Beats: Metricbeat fstat on Windows always shows zero values

[Cylindric]

I'm running metricbeat on a bunch of Windows servers as a test, and I am seeing ES records for each drive on the server, but the values are always zero.

"system": {
      "diskio": {
        "io": {
          "time": 0
        },
        "name": "E:",
        "read": {
          "bytes": 0,
          "count": 0,
          "time": 0
        },
        "write": {
          "bytes": 0,
          "count": 0,
          "time": 0
        }
      }
    }

I am using metricbeat version 5.0.0-rc1 (amd64), libbeat 5.0.0-rc1.

[andrewkroh]

Is this for all drives? Or is it only for E:\? Is E:\ a CD-ROM? Are there any errors/warnings in Metricbeat log? What version of Windows are you running?

[stefanes]

Can confirm this behavior on all drives. I get the bytes (_system.diskio.write.bytes_ and _system.diskio.read.bytes_) but no times, ever.

Beats are running on several Windows Server 2008 SP1 and 2012 R2 machines. Same behavior with both version 5.3.0 and 5.4.0. No errors in the metricbeat log, and nothing obvious in the elasticsearch log either.

[consulthys]

@ruflin any status on this? we have a case where write.bytes is always > 0 but read.bytes is always = 0.
Appreciate your input on this, thanks in advance

[ruflin]

@consulthys I don't think any changes happened here. Any errors in the logs? Which Metricbeat version?

[consulthys]

@ruflin no errors in the logs, read.bytes is simply always 0, which is weird. I'm using Metricbeat 6.4.0

[wheelq]

Same issue here

[jsoriano]

@wheelq with what version of metricbeat and windows?

[wheelq]

latest :)

[jsoriano]

We take these values directly from Win32_PerfFormattedData_PerfDisk_LogicalDisk class. I have found some reports of people with the same problem, zero values when querying this class. We'd need to investigate it further to see if we can find some workaround.

[wheelq]

Ok. What would you like me to provide you in order to investigate

[bebeo92]

I also facing this issue, currently I using metricbeat latest 6 version with ES 5.6

[bebeo92]

@andrewkroh Is there any progress, this bug seem to be report so longggggggggggggggggggggggggggggggggggggggggggggggg

[narph]

@bebeo92, I suspect you might be hitting the file system cache in this case (https://docs.microsoft.com/en-us/windows/desktop/fileio/file-caching).
To rule this out (as I have encountered the same situation while reproducing), I suggest running any benchmark/performance monitoring tool (ex CrystalDiskMark) which will read/write directly on disk while you are collecting these metrics.
Keen to hear if the read/write values have increased and any additional details on your environment are more than welcome (os, type of disks, etc.)

[narph]

Replaced the current WMI query to get the system/diskio metrics for Windows
(SELECT * FROM Win32_PerfFormattedData_PerfDisk_LogicalDisk)
with DeviceIOControl Win32 API method using IOCTL_DISK_PERFORMANCE control code.
PR https://github.com/elastic/beats/pull/11635
Should reflect the rawinstead of the precalculatedperformance data from the counters that monitor logical partitions of a hard or fixed disk drive.

[bebeo92]

@andrewkroh sorry for late reply. I'm busy with other works
Currently I have 3 machine
1 have 16 core 32gb ram 1 ssd for os , 1 hdd
1 have 16 core 8gb ram 1 ssd for os
1 have 4 core 8gb ram 1 ssd for os , 1 hdd

All running on win 10

[bebeo92]

I saw there is a bug fix for it
One thing I forget to mention currently I using ES 5.x. I will try to test new package if it compatible with ES 5.x