/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Learned Mac Addresses` | `PERF_COUNTER_LARGE_RAWCOUNT` | 3 | | +| `Multicast Packets Received/sec` | `PERF_COUNTER_BULK_COUNT` | 438 | | +| `Multicast Packets Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 360 | | +| `Number of Send Channel Moves/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Number of VMQ Moves/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Packets Flooded` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Packets Received/sec` | `PERF_COUNTER_BULK_COUNT` | 1035670 | | +| `Packets Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 1035574 | | +| `Packets/sec` | `PERF_COUNTER_BULK_COUNT` | 2071244 | | +| `Purged Mac Addresses` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | + +Not read by the collector: + +- `PERF_COUNTER_BULK_COUNT`: `Learned Mac Addresses/sec`, `Packets Flooded/sec`, `Purged Mac Addresses/sec` +- `PERF_COUNTER_LARGE_RAWCOUNT`: `RSC Coalesce Events`, `RSC Coalesced Bytes`, `RSC Coalesced Event Bucket 1 (0To1)`, `RSC Coalesced Event Bucket 2 (2To3)`, `RSC Coalesced Event Bucket 3 (4To7)`, `RSC Coalesced Event Bucket 4 (8To15)`, `RSC Coalesced Event Bucket 5 (16To31)`, `RSC Coalesced Event Bucket 6 (32To63)`, `RSC Coalesced Packet Bucket 1 (0To1)`, `RSC Coalesced Packet Bucket 2 (2To3)`, `RSC Coalesced Packet Bucket 3 (4To7)`, `RSC Coalesced Packet Bucket 4 (8To15)`, `RSC Coalesced Packet Bucket 5 (16To31)`, `RSC Coalesced Packet Bucket 6 (32To63)`, `RSC Coalesced Packets`, `RSC Packets Processed` + +### `Hyper-V VM Vid Partition` + +Multi-instance. Instances: `_Total`, `ubuntu`. Sample instance: `ubuntu`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Physical Pages Allocated` | `PERF_COUNTER_LARGE_RAWCOUNT` | 526336 | | +| `Preferred NUMA Node Index` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Remote Physical Pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | diff --git a/internal/collector/iis/AGENTS.md b/internal/collector/iis/AGENTS.md index c2f28286..b663bdf1 100644 --- a/internal/collector/iis/AGENTS.md +++ b/internal/collector/iis/AGENTS.md @@ -25,3 +25,254 @@ - To find which Windows call a collector blocks in, capture a Go execution trace with `--debug.enabled` and `/debug/pprof/trace?seconds=600`. Collectors waiting in a Windows call use no CPU, so a CPU profile does not show it. + +## PDH objects and raw values + +The collector reads five PDH objects with `pdh.CounterTypeRaw`: `Web Service`, +`Web Service Cache` (single instance), `APP_POOL_WAS`, `W3SVC_W3WP` and +`HTTP Service Request Queues`. They need the IIS role (W3SVC and WAS). These +notes were recorded on Windows Server 2025 (build 26100) with only +`Default Web Site` and `DefaultAppPool`. + +- Almost every counter is `PERF_COUNTER_RAWCOUNT` or + `PERF_COUNTER_LARGE_RAWCOUNT`. The help text decides the kind: + - Cumulative "since service startup": every `Total ...` counter of + `Web Service`, the `... Hits`, `... Misses`, `... Flushes` and `Total ...` + counters of `Web Service Cache` and `W3SVC_W3WP`, and + `Total HTTP Requests Served`. + - Gauges: every `Current ...` counter, `Active Requests`, + `Active Threads Count`, `WebSocket Active Requests`, + `Active Flushed Entries`, `Output Cache Current ...` and `Total Threads` + (threads available in the worker process, 12 here). + - `Maximum Threads Count` is the thread pool limit (256 here), not a peak. + `Maximum File Cache Memory Usage` is the peak of + `Current File Cache Memory Usage`. +- Units: `... Memory Usage` and `Total Bytes ...` are bytes. `Service Uptime` + is seconds (334 about 5 minutes after boot). +- The `X/sec` twins are not read. Their raw value equals the `Total X` + counter (`Get Requests/sec` = `Total Get Requests`, + `Bytes Sent/sec` = `Total Bytes Sent`, `Requests / Sec` = + `Total HTTP Requests Served`). +- `% 401/403/404/500 HTTP Response Sent` of `W3SVC_W3WP` are + `PERF_SAMPLE_FRACTION`. Raw is the cumulative count of that status, base is + the cumulative request count (after one 200 and one 404 request: 404 raw 1, + base 2). +- `APP_POOL_WAS` uptimes and `Time Since Last Worker Process Failure` are + `PERF_ELAPSED_TIME`. Raw is the start time as a FILETIME (100 ns since 1601), + the second value is the current time, and `internal/pdh` returns the elapsed + seconds (298 about 5 minutes after boot). Without any failure, + `Time Since Last Worker Process Failure` equals the pool uptime. + `Current Application Pool State` is an enum (1 to 7, 3 = Running). +- `HTTP Service Request Queues`: `ArrivalRate` is `PERF_COUNTER_BULK_COUNT`, a + cumulative count of arrived requests. `RejectedRequests` is cumulative + ("Total number of requests rejected"). `MaxQueueItemAge` is + `PERF_ELAPSED_TIME`; on an empty queue the raw value is `math.MaxInt64`, PDH + formats it as 0, and the raw calculation gives a large negative number. +- Instances: `Web Service` and `APP_POOL_WAS` have a `_Total` instance, which + the collector exports like a site or pool named `_Total`. `W3SVC_W3WP` + instances are `_` (`10932_DefaultAppPool`) plus `_Total`, and + exist only while a worker process runs; send one HTTP request to start one. + `HTTP Service Request Queues` instances are app pool names plus about 40 + `---` queues, which the collector skips. Recycled instances get a `#` + suffix that the collector strips. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `APP_POOL_WAS` + +Multi-instance. Instances: `_Total`, `DefaultAppPool`. Sample instance: `DefaultAppPool`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Current Application Pool State` | `PERF_COUNTER_RAWCOUNT` | 3 | | +| `Current Application Pool Uptime` | `PERF_ELAPSED_TIME` | 134365471332535000 | | +| `Current Worker Processes` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Maximum Worker Processes` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Recent Worker Process Failures` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Time Since Last Worker Process Failure` | `PERF_ELAPSED_TIME` | 134365471332535000 | | +| `Total Application Pool Recycles` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Application Pool Uptime` | `PERF_ELAPSED_TIME` | 134365471332535000 | | +| `Total Worker Process Failures` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Worker Process Ping Failures` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Worker Process Shutdown Failures` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Worker Process Startup Failures` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Worker Processes Created` | `PERF_COUNTER_RAWCOUNT` | 0 | | + +### `HTTP Service Request Queues` + +Multi-instance. Instances: `---1`, `---10`, `---11`, `---12`, `---13`, `---14`, `---15`, `---16`, ... (40 in total). Sample instance: `---1`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `ArrivalRate` | `PERF_COUNTER_BULK_COUNT` | 67 | | +| `CurrentQueueSize` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `MaxQueueItemAge` | `PERF_ELAPSED_TIME` | 9223372036854780000 | | +| `RejectedRequests` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | + +Not read by the collector: + +- `PERF_COUNTER_BULK_COUNT`: `CacheHitRate`, `RejectionRate` +- `PERF_COUNTER_RAWCOUNT`: `PendingReceiveRequests` + +### `W3SVC_W3WP` + +Multi-instance. No instances on the recording host, so the table has types only. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `% 401 HTTP Response Sent` | `PERF_SAMPLE_FRACTION` | | | +| `% 403 HTTP Response Sent` | `PERF_SAMPLE_FRACTION` | | | +| `% 404 HTTP Response Sent` | `PERF_SAMPLE_FRACTION` | | | +| `% 500 HTTP Response Sent` | `PERF_SAMPLE_FRACTION` | | | +| `Active Flushed Entries` | `PERF_COUNTER_RAWCOUNT` | | | +| `Active Requests` | `PERF_COUNTER_RAWCOUNT` | | | +| `Active Threads Count` | `PERF_COUNTER_RAWCOUNT` | | | +| `Current File Cache Memory Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `Current Files Cached` | `PERF_COUNTER_RAWCOUNT` | | | +| `Current Metadata Cached` | `PERF_COUNTER_RAWCOUNT` | | | +| `Current URIs Cached` | `PERF_COUNTER_RAWCOUNT` | | | +| `File Cache Flushes` | `PERF_COUNTER_RAWCOUNT` | | | +| `File Cache Hits` | `PERF_COUNTER_RAWCOUNT` | | | +| `File Cache Misses` | `PERF_COUNTER_RAWCOUNT` | | | +| `Maximum File Cache Memory Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `Maximum Threads Count` | `PERF_COUNTER_RAWCOUNT` | | | +| `Metadata Cache Flushes` | `PERF_COUNTER_RAWCOUNT` | | | +| `Metadata Cache Hits` | `PERF_COUNTER_RAWCOUNT` | | | +| `Metadata Cache Misses` | `PERF_COUNTER_RAWCOUNT` | | | +| `Output Cache Current Flushed Items` | `PERF_COUNTER_RAWCOUNT` | | | +| `Output Cache Current Items` | `PERF_COUNTER_RAWCOUNT` | | | +| `Output Cache Current Memory Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | | | +| `Output Cache Total Flushed Items` | `PERF_COUNTER_RAWCOUNT` | | | +| `Output Cache Total Flushes` | `PERF_COUNTER_RAWCOUNT` | | | +| `Output Cache Total Hits` | `PERF_COUNTER_RAWCOUNT` | | | +| `Output Cache Total Misses` | `PERF_COUNTER_RAWCOUNT` | | | +| `Total Files Cached` | `PERF_COUNTER_RAWCOUNT` | | | +| `Total Flushed Files` | `PERF_COUNTER_RAWCOUNT` | | | +| `Total Flushed Metadata` | `PERF_COUNTER_RAWCOUNT` | | | +| `Total Flushed URIs` | `PERF_COUNTER_RAWCOUNT` | | | +| `Total HTTP Requests Served` | `PERF_COUNTER_RAWCOUNT` | | | +| `Total Metadata Cached` | `PERF_COUNTER_RAWCOUNT` | | | +| `Total URIs Cached` | `PERF_COUNTER_RAWCOUNT` | | | +| `URI Cache Flushes` | `PERF_COUNTER_RAWCOUNT` | | | +| `URI Cache Hits` | `PERF_COUNTER_RAWCOUNT` | | | +| `URI Cache Misses` | `PERF_COUNTER_RAWCOUNT` | | | +| `WebSocket Active Requests` | `PERF_COUNTER_RAWCOUNT` | | | +| `WebSocket Connection Attempts / Sec` | `PERF_COUNTER_COUNTER` | | | +| `WebSocket Connections Accepted / Sec` | `PERF_COUNTER_COUNTER` | | | +| `WebSocket Connections Rejected / Sec` | `PERF_COUNTER_COUNTER` | | | + +Not read by the collector: + +- `PERF_COUNTER_COUNTER`: `File Cache Hits / sec`, `File Cache Misses / sec`, `Metadata Cache Hits / sec`, `Metadata Cache Misses / sec`, `Output Cache Hits / sec`, `Output Cache Misses / sec`, `Requests / Sec`, `Uri Cache Hits / sec`, `Uri Cache Misses / sec` +- `PERF_COUNTER_RAWCOUNT`: `Total Threads` + +### `Web Service` + +Multi-instance. Instances: `_Total`, `Default Web Site`. Sample instance: `Default Web Site`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Current Anonymous Users` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Current Blocked Async I/O Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Current CGI Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Current Connections` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Current ISAPI Extension Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Current NonAnonymous Users` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Service Uptime` | `PERF_COUNTER_RAWCOUNT` | 3399 | | +| `Total Anonymous Users` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Blocked Async I/O Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Bytes Received` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Total Bytes Sent` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Total CGI Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Connection Attempts (all instances)` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Copy Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Delete Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Files Received` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Files Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Get Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Head Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total ISAPI Extension Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Lock Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Locked Errors` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Logon Attempts` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Mkcol Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Move Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total NonAnonymous Users` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Not Found Errors` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Options Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Other Request Methods` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Post Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Propfind Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Proppatch Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Put Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Rejected Async I/O Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Search Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Trace Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Unlock Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | + +Not read by the collector: + +- `PERF_COUNTER_BULK_COUNT`: `Bytes Received/sec`, `Bytes Sent/sec`, `Bytes Total/sec` +- `PERF_COUNTER_COUNTER`: `Anonymous Users/sec`, `CGI Requests/sec`, `Connection Attempts/sec`, `Copy Requests/sec`, `Delete Requests/sec`, `Files Received/sec`, `Files Sent/sec`, `Files/sec`, `Get Requests/sec`, `Head Requests/sec`, `ISAPI Extension Requests/sec`, `Lock Requests/sec`, `Locked Errors/sec`, `Logon Attempts/sec`, `Mkcol Requests/sec`, `Move Requests/sec`, `NonAnonymous Users/sec`, `Not Found Errors/sec`, `Options Requests/sec`, `Other Request Methods/sec`, `Post Requests/sec`, `Propfind Requests/sec`, `Proppatch Requests/sec`, `Put Requests/sec`, `Search Requests/sec`, `Total Method Requests/sec`, `Trace Requests/sec`, `Unlock Requests/sec` +- `PERF_COUNTER_LARGE_RAWCOUNT`: `Total Bytes Transferred` +- `PERF_COUNTER_RAWCOUNT`: `Current blocked bandwidth bytes.`, `Current CAL count for authenticated users`, `Current CAL count for SSL connections`, `Maximum Anonymous Users`, `Maximum CAL count for authenticated users`, `Maximum CAL count for SSL connections`, `Maximum CGI Requests`, `Maximum Connections`, `Maximum ISAPI Extension Requests`, `Maximum NonAnonymous Users`, `Measured Async I/O Bandwidth Usage`, `Total Allowed Async I/O Requests`, `Total blocked bandwidth bytes.`, `Total count of failed CAL requests for authenticated users`, `Total count of failed CAL requests for SSL connections`, `Total Files Transferred`, `Total Method Requests` + +### `Web Service Cache` + +Single-instance. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Active Flushed Entries` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Current File Cache Memory Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Current Files Cached` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Current Metadata Cached` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Current URIs Cached` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `File Cache Flushes` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `File Cache Hits` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `File Cache Misses` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Kernel: Current URIs Cached` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Kernel: Total Flushed URIs` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Kernel: Total URIs Cached` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Kernel: URI Cache Flushes` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Kernel: URI Cache Hits` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Kernel: URI Cache Misses` | `PERF_COUNTER_RAWCOUNT` | 85 | | +| `Maximum File Cache Memory Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Metadata Cache Flushes` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Metadata Cache Hits` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Metadata Cache Misses` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Output Cache Current Flushed Items` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Output Cache Current Items` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Output Cache Current Memory Usage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Output Cache Total Flushed Items` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Output Cache Total Flushes` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Output Cache Total Hits` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Output Cache Total Misses` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Files Cached` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Flushed Files` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Flushed Metadata` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Flushed URIs` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total Metadata Cached` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Total URIs Cached` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `URI Cache Flushes` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `URI Cache Hits` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `URI Cache Misses` | `PERF_COUNTER_RAWCOUNT` | 0 | | + +Not read by the collector: + +- `PERF_COUNTER_COUNTER`: `Kernel: Uri Cache Hits/sec` +- `PERF_RAW_FRACTION`: `File Cache Hits %`, `Kernel: URI Cache Hits %`, `Metadata Cache Hits %`, `URI Cache Hits %` +- `PERF_SAMPLE_FRACTION`: `Output Cache Current Hits %` diff --git a/internal/collector/logical_disk/AGENTS.md b/internal/collector/logical_disk/AGENTS.md new file mode 100644 index 00000000..21f6c1c4 --- /dev/null +++ b/internal/collector/logical_disk/AGENTS.md @@ -0,0 +1,72 @@ +# `logical_disk` collector + +The collector reads the `LogicalDisk` PDH object with `pdh.CounterTypeRaw`. +The object exists on every Windows host; no role is needed. It is +multi-instance. These notes were recorded on a Windows Server 2025 +(build 26100) Hyper-V guest. + +- Instances are drive letters (`C:`), `HarddiskVolumeN` for volumes without a + drive letter (here `HarddiskVolume1` and `HarddiskVolume4`) and the + aggregate `_Total`. `internal/pdh` drops `_Total` because the collector + asks for `pdh.InstancesAll`. The other instances pass through the volume + include and exclude regular expressions, and the instance name is the `volume` label. +- `% Free Space` is `PERF_RAW_FRACTION`. Its raw value equals + `Free Megabytes` (49907) and its base is the volume size in megabytes + (129254). The collector reads the base (`,secondvalue`) as the size in MB. + Both values are in units of 1,048,576 bytes per the help text. +- The time counters share one raw value. `% Disk Read Time`, + `Avg. Disk Read Queue Length` and the first value of `Avg. Disk sec/Read` + were all 9858832; the write counters were all 11319205, and + `Avg. Disk sec/Transfer` (21178037) is their sum. The raw value is the + cumulative busy time in 100 ns ticks. `internal/pdh` converts the + `PERF_PRECISION_100NS_TIMER` counters to seconds. The queue length and + `PERF_AVERAGE_TIMER` values arrive in ticks and need the 1e-7 factor; the + counter time base is 10 MHz here. +- `Avg. Disk sec/Read`, `/Write` and `/Transfer` are `PERF_AVERAGE_TIMER`. + Their base is the operation count and equals `Disk Reads/sec` (3073), + `Disk Writes/sec` (1698) and their sum (4771). +- `% Idle Time` is a cumulative 100 ns timer as well, not a percentage. + On `C:` it was 115960642 ticks, about 11.6 seconds. +- `Disk Read Bytes/sec` and `Disk Write Bytes/sec` (`PERF_COUNTER_BULK_COUNT`) + and the `PERF_COUNTER_COUNTER` rates are cumulative counts since boot. +- `Current Disk Queue Length` is an instantaneous snapshot (gauge) and was 0. +- `Free Megabytes` is a gauge. The collector code notes that Windows caches + it; the volume is queried directly when possible. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `LogicalDisk` + +Multi-instance. Instances: `_Total`, `C:`, `HarddiskVolume1`, `HarddiskVolume4`. Sample instance: `C:`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `% Disk Read Time` | `PERF_PRECISION_100NS_TIMER` | 9858832 | | +| `% Disk Write Time` | `PERF_PRECISION_100NS_TIMER` | 11319205 | | +| `% Free Space` | `PERF_RAW_FRACTION` | 49907 | 129254 | +| `% Idle Time` | `PERF_PRECISION_100NS_TIMER` | 115960642 | | +| `Avg. Disk Read Queue Length` | `PERF_COUNTER_100NS_QUEUELEN_TYPE` | 9858832 | | +| `Avg. Disk sec/Read` | `PERF_AVERAGE_TIMER` | 9858832 | 3073 | +| `Avg. Disk sec/Transfer` | `PERF_AVERAGE_TIMER` | 21178037 | 4771 | +| `Avg. Disk sec/Write` | `PERF_AVERAGE_TIMER` | 11319205 | 1698 | +| `Avg. Disk Write Queue Length` | `PERF_COUNTER_100NS_QUEUELEN_TYPE` | 11319205 | | +| `Current Disk Queue Length` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Disk Read Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 131518976 | | +| `Disk Reads/sec` | `PERF_COUNTER_COUNTER` | 3073 | | +| `Disk Write Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 139952640 | | +| `Disk Writes/sec` | `PERF_COUNTER_COUNTER` | 1698 | | +| `Free Megabytes` | `PERF_COUNTER_RAWCOUNT` | 49907 | | +| `Split IO/Sec` | `PERF_COUNTER_COUNTER` | 134 | | + +Not read by the collector: + +- `PERF_AVERAGE_BULK`: `Avg. Disk Bytes/Read`, `Avg. Disk Bytes/Transfer`, `Avg. Disk Bytes/Write` +- `PERF_COUNTER_100NS_QUEUELEN_TYPE`: `Avg. Disk Queue Length` +- `PERF_COUNTER_BULK_COUNT`: `Disk Bytes/sec` +- `PERF_COUNTER_COUNTER`: `Disk Transfers/sec` +- `PERF_PRECISION_100NS_TIMER`: `% Disk Time` diff --git a/internal/collector/memory/AGENTS.md b/internal/collector/memory/AGENTS.md new file mode 100644 index 00000000..92732f26 --- /dev/null +++ b/internal/collector/memory/AGENTS.md @@ -0,0 +1,82 @@ +# `memory` collector + +The collector reads the single-instance PDH object `Memory` with +`pdh.CounterTypeRaw`. The object exists on every Windows host, so no role is +needed. It also calls `GlobalMemoryStatusEx` for the physical and virtual +totals, which do not come from PDH. These notes were recorded on Windows +Server 2025 (build 26100). + +- Every `PERF_COUNTER_LARGE_RAWCOUNT` counter of this object is a gauge in + bytes, except `Available KBytes` and `Available MBytes`. + `Cache Bytes Peak` is the highest cache size since boot. In the sample, + `Available Bytes` equals `Available KBytes` times 1024, and + `Available MBytes` is the truncated value. +- `Available Bytes` equals the sum of `Free & Zero Page List Bytes` and the + three `Standby Cache ... Bytes` counters (exact in the sample). + `Cache Bytes` and `System Cache Resident Bytes` are the same value; the help + text says they are equivalent. +- Every `/sec` counter is `PERF_COUNTER_COUNTER`; its raw value is a count + since boot. `Pages/sec` equals `Pages Input/sec` plus `Pages Output/sec` + (exact in the sample) and counts pages. `Page Reads/sec` and + `Page Writes/sec` count disk operations, regardless of how many pages each + operation moved. +- `Long-Term Average Standby Cache Lifetime (s)` is a gauge in seconds. +- `Pool Paged Allocs` and `Pool Nonpaged Allocs` are `PERF_COUNTER_RAWCOUNT`. + The help text calls them the number of allocation calls; both were 0 on this + host, so their behavior could not be checked. +- `System Code Total Bytes` (8192) was smaller than + `System Code Resident Bytes` in the sample, although the help text calls the + resident value a component of the total. `Standby Cache Core Bytes` was 0. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `Memory` + +Single-instance. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Available Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 6625095680 | | +| `Available KBytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 6469820 | | +| `Available MBytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 6318 | | +| `Cache Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 401428480 | | +| `Cache Bytes Peak` | `PERF_COUNTER_LARGE_RAWCOUNT` | 558510080 | | +| `Cache Faults/sec` | `PERF_COUNTER_COUNTER` | 13400536 | | +| `Commit Limit` | `PERF_COUNTER_LARGE_RAWCOUNT` | 19728846848 | | +| `Committed Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 11770671104 | | +| `Demand Zero Faults/sec` | `PERF_COUNTER_COUNTER` | 49162751 | | +| `Free & Zero Page List Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 602169344 | | +| `Long-Term Average Standby Cache Lifetime (s)` | `PERF_COUNTER_RAWCOUNT` | 547 | | +| `Modified Page List Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 23617536 | | +| `Page Faults/sec` | `PERF_COUNTER_COUNTER` | 130811351 | | +| `Page Reads/sec` | `PERF_COUNTER_COUNTER` | 1012866 | | +| `Page Writes/sec` | `PERF_COUNTER_COUNTER` | 8667 | | +| `Pages Input/sec` | `PERF_COUNTER_COUNTER` | 8156926 | | +| `Pages Output/sec` | `PERF_COUNTER_COUNTER` | 244196 | | +| `Pages/sec` | `PERF_COUNTER_COUNTER` | 8401122 | | +| `Pool Nonpaged Allocs` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Pool Nonpaged Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 523558912 | | +| `Pool Paged Allocs` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Pool Paged Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 697995264 | | +| `Pool Paged Resident Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 673656832 | | +| `Standby Cache Core Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Standby Cache Normal Priority Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 5178191872 | | +| `Standby Cache Reserve Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 844734464 | | +| `System Cache Resident Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 401428480 | | +| `System Code Resident Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 11939840 | | +| `System Code Total Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 8192 | | +| `System Driver Resident Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 60264448 | | +| `System Driver Total Bytes` | `PERF_COUNTER_LARGE_RAWCOUNT` | 27291648 | | +| `Transition Faults/sec` | `PERF_COUNTER_COUNTER` | 63418925 | | +| `Transition Pages RePurposed/sec` | `PERF_COUNTER_COUNTER` | 10022193 | | +| `Write Copies/sec` | `PERF_COUNTER_COUNTER` | 1722840 | | + +Not read by the collector: + +- `PERF_COUNTER_RAWCOUNT`: `Free System Page Table Entries` +- `PERF_RAW_FRACTION`: `% Committed Bytes In Use` diff --git a/internal/collector/msmq/AGENTS.md b/internal/collector/msmq/AGENTS.md new file mode 100644 index 00000000..675c5743 --- /dev/null +++ b/internal/collector/msmq/AGENTS.md @@ -0,0 +1,36 @@ +# `msmq` collector + +The collector reads the PDH object `MSMQ Queue` with `pdh.CounterTypeRaw`. The +object exists only where the Message Queuing feature (MSMQ service) is +installed. It is multi-instance. These notes were recorded on Windows Server +2025 (build 26100) with no application queues. + +- All four counters are `PERF_COUNTER_LARGE_RAWCOUNT` and are gauges: the help + text says they count messages or bytes that "currently reside" in the queue. + `Bytes ...` counters are bytes. +- Instances: `Computer Queues` plus one instance per queue, named + `\private$\` in lower case. A fresh install already has the + internal queues `server2025\private$\admin_queue$` and + `server2025\private$\order_queue$`. The collector uses the instance name + unchanged as the `name` label. +- For `Computer Queues`, `Messages/Bytes in Queue` is the dead-letter queue + and `Messages/Bytes in Journal Queue` is the computer journal. +- All values were 0 on the recording host. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `MSMQ Queue` + +Multi-instance. Instances: `Computer Queues`, `server2025\private$\admin_queue$`, `server2025\private$\order_queue$`. Sample instance: `Computer Queues`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Bytes in Journal Queue` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Bytes in Queue` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Messages in Journal Queue` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Messages in Queue` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | diff --git a/internal/collector/mssql/AGENTS.md b/internal/collector/mssql/AGENTS.md new file mode 100644 index 00000000..e54aca72 --- /dev/null +++ b/internal/collector/mssql/AGENTS.md @@ -0,0 +1,443 @@ +# `mssql` collector + +The collector reads the SQL Server performance objects (`Access Methods`, +`Buffer Manager`, `Databases`, `Locks`, `Wait Statistics` and others) with +`pdh.CounterTypeRaw`, one PDH collector per SQL Server instance. It needs a +SQL Server Database Engine; CI does not provision one. These notes were +recorded on Windows Server 2025 (build 26100) with SQL Server 2022 Developer +Edition (`PatchLevel` 16.0.1000.6), named instance `NONDEFAULT`. + +- Instance discovery: each value name under + `HKLM\Software\Microsoft\Microsoft SQL Server\Instance Names\SQL` is an + instance; its data (here `MSSQL16.NONDEFAULT`) names the `Setup` key with + `PatchLevel` and `Edition`. The `mssql_instance` label is the part after + the first dot (`NONDEFAULT`). +- Object names: the value name `MSSQLSERVER` (default instance) gives + `SQLServer:`; every other instance gives `MSSQL$:`, + for example `MSSQL$NONDEFAULT:Buffer Manager`. The tables below write + `MSSQL$`. +- The Windows Internal Database on this host publishes + `MSSQL$MICROSOFT##WID:` objects, but it is not listed under + `Instance Names\SQL`, so the collector does not read it. +- `pdh` drops `_Total` because the collector does not request it. On a host + without Always On availability groups, `Availability Replica` and + `Database Replica` have only `_Total`, so they emit no series. +- `Active parallel redo threads` is read through a second `Databases` + collector that exists only for SQL Server 2019 (major version 15) and later. +- Instance labels: `Databases` instances are database names, including + `mssqlsystemresource`, `model_msdb` and `model_replicatedmaster`. `Locks` + instances are lock resource types (`Key`, `RID`, `Page`, `Object`, ...), + 15 including `_Total`. `SQL Errors` instances are error classes + (`User Errors`, `Info Errors`, `Kill Connection Errors`, + `DB Offline Errors`); `_Total` equalled their sum (38 = 34 + 4). +- `Wait Statistics` is unusual: every counter is a wait class and every + instance is a statistic, `Average wait time (ms)`, + `Cumulative wait time (ms) per second`, `Waits in progress` and + `Waits started per second`. All counters are + `PERF_COUNTER_LARGE_RAWCOUNT`, so the meaning comes from the instance name. + All values stayed 0 over 10 seconds on this idle instance. +- Every `.../sec` counter, and several counters without `/sec` (for example + `Mars Deadlocks`, the `SOAP ...` and `Lob...Count` counters, + `Log Flush Wait Time`, `Group Commit Time`, `Transaction Delay`, + `Database Flow Control Delay`), is `PERF_COUNTER_BULK_COUNT`: a cumulative + count since the instance started. +- `PERF_COUNTER_LARGE_RAWCOUNT` counters that are cumulative by their help + text: `Log Truncations`, `Log Growths` and `Log Shrinks` ("Total number of + ..."). Sizes, queues and "active"/"current" counts (`Active Transactions`, + `Processes blocked`, `Snapshot Transactions`, `Version Store unit count`, + ...) are gauges. The help text of `Version Store unit creation` and + `unit truncation` does not say which; both were 2 and 0. +- Units from the help text: + - KB: every `(KB)` counter, `Bulk Copy Throughput/sec`, + `Version Generation/Cleanup rate (KB/s)`, and in `Database Replica` the + `Recovery Queue`, `Log Send Queue`, `Total Log requiring undo`, + `Log remaining for undo` and `Redo Bytes Remaining` counters. + - Bytes: `Log Bytes Flushed/sec`, `Log Pool Total Active Log Size`, + `Log Pool Total Shared Pool Size`, `Log Bytes Compressed/sec` and + `Log Bytes Decompressed/sec`. + - Milliseconds: `Log Flush Wait Time`, `Log Flush Write Time (ms)`, + `Lock Wait Time (ms)`, `Average Wait Time (ms)`, `Transaction Delay`, + `Flow Control Time (ms/sec)`. + - Microseconds: `Readahead time/sec`, `Group Commit Time/sec` (Databases), + `Group Commit Time` and `Database Flow Control Delay` (Database Replica), + `XTP Controller DLC Latency/Fetch` and `XTP Controller DLC Peak Latency`. + - Seconds: `Page life expectancy`, `Extension page unreferenced time`, + `Longest Transaction Running Time`. + - Pages (8 KB): `Database pages`, `Target pages`, `Extension ... pages`. + - `Integral Controller Slope` and `External benefit of memory` are scaled + by 10 billion. +- Fractions and averages: the base is a separate counter in PDH + (`Buffer cache hit ratio base`, `Worktables From Cache Base`, + `Log Cache Hit Ratio Base`, `Average Wait Time Base`, + `Update conflict ratio base`, `XTP Controller DLC Latency Base`) and + `pdh.CounterTypeRaw` returns it as `,secondvalue`. + - `Locks` `Average Wait Time (ms)` is `PERF_AVERAGE_BULK`: the raw value is + cumulative lock wait milliseconds and equalled `Lock Wait Time (ms)` + (499); the base is the cumulative number of waits (3). + - `Buffer cache hit ratio` (`PERF_LARGE_RAW_FRACTION`) had equal value and + base, and both grew from 56 to 175 within 10 seconds while + `Page lookups/sec` grew by 247. They are not the lookup counter and not a + fixed sample. +- The dump below and the 10 second check above were taken at different + times. The counters had reset in between (`Page lookups/sec` fell from + 92847 to 11432), so raw values differ. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `MSSQL$:Access Methods` + +Single-instance. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `AU cleanup batches/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `AU cleanups/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `By-reference Lob Create Count` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `By-reference Lob Use Count` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Count Lob Readahead` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Count Pull In Row` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Count Push Off Row` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Deferred dropped AUs` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Deferred Dropped rowsets` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Dropped rowset cleanups/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Dropped rowsets skipped/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Extent Deallocations/sec` | `PERF_COUNTER_BULK_COUNT` | 2 | | +| `Extents Allocated/sec` | `PERF_COUNTER_BULK_COUNT` | 8 | | +| `Failed AU cleanup batches/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Failed leaf page cookie` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Failed tree page cookie` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Forwarded Records/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `FreeSpace Page Fetches/sec` | `PERF_COUNTER_BULK_COUNT` | 7 | | +| `FreeSpace Scans/sec` | `PERF_COUNTER_BULK_COUNT` | 7 | | +| `Full Scans/sec` | `PERF_COUNTER_BULK_COUNT` | 254 | | +| `Index Searches/sec` | `PERF_COUNTER_BULK_COUNT` | 44003 | | +| `InSysXact waits/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `LobHandle Create Count` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `LobHandle Destroy Count` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `LobSS Provider Create Count` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `LobSS Provider Destroy Count` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `LobSS Provider Truncation Count` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Mixed page allocations/sec` | `PERF_COUNTER_BULK_COUNT` | 6 | | +| `Page compression attempts/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Page Deallocations/sec` | `PERF_COUNTER_BULK_COUNT` | 4 | | +| `Page Splits/sec` | `PERF_COUNTER_BULK_COUNT` | 9 | | +| `Pages Allocated/sec` | `PERF_COUNTER_BULK_COUNT` | 14 | | +| `Pages compressed/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Probe Scans/sec` | `PERF_COUNTER_BULK_COUNT` | 15454 | | +| `Range Scans/sec` | `PERF_COUNTER_BULK_COUNT` | 27655 | | +| `Scan Point Revalidations/sec` | `PERF_COUNTER_BULK_COUNT` | 3 | | +| `Skipped Ghosted Records/sec` | `PERF_COUNTER_BULK_COUNT` | 7 | | +| `Table Lock Escalations/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Used leaf page cookie` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Used tree page cookie` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Workfiles Created/sec` | `PERF_COUNTER_BULK_COUNT` | 32 | | +| `Worktables Created/sec` | `PERF_COUNTER_BULK_COUNT` | 21 | | +| `Worktables From Cache Ratio` | `PERF_LARGE_RAW_FRACTION` | 0 | 0 | + +### `MSSQL$:Availability Replica` + +Multi-instance. Instances: `_Total`. Sample instance: `_Total`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Bytes Received from Replica/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Bytes Sent to Replica/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Bytes Sent to Transport/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Flow Control Time (ms/sec)` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Flow Control/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Receives from Replica/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Resent Messages/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Sends to Replica/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Sends to Transport/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | + +### `MSSQL$:Buffer Manager` + +Single-instance. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Background writer pages/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Buffer cache hit ratio` | `PERF_LARGE_RAW_FRACTION` | 56 | 56 | +| `Checkpoint pages/sec` | `PERF_COUNTER_BULK_COUNT` | 3 | | +| `Database pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 2838 | | +| `Extension allocated pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Extension free pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Extension in use as percentage` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Extension outstanding IO counter` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Extension page evictions/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Extension page reads/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Extension page unreferenced time` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Extension page writes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Free list stalls/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Integral Controller Slope` | `PERF_COUNTER_LARGE_RAWCOUNT` | 10 | | +| `Lazy writes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Page life expectancy` | `PERF_COUNTER_LARGE_RAWCOUNT` | 3273 | | +| `Page lookups/sec` | `PERF_COUNTER_BULK_COUNT` | 92847 | | +| `Page reads/sec` | `PERF_COUNTER_BULK_COUNT` | 2840 | | +| `Page writes/sec` | `PERF_COUNTER_BULK_COUNT` | 15 | | +| `Readahead pages/sec` | `PERF_COUNTER_BULK_COUNT` | 128 | | +| `Readahead time/sec` | `PERF_COUNTER_BULK_COUNT` | 872 | | +| `Target pages` | `PERF_COUNTER_LARGE_RAWCOUNT` | 32751616 | | + +Not read by the collector: + +- `PERF_LARGE_RAW_FRACTION`: `RBPEX cache hit ratio` + +### `MSSQL$:Database Replica` + +Multi-instance. Instances: `_Total`. Sample instance: `_Total`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Database Flow Control Delay` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Database Flow Controls/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `File Bytes Received/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Group Commit Time` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Group Commits/Sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Log Apply Pending Queue` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Log Apply Ready Queue` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Log Bytes Compressed/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Log Bytes Decompressed/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Log Bytes Received/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Log Compression Cache hits/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Log Compression Cache misses/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Log Compressions/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Log Decompressions/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Log remaining for undo` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Log Send Queue` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Mirrored Write Transactions/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Recovery Queue` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Redo blocked/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Redo Bytes Remaining` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Redone Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Redones/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Total Log requiring undo` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Transaction Delay` | `PERF_COUNTER_BULK_COUNT` | 0 | | + +### `MSSQL$:Databases` + +Multi-instance. Instances: `_Total`, `master`, `model`, `model_msdb`, `model_replicatedmaster`, `msdb`, `mssqlsystemresource`, `tempdb`. Sample instance: `master`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Active parallel redo threads` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Active Transactions` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Backup/Restore Throughput/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Bulk Copy Rows/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Bulk Copy Throughput/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Commit table entries` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Data File(s) Size (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 4096 | | +| `DBCC Logical Scan Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Group Commit Time/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Log Bytes Flushed/sec` | `PERF_COUNTER_BULK_COUNT` | 204800 | | +| `Log Cache Hit Ratio` | `PERF_LARGE_RAW_FRACTION` | 0 | 0 | +| `Log Cache Reads/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Log File(s) Size (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1272 | | +| `Log File(s) Used Size (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 664 | | +| `Log Flush Wait Time` | `PERF_COUNTER_BULK_COUNT` | 1 | | +| `Log Flush Waits/sec` | `PERF_COUNTER_BULK_COUNT` | 23 | | +| `Log Flush Write Time (ms)` | `PERF_COUNTER_BULK_COUNT` | 1 | | +| `Log Flushes/sec` | `PERF_COUNTER_BULK_COUNT` | 23 | | +| `Log Growths` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Log Pool Cache Misses/sec` | `PERF_COUNTER_BULK_COUNT` | 3 | | +| `Log Pool Disk Reads/sec` | `PERF_COUNTER_BULK_COUNT` | 2 | | +| `Log Pool Hash Deletes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Log Pool Hash Inserts/sec` | `PERF_COUNTER_BULK_COUNT` | 3 | | +| `Log Pool Invalid Hash Entry/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Log Pool Log Scan Pushes/sec` | `PERF_COUNTER_BULK_COUNT` | 3 | | +| `Log Pool LogWriter Pushes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Log Pool Push Empty FreePool/sec` | `PERF_COUNTER_BULK_COUNT` | 3 | | +| `Log Pool Push Low Memory/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Log Pool Push No Free Buffer/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Log Pool Req. Behind Trunc/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Log Pool Requests Old VLF/sec` | `PERF_COUNTER_BULK_COUNT` | 4 | | +| `Log Pool Requests/sec` | `PERF_COUNTER_BULK_COUNT` | 8 | | +| `Log Pool Total Active Log Size` | `PERF_COUNTER_LARGE_RAWCOUNT` | 446464 | | +| `Log Pool Total Shared Pool Size` | `PERF_COUNTER_LARGE_RAWCOUNT` | 12288 | | +| `Log Shrinks` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Log Truncations` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Percent Log Used` | `PERF_COUNTER_LARGE_RAWCOUNT` | 52 | | +| `Repl. Pending Xacts` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Repl. Trans. Rate` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Shrink Data Movement Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Tracked transactions/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Transactions/sec` | `PERF_COUNTER_BULK_COUNT` | 151 | | +| `Write Transactions/sec` | `PERF_COUNTER_BULK_COUNT` | 23 | | +| `XTP Controller DLC Latency/Fetch` | `PERF_AVERAGE_BULK` | 0 | 0 | +| `XTP Controller DLC Peak Latency` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `XTP Controller Log Processed/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `XTP Memory Used (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | + +Not read by the collector: + +- `PERF_AVERAGE_BULK`: `Avg Dist From EOL/LP Request` +- `PERF_COUNTER_BULK_COUNT`: `PVS in-row diff generated/sec`, `PVS in-row diff retrieved/sec`, `PVS off-row pages allocated/sec`, `PVS off-row pages deleted/sec`, `PVS off-row record generated/sec`, `PVS off-row record retrieved/sec`, `Tail Log Cache Deletes/sec`, `Tail Log Cache Misses/sec`, `TLC LogWriter Pushes/sec`, `TLC Req. Behind Trunc/sec` +- `PERF_COUNTER_LARGE_RAWCOUNT`: `WPR add lsn bucket miss`, `WPR bucket swaps`, `WPR stale check bucket miss` + +### `MSSQL$:General Statistics` + +Single-instance. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Active Temp Tables` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Connection Reset/sec` | `PERF_COUNTER_BULK_COUNT` | 75 | | +| `Event Notifications Delayed Drop` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `HTTP Authenticated Requests` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Logical Connections` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Logins/sec` | `PERF_COUNTER_BULK_COUNT` | 5 | | +| `Logouts/sec` | `PERF_COUNTER_BULK_COUNT` | 5 | | +| `Mars Deadlocks` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Non-atomic yield rate` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Processes blocked` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `SOAP Empty Requests` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `SOAP Method Invocations` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `SOAP Session Initiate Requests` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `SOAP Session Terminate Requests` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `SOAP SQL Requests` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `SOAP WSDL Requests` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `SQL Trace IO Provider Lock Waits` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Temp Tables Creation Rate` | `PERF_COUNTER_BULK_COUNT` | 2 | | +| `Temp Tables For Destruction` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Tempdb recovery unit id` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Tempdb rowset id` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Trace Event Notification Queue` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Transactions` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `User Connections` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | + +### `MSSQL$:Locks` + +Multi-instance. Instances: `_Total`, `AllocUnit`, `Application`, `Database`, `Extent`, `File`, `HoBT`, `Key`, ... (15 in total). Sample instance: `AllocUnit`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Average Wait Time (ms)` | `PERF_AVERAGE_BULK` | 0 | 0 | +| `Lock Requests/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Lock Timeouts (timeout > 0)/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Lock Timeouts/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Lock Wait Time (ms)` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Lock Waits/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Number of Deadlocks/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | + +### `MSSQL$:Memory Manager` + +Single-instance. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Connection Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 2024 | | +| `Database Cache Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 22704 | | +| `External benefit of memory` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Free Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 7776 | | +| `Granted Workspace Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Lock Blocks` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Lock Blocks Allocated` | `PERF_COUNTER_LARGE_RAWCOUNT` | 3050 | | +| `Lock Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 768 | | +| `Lock Owner Blocks` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Lock Owner Blocks Allocated` | `PERF_COUNTER_LARGE_RAWCOUNT` | 5550 | | +| `Log Pool Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 4376 | | +| `Maximum Workspace Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 4500240 | | +| `Memory Grants Outstanding` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Memory Grants Pending` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Optimizer Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1024 | | +| `Reserved Server Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `SQL Cache Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 1720 | | +| `Stolen Server Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 297616 | | +| `Target Server Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 5988752 | | +| `Total Server Memory (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 328096 | | + +Not read by the collector: + +- `PERF_COUNTER_BULK_COUNT`: `Decommit Memory (KB)/sec` + +### `MSSQL$:SQL Errors` + +Multi-instance. Instances: `_Total`, `DB Offline Errors`, `Info Errors`, `Kill Connection Errors`, `User Errors`. Sample instance: `DB Offline Errors`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Errors/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | + +### `MSSQL$:SQL Statistics` + +Single-instance. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Auto-Param Attempts/sec` | `PERF_COUNTER_BULK_COUNT` | 35 | | +| `Batch Requests/sec` | `PERF_COUNTER_BULK_COUNT` | 160 | | +| `Failed Auto-Params/sec` | `PERF_COUNTER_BULK_COUNT` | 27 | | +| `Forced Parameterizations/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Guided plan executions/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Misguided plan executions/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Safe Auto-Params/sec` | `PERF_COUNTER_BULK_COUNT` | 2 | | +| `SQL Attention rate` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `SQL Compilations/sec` | `PERF_COUNTER_BULK_COUNT` | 83 | | +| `SQL Re-Compilations/sec` | `PERF_COUNTER_BULK_COUNT` | 2 | | +| `Unsafe Auto-Params/sec` | `PERF_COUNTER_BULK_COUNT` | 6 | | + +### `MSSQL$:Transactions` + +Single-instance. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Free Space in tempdb (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 62528 | | +| `Longest Transaction Running Time` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `NonSnapshot Version Transactions` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Snapshot Transactions` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Transactions` | `PERF_COUNTER_LARGE_RAWCOUNT` | 6 | | +| `Update conflict ratio` | `PERF_AVERAGE_BULK` | 0 | 0 | +| `Update Snapshot Transactions` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Version Cleanup rate (KB/s)` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Version Generation rate (KB/s)` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Version Store Size (KB)` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Version Store unit count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 2 | | +| `Version Store unit creation` | `PERF_COUNTER_LARGE_RAWCOUNT` | 2 | | +| `Version Store unit truncation` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | + +### `MSSQL$:Wait Statistics` + +Multi-instance. Instances: `Average wait time (ms)`, `Cumulative wait time (ms) per second`, `Waits in progress`, `Waits started per second`. Sample instance: `Average wait time (ms)`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Lock waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Log buffer waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Log write waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Memory grant queue waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Network IO waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Non-Page latch waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Page IO latch waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Page latch waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Thread-safe memory objects waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Transaction ownership waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Wait for the worker` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Workspace synchronization waits` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | diff --git a/internal/collector/net/AGENTS.md b/internal/collector/net/AGENTS.md new file mode 100644 index 00000000..ed15bb00 --- /dev/null +++ b/internal/collector/net/AGENTS.md @@ -0,0 +1,61 @@ +# `net` collector + +The collector reads the `Network Interface` PDH object with +`pdh.CounterTypeRaw`. The object exists on every Windows host; no role is +needed. It is multi-instance. These notes were recorded on a Windows Server +2025 (build 26100) Hyper-V guest that also runs the Hyper-V role. + +- Instances are adapter descriptions with `(`, `)`, `#`, `/` and `\` + replaced by `[`, `]`, `_`, `_` and `_`. The collector applies the same + replacement to the adapter description for the `nic` label of the info + metrics. There is no `_Total` instance. +- On this host `Network Interface` had only one instance, + `Microsoft Hyper-V Network Adapter`, although `Get-NetAdapter` also listed + the Hyper-V switch adapters `Hyper-V Virtual Ethernet Adapter` and + `Hyper-V Virtual Ethernet Adapter #2`. Those appear only in the + `Network Adapter` object (as `Hyper-V Virtual Ethernet Adapter _2` for the + second one), which the collector does not read. +- `Current Bandwidth` is in bits per second per the help text; the raw value + was 10000000000 for a 10 Gbps link. The collector divides it by 8 for + `current_bandwidth_bytes`. +- `Output Queue Length` is a gauge. The help text says it is always 0 + because NDIS queues the requests. +- The `Packets ... Discarded`, `Packets ... Errors` and + `Packets Received Unknown` counters are `PERF_COUNTER_LARGE_RAWCOUNT` but + cumulative counts of packets. All were 0 here. +- The `/sec` counters are `PERF_COUNTER_BULK_COUNT`, cumulative since the + adapter started. `Bytes Total/sec` is the sum of `Bytes Received/sec` and + `Bytes Sent/sec`, and `Packets/sec` is the sum of `Packets Received/sec` + and `Packets Sent/sec` (exact in the sample). + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `Network Interface` + +Multi-instance. Instances: `Microsoft Hyper-V Network Adapter`. Sample instance: `Microsoft Hyper-V Network Adapter`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Bytes Received/sec` | `PERF_COUNTER_BULK_COUNT` | 6363880254 | | +| `Bytes Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 82374607 | | +| `Bytes Total/sec` | `PERF_COUNTER_BULK_COUNT` | 6446254861 | | +| `Current Bandwidth` | `PERF_COUNTER_LARGE_RAWCOUNT` | 10000000000 | | +| `Output Queue Length` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Packets Outbound Discarded` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Packets Outbound Errors` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Packets Received Discarded` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Packets Received Errors` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Packets Received Unknown` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Packets Received/sec` | `PERF_COUNTER_BULK_COUNT` | 4526889 | | +| `Packets Sent/sec` | `PERF_COUNTER_BULK_COUNT` | 538207 | | +| `Packets/sec` | `PERF_COUNTER_BULK_COUNT` | 5065096 | | + +Not read by the collector: + +- `PERF_COUNTER_BULK_COUNT`: `Packets Received Non-Unicast/sec`, `Packets Received Unicast/sec`, `Packets Sent Non-Unicast/sec`, `Packets Sent Unicast/sec`, `TCP RSC Coalesced Packets/sec`, `TCP RSC Exceptions/sec` +- `PERF_COUNTER_LARGE_RAWCOUNT`: `Offloaded Connections`, `TCP Active RSC Connections`, `TCP RSC Average Packet Size` diff --git a/internal/collector/nps/AGENTS.md b/internal/collector/nps/AGENTS.md new file mode 100644 index 00000000..e78d6cb7 --- /dev/null +++ b/internal/collector/nps/AGENTS.md @@ -0,0 +1,74 @@ +# `nps` collector + +The collector reads the single-instance PDH objects `NPS Authentication Server` +and `NPS Accounting Server` with `pdh.CounterTypeRaw`. They exist only where +the Network Policy Server role (service `IAS`) is installed. These notes were +recorded on Windows Server 2025 (build 26100) with almost no RADIUS traffic. + +- Every counter that the collector reads is `PERF_COUNTER_RAWCOUNT`. All of + them except the two time counters are cumulative packet counts since the + NPS service started. +- `Server Up Time` and `Server Reset Time` are elapsed times. The help text + says "in hundredths of a second", but the raw value is seconds: 303 about + 304 s after the `IAS` service started. Both objects report the same values. +- Each `X / sec.` twin (`PERF_COUNTER_COUNTER`, not read) has the same raw + value as `X` (`Packets Received / sec.` 1 = `Packets Received` 1). +- `No Record` exists only on `NPS Accounting Server`; + `Access-Accepts/Challenges/Rejects/Requests` only on + `NPS Authentication Server`. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `NPS Accounting Server` + +Single-instance. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Accounting-Requests` | `PERF_COUNTER_RAWCOUNT` | 1 | | +| `Accounting-Responses` | `PERF_COUNTER_RAWCOUNT` | 1 | | +| `Bad Authenticators` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Dropped Packets` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Invalid Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Malformed Packets` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `No Record` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Packets Received` | `PERF_COUNTER_RAWCOUNT` | 1 | | +| `Packets Sent` | `PERF_COUNTER_RAWCOUNT` | 1 | | +| `Server Reset Time` | `PERF_COUNTER_RAWCOUNT` | 3275 | | +| `Server Up Time` | `PERF_COUNTER_RAWCOUNT` | 3275 | | +| `Unknown Type` | `PERF_COUNTER_RAWCOUNT` | 0 | | + +Not read by the collector: + +- `PERF_COUNTER_COUNTER`: `Accounting-Requests / sec.`, `Accounting-Responses / sec.`, `Bad Authenticators / sec.`, `Dropped Packets / sec.`, `Invalid Requests / sec.`, `Malformed Packets / sec.`, `No Record / sec.`, `Packets Received / sec.`, `Packets Sent / sec.`, `Unknown Type / sec.` + +### `NPS Authentication Server` + +Single-instance. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Access-Accepts` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Access-Challenges` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Access-Rejects` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Access-Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Bad Authenticators` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Dropped Packets` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Invalid Requests` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Malformed Packets` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Packets Received` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Packets Sent` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Server Reset Time` | `PERF_COUNTER_RAWCOUNT` | 3275 | | +| `Server Up Time` | `PERF_COUNTER_RAWCOUNT` | 3275 | | +| `Unknown Type` | `PERF_COUNTER_RAWCOUNT` | 0 | | + +Not read by the collector: + +- `PERF_COUNTER_COUNTER`: `Access-Accepts / sec.`, `Access-Challenges / sec.`, `Access-Rejects / sec.`, `Access-Requests / sec.`, `Bad Authenticators / sec.`, `Dropped Packets / sec.`, `Invalid Requests / sec.`, `Malformed Packets / sec.`, `Packets Received / sec.`, `Packets Sent / sec.`, `Unknown Type / sec.` diff --git a/internal/collector/pagefile/AGENTS.md b/internal/collector/pagefile/AGENTS.md new file mode 100644 index 00000000..27f75bf8 --- /dev/null +++ b/internal/collector/pagefile/AGENTS.md @@ -0,0 +1,37 @@ +# `pagefile` collector + +The collector reads the multi-instance PDH object `Paging File` with +`pdh.CounterTypeRaw`. The object exists on every Windows host with a page +file, so no role is needed. It also uses `GetPerformanceInfo` for the page +size and `os.Stat` for the file size. These notes were recorded on Windows +Server 2025 (build 26100) with one page file. + +- Instances are the page file paths, here `C:\pagefile.sys`, plus `_Total`. + `_Total` is dropped because the collector does not request it. The + instance name had no `\??\` prefix on this host. The `file` label is the + instance name with any `\??\` prefix removed. +- `% Usage` and `% Usage Peak` are `PERF_RAW_FRACTION`. Despite the `%`, the + raw value is the number of pages in use (a gauge) and the base + (`,secondvalue`) is the page file size in pages. With 4096-byte pages, the + base 622592 matched the file size of 2550136832 bytes from `os.Stat` and + the 2432 MB `AllocatedBaseSize` of `Win32_PageFileUsage`. +- `% Usage` was 128462 pages in the dump and 0 in a later live sample. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `Paging File` + +Multi-instance. Instances: `_Total`, `C:\pagefile.sys`. Sample instance: `C:\pagefile.sys`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `% Usage` | `PERF_RAW_FRACTION` | 128462 | 622592 | + +Not read by the collector: + +- `PERF_RAW_FRACTION`: `% Usage Peak` diff --git a/internal/collector/physical_disk/AGENTS.md b/internal/collector/physical_disk/AGENTS.md new file mode 100644 index 00000000..285748d8 --- /dev/null +++ b/internal/collector/physical_disk/AGENTS.md @@ -0,0 +1,62 @@ +# `physical_disk` collector + +The collector reads the `PhysicalDisk` PDH object with `pdh.CounterTypeRaw`. +The object exists on every Windows host; no role is needed. It is +multi-instance. These notes were recorded on a Windows Server 2025 +(build 26100) Hyper-V guest, so the disks are virtual Hyper-V disks. + +- Instances are the disk number, followed by the drive letters of its + volumes when it has any: `0 C:`, `1`, `2`, `3`, `4`, plus the aggregate + `_Total`. `internal/pdh` drops `_Total` because the collector asks for + `pdh.InstancesAll`. The collector matches the include and exclude regular expressions + against the full instance name and then labels the metrics with the part + before the first space (`0`). +- The time counters share one raw value. `% Disk Read Time` and the first + value of `Avg. Disk sec/Read` were both 7370439057; the write pair was + 9150445263, and `Avg. Disk sec/Transfer` (16520884320) is their sum. The + value is the cumulative busy time in 100 ns ticks. +- `internal/pdh` converts the `PERF_PRECISION_100NS_TIMER` counters + (`% Disk Read Time`, `% Disk Write Time`, `% Idle Time`) to seconds. + `PERF_AVERAGE_TIMER` values arrive in ticks of the 10 MHz counter time base + and need the 1e-7 factor. +- The `PERF_AVERAGE_TIMER` base is the operation count: it equals + `Disk Reads/sec` (781613), `Disk Writes/sec` (940802) and their sum + (1722415). +- `Disk Read Bytes/sec`, `Disk Write Bytes/sec` (`PERF_COUNTER_BULK_COUNT`, + bytes) and the `PERF_COUNTER_COUNTER` rates are cumulative counts since + boot. +- `Current Disk Queue Length` is an instantaneous snapshot (gauge) and was 0. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `PhysicalDisk` + +Multi-instance. Instances: `_Total`, `0 C:`, `1`, `2`, `3`, `4`. Sample instance: `0 C:`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `% Disk Read Time` | `PERF_PRECISION_100NS_TIMER` | 7370439057 | | +| `% Disk Write Time` | `PERF_PRECISION_100NS_TIMER` | 9150445263 | | +| `% Idle Time` | `PERF_PRECISION_100NS_TIMER` | 28962791306 | | +| `Avg. Disk sec/Read` | `PERF_AVERAGE_TIMER` | 7370439057 | 781613 | +| `Avg. Disk sec/Transfer` | `PERF_AVERAGE_TIMER` | 16520884320 | 1722415 | +| `Avg. Disk sec/Write` | `PERF_AVERAGE_TIMER` | 9150445263 | 940802 | +| `Current Disk Queue Length` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Disk Read Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 44064459264 | | +| `Disk Reads/sec` | `PERF_COUNTER_COUNTER` | 781613 | | +| `Disk Write Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 55022156288 | | +| `Disk Writes/sec` | `PERF_COUNTER_COUNTER` | 940802 | | +| `Split IO/Sec` | `PERF_COUNTER_COUNTER` | 75848 | | + +Not read by the collector: + +- `PERF_AVERAGE_BULK`: `Avg. Disk Bytes/Read`, `Avg. Disk Bytes/Transfer`, `Avg. Disk Bytes/Write` +- `PERF_COUNTER_100NS_QUEUELEN_TYPE`: `Avg. Disk Queue Length`, `Avg. Disk Read Queue Length`, `Avg. Disk Write Queue Length` +- `PERF_COUNTER_BULK_COUNT`: `Disk Bytes/sec` +- `PERF_COUNTER_COUNTER`: `Disk Transfers/sec` +- `PERF_PRECISION_100NS_TIMER`: `% Disk Time` diff --git a/internal/collector/remote_fx/AGENTS.md b/internal/collector/remote_fx/AGENTS.md new file mode 100644 index 00000000..d6fa0508 --- /dev/null +++ b/internal/collector/remote_fx/AGENTS.md @@ -0,0 +1,86 @@ +# `remote_fx` collector + +The collector reads `RemoteFX Network` and `RemoteFX Graphics` with +`pdh.CounterTypeRaw`. Instances exist only while an RDP session is connected, +so most local runs see none. These notes were recorded on Windows Server 2025 +with one active RDP session over TCP. + +- Instance names differ in case between the objects: `RDP-tcp 0` in + `RemoteFX Network`, `RDP-Tcp 0` in `RemoteFX Graphics`. + `normalizeSessionName` makes both `RDP-Tcp 0`, which is also the + `session_name` of `windows_terminal_services_session_info`. The console and + services sessions have no instance. +- `RemoteFX Network` counter types and units (from the counter help text): + - `Current TCP/UDP Bandwidth`: `NumberOfItems32`, kbit/s (1000 bit/s). + - `Base/Current TCP/UDP RTT`: `NumberOfItems32`, milliseconds. They stayed + 0 for the whole TCP-only session; they appear to be measured only with UDP + transport. + - `Total Sent Bytes`, `Total Received Bytes`: `NumberOfItems32`, cumulative + bytes. + - `Total/TCP/UDP Sent Rate`, `Total/TCP/UDP Received Rate` and + `Sent Rate P0`..`P3`: `RateOfCountsPerSecond32`, cumulative **bits** + (`Total Sent Rate` raw was 8 × `Total Sent Bytes`). + - `UDP Packets Sent/sec`, `UDP Packets Received/sec`: + `RateOfCountsPerSecond32`, cumulative packets. + - `Loss Rate`, `Retransmission Rate`, `FEC Rate`: `SampleFraction`; raw is a + cumulative numerator and the base (`,secondvalue`) the matching total. + Neither value alone is a percentage. Both were 0 on TCP. +- `RemoteFX Graphics`: `Input/Output/Source Frames/Second` and the three + `Frames Skipped/Second - Insufficient {Client,Network,Server} Resources` + counters are `RateOfCountsPerSecond32` (cumulative frames); + `Frame Quality` (percent), `Graphics Compression ratio` and + `Average Encoding Time` (milliseconds) are `NumberOfItems32` gauges. +- Sample: `Input Frames/Second` raw 27086, `Output Frames/Second` 26142, + `Source Frames/Second` 0, `Frame Quality` 100, `Current TCP Bandwidth` + 151159, `Total Sent Bytes` 29262741, `Total Received Bytes` 3920173. +- `RemoteFX Root GPU Management` exists but has no instances without GPU + partitioning; the collector does not read it. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `RemoteFX Graphics` + +Multi-instance. Instances: `RDP-Tcp 0`. Sample instance: `RDP-Tcp 0`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Average Encoding Time` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Frame Quality` | `PERF_COUNTER_RAWCOUNT` | 100 | | +| `Frames Skipped/Second - Insufficient Client Resources` | `PERF_COUNTER_COUNTER` | 0 | | +| `Frames Skipped/Second - Insufficient Network Resources` | `PERF_COUNTER_COUNTER` | 0 | | +| `Frames Skipped/Second - Insufficient Server Resources` | `PERF_COUNTER_COUNTER` | 0 | | +| `Graphics Compression ratio` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Input Frames/Second` | `PERF_COUNTER_COUNTER` | 27104 | | +| `Output Frames/Second` | `PERF_COUNTER_COUNTER` | 26157 | | +| `Source Frames/Second` | `PERF_COUNTER_COUNTER` | 0 | | + +### `RemoteFX Network` + +Multi-instance. Instances: `RDP-tcp 0`. Sample instance: `RDP-tcp 0`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Base TCP RTT` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Base UDP RTT` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Current TCP Bandwidth` | `PERF_COUNTER_RAWCOUNT` | 151159 | | +| `Current TCP RTT` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Current UDP Bandwidth` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Current UDP RTT` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `FEC Rate` | `PERF_SAMPLE_FRACTION` | 0 | 0 | +| `Loss Rate` | `PERF_SAMPLE_FRACTION` | 0 | 0 | +| `Retransmission Rate` | `PERF_SAMPLE_FRACTION` | 0 | 0 | +| `Total Received Bytes` | `PERF_COUNTER_RAWCOUNT` | 3922173 | | +| `Total Sent Bytes` | `PERF_COUNTER_RAWCOUNT` | 29288171 | | +| `UDP Packets Received/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `UDP Packets Sent/sec` | `PERF_COUNTER_COUNTER` | 0 | | + +Not read by the collector: + +- `PERF_COUNTER_COUNTER`: `Sent Rate P0`, `Sent Rate P1`, `Sent Rate P2`, `Sent Rate P3`, `TCP Received Rate`, `TCP Sent Rate`, `Total Received Rate`, `Total Sent Rate`, `UDP Received Rate`, `UDP Sent Rate` diff --git a/internal/collector/smb/AGENTS.md b/internal/collector/smb/AGENTS.md new file mode 100644 index 00000000..f1bc0fff --- /dev/null +++ b/internal/collector/smb/AGENTS.md @@ -0,0 +1,55 @@ +# `smb` collector + +The collector reads the `SMB Server Shares` PDH object with +`pdh.CounterTypeRaw`. The object comes with the SMB server (`LanmanServer`) +and is multi-instance, one instance per share. These notes were recorded on a +Windows Server 2025 (build 26100) domain controller running as a Hyper-V +guest. + +- Instance names are UNC paths with `*` as the host, for example + `\\*\IPC$`, `\\*\SYSVOL` and `\\*\NETLOGON`. Scoped shares use the scope + name instead, here `\\MSCLUSTER\ClusterStorage$`. There is also an + aggregate `_Total`, which `internal/pdh` drops because the collector asks + for `pdh.InstancesAll`. The instance name is the `share` label. +- `Current Open File Count` and `Tree Connect Count` are gauges: the help + text calls them the handles "currently open" and "the current number of + tree connects". With one test client connected, `\\*\SmbClientTest` had + `Tree Connect Count` 1 and `Current Open File Count` 1. +- The `/sec` counters (`PERF_COUNTER_BULK_COUNT` and + `PERF_COUNTER_COUNTER`) are cumulative. `Files Opened/sec` was 28 on + `\\*\SYSVOL` while its open file count was 0. +- `Received Bytes/sec` and `Sent Bytes/sec` are bytes and include SMB + protocol data such as packet headers, per the help text. +- The sample instance `\\*\ADMIN$` had no traffic, so all its values are 0. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `SMB Server Shares` + +Multi-instance. Instances: `\\*\ADMIN$`, `\\*\C$`, `\\*\IPC$`, `\\*\MSCLUSTER`, `\\*\NETLOGON`, `\\*\SmbClientTest`, `\\*\SYSVOL`, `\\MSCLUSTER\ClusterStorage$`, ... (9 in total). Sample instance: `\\*\ADMIN$`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Current Open File Count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Files Opened/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Metadata Requests/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Read Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Received Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Sent Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Tree Connect Count` | `PERF_COUNTER_LARGE_RAWCOUNT` | 0 | | +| `Write Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | | + +Not read by the collector: + +- `PERF_AVERAGE_BULK`: `Avg. Bytes/Read`, `Avg. Bytes/Write`, `Avg. Data Bytes/Request` +- `PERF_AVERAGE_TIMER`: `Avg. sec/Data Request`, `Avg. sec/Read`, `Avg. sec/Request`, `Avg. sec/Write` +- `PERF_COUNTER_100NS_QUEUELEN_TYPE`: `Avg. Data Queue Length`, `Avg. Read Queue Length`, `Avg. Write Queue Length` +- `PERF_COUNTER_BULK_COUNT`: `Attempted Compressed Responses/sec`, `Bytes Compressed/sec`, `Compressed Requests/sec`, `Data Bytes/sec`, `Read Bytes transmitted ByPassCSV/sec`, `Read Bytes transmitted via SMB Direct/sec`, `Read Bytes/sec`, `Requests/sec`, `Successful Compressed Responses/sec`, `Transferred Bytes/sec`, `Write Bytes transmitted ByPassCSV/sec`, `Write Bytes transmitted via SMB Direct/sec`, `Write Bytes/sec` +- `PERF_COUNTER_COUNTER`: `Data Requests/sec`, `Read Requests transmitted via BypassCSV/sec`, `Read Requests transmitted via SMB Direct/sec`, `Write Requests transmitted via BypassCSV/sec`, `Write Requests transmitted via SMB Direct/sec` +- `PERF_COUNTER_LARGE_RAWCOUNT`: `Current Bypass Open File Count`, `Current Data Queue Length`, `Current Durable Open File Count`, `Current Pending Requests`, `Total Durable Handle Reopen Count`, `Total Failed Durable Handle Reopen Count`, `Total Failed Persistent Handle Reopen Count`, `Total Failed Resilient Handle Reopen Count`, `Total File Open Count`, `Total Persistent Handle Reopen Count`, `Total Resilient Handle Reopen Count` +- `PERF_LARGE_RAW_FRACTION`: `% Persistent Handles`, `% Resilient Handles` diff --git a/internal/collector/smbclient/AGENTS.md b/internal/collector/smbclient/AGENTS.md new file mode 100644 index 00000000..df9c4e26 --- /dev/null +++ b/internal/collector/smbclient/AGENTS.md @@ -0,0 +1,63 @@ +# `smbclient` collector + +The collector reads the `SMB Client Shares` PDH object with +`pdh.CounterTypeRaw`. It is multi-instance, with one instance per share the +host has connected to. These notes were recorded on a Windows Server 2025 +(build 26100) Hyper-V guest that had mapped one share of its own SMB server. + +- Instance names have a single leading backslash: `\SERVER2025\SmbClientTest`. + The collector splits the name at `\` and uses the two parts as the `server` + and `share` labels. The aggregate `_Total` is dropped by `internal/pdh` + because the collector asks for `pdh.InstancesAll`. +- The mapped share was idle, so every counter of the sample instance was 0. +- `Current Data Queue Length` is the only gauge ("the current number of read + or write requests outstanding"). The `/sec` counters are cumulative counts. +- `Avg. Data/Read/Write Queue Length` are `PERF_COUNTER_100NS_QUEUELEN_TYPE`: + the raw value is accumulated queue time in 100 ns ticks. `internal/pdh` does + not convert this type, so the collector applies the 1e-7 factor. +- `Avg. sec/Read`, `Avg. sec/Write` and `Avg. sec/Data Request` are + `PERF_AVERAGE_TIMER`. The first value is the summed latency in ticks of the + 10 MHz counter time base and the base is the request count; the collector + reads only the first value. +- `Data Bytes/sec`, `Read Bytes/sec` and `Write Bytes/sec` are bytes + (`PERF_COUNTER_BULK_COUNT`). + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `SMB Client Shares` + +Multi-instance. Instances: `\SERVER2025\SmbClientTest`, `_Total`. Sample instance: `\SERVER2025\SmbClientTest`. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Avg. Data Queue Length` | `PERF_COUNTER_100NS_QUEUELEN_TYPE` | 0 | | +| `Avg. Read Queue Length` | `PERF_COUNTER_100NS_QUEUELEN_TYPE` | 0 | | +| `Avg. sec/Data Request` | `PERF_AVERAGE_TIMER` | 0 | 0 | +| `Avg. sec/Read` | `PERF_AVERAGE_TIMER` | 0 | 0 | +| `Avg. sec/Write` | `PERF_AVERAGE_TIMER` | 0 | 0 | +| `Avg. Write Queue Length` | `PERF_COUNTER_100NS_QUEUELEN_TYPE` | 0 | | +| `Credit Stalls/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Current Data Queue Length` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Data Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Data Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Metadata Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Read Bytes transmitted via SMB Direct/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Read Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Read Requests transmitted via SMB Direct/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Read Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Turbo I/O Reads/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Turbo I/O Writes/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Write Bytes transmitted via SMB Direct/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Write Bytes/sec` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `Write Requests transmitted via SMB Direct/sec` | `PERF_COUNTER_COUNTER` | 0 | | +| `Write Requests/sec` | `PERF_COUNTER_COUNTER` | 0 | | + +Not read by the collector: + +- `PERF_AVERAGE_BULK`: `Avg. Bytes/Read`, `Avg. Bytes/Write`, `Avg. Data Bytes/Request` +- `PERF_COUNTER_COUNTER`: `Attempted Compressed Requests/sec`, `Compressed Bytes Sent/sec`, `Compressed Responses/sec`, `Successful Compressed Requests /sec` diff --git a/internal/collector/system/AGENTS.md b/internal/collector/system/AGENTS.md new file mode 100644 index 00000000..cd05d8b3 --- /dev/null +++ b/internal/collector/system/AGENTS.md @@ -0,0 +1,45 @@ +# `system` collector + +The collector reads the single-instance PDH object `System` with +`pdh.CounterTypeRaw`. The object exists on every Windows host, so no role is +needed. The boot time comes from `ntdll`, not from the PDH counter +`System Up Time`. These notes were recorded on Windows Server 2025 +(build 26100). + +- `Context Switches/sec`, `Exception Dispatches/sec` and `System Calls/sec` + are `PERF_COUNTER_COUNTER`. The raw value is a cumulative count since boot. + The type has a 32-bit raw value, so a busy host wraps it at 2^32; a scraper + sees the wrap as a counter reset. `System Calls/sec` was already 345 million + in the sample. +- `Processes`, `Threads` and `Processor Queue Length` are + `PERF_COUNTER_RAWCOUNT` gauges. The help text calls `Processes` and + `Threads` instantaneous counts. `Processor Queue Length` counts ready + threads in the single queue shared by all processors, so per-processor load + needs a division by the processor count. It was 0 in the sample. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `System` + +Single-instance. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Context Switches/sec` | `PERF_COUNTER_COUNTER` | 50992231 | | +| `Exception Dispatches/sec` | `PERF_COUNTER_COUNTER` | 321946 | | +| `Processes` | `PERF_COUNTER_RAWCOUNT` | 200 | | +| `Processor Queue Length` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `System Calls/sec` | `PERF_COUNTER_COUNTER` | 345210165 | | +| `Threads` | `PERF_COUNTER_RAWCOUNT` | 2894 | | + +Not read by the collector: + +- `PERF_COUNTER_BULK_COUNT`: `File Control Bytes/sec`, `File Read Bytes/sec`, `File Write Bytes/sec` +- `PERF_COUNTER_COUNTER`: `Alignment Fixups/sec`, `File Control Operations/sec`, `File Data Operations/sec`, `File Read Operations/sec`, `File Write Operations/sec`, `Floating Emulations/sec` +- `PERF_ELAPSED_TIME`: `System Up Time` +- `PERF_RAW_FRACTION`: `% Registry Quota In Use` diff --git a/internal/collector/time/AGENTS.md b/internal/collector/time/AGENTS.md new file mode 100644 index 00000000..7debbba0 --- /dev/null +++ b/internal/collector/time/AGENTS.md @@ -0,0 +1,41 @@ +# `time` collector + +The collector reads the single-instance PDH object `Windows Time Service` with +`pdh.CounterTypeRaw`. The object needs the W32Time service. These notes were +recorded on Windows Server 2025 (build 26100), a domain controller and +Hyper-V guest. + +- `Computed Time Offset` (`PERF_COUNTER_LARGE_RAWCOUNT`) and + `NTP Roundtrip Delay` (`PERF_COUNTER_RAWCOUNT`) are gauges in microseconds, + per the help text. The offset is absolute, so it is never negative. +- `Clock Frequency Adjustment` is a gauge in nominal clock units; + `Clock Frequency Adjustment (PPB)` is the same adjustment in parts per + billion. In the sample they were 0 and 600. +- The struct tag spells the counter `Clock Frequency Adjustment (ppb)`, but + Windows names it `(PPB)`. The name lookup is case-insensitive, and the + counter was read on this host. +- `NTP Server Incoming Requests` and `NTP Server Outgoing Responses` are + `PERF_COUNTER_BULK_COUNT`; the raw value is a cumulative count. +- `NTP Client Time Source Count`, `NTP Roundtrip Delay` and both NTP server + counters were 0 on this host. + +## Counter reference + +Recorded on Windows Server 2025 (build 26100). `Raw` and `Base` are the first and second +values that `pdh.CounterTypeRaw` returns for the sample instance. + +### `Windows Time Service` + +Single-instance. + +Counters the collector reads: + +| Counter | Type | Raw | Base | +|---|---|---|---| +| `Clock Frequency Adjustment` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `Clock Frequency Adjustment (PPB)` | `PERF_COUNTER_RAWCOUNT` | 600 | | +| `Computed Time Offset` | `PERF_COUNTER_LARGE_RAWCOUNT` | 83 | | +| `NTP Client Time Source Count` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `NTP Roundtrip Delay` | `PERF_COUNTER_RAWCOUNT` | 0 | | +| `NTP Server Incoming Requests` | `PERF_COUNTER_BULK_COUNT` | 0 | | +| `NTP Server Outgoing Responses` | `PERF_COUNTER_BULK_COUNT` | 0 | |