WMIbeat

Welcome to WMIbeat. WMIbeat is a beat that allows you to run arbitrary WMI queries and index the results into elasticsearch so you can monitor Windows machines.

Ensure that this folder is at the following location: ${GOPATH}/github.com/eskibars

Getting Started with WMIbeat

To get running with WMIbeat, run "go build" and then run wmibeat.exe, as in the below run section. If you don't want to build your own, hop over to the "releases" page to download the latest.

Configuring

To configure the WMI queries to run, you need to change wmibeat.yml. Working from the default example:

queries:
- class: Win32_OperatingSystem
  period: 1m
  fields:
  - FreePhysicalMemory
  - FreeSpaceInPagingFiles
  - FreeVirtualMemory
  - NumberOfProcesses
  - NumberOfUsers
- class: Win32_PerfFormattedData_PerfDisk_LogicalDisk
  period: 10s
  fields:
  - Name
  - FreeMegabytes
  - PercentFreeSpace
  - CurrentDiskQueueLength
  - DiskReadsPerSec
  - DiskWritesPerSec
  - DiskBytesPerSec
  - PercentDiskReadTime
  - PercentDiskWriteTime
  - PercentDiskTime
  whereclause: Name != "_Total"
- class: Win32_PerfFormattedData_PerfOS_Memory
  namespace: root/CIMV2
  period: 10s
  fields:
  - CommittedBytes
  - AvailableBytes
  - PercentCommittedBytesInUse
- class: Win32_PerfFormattedData_Counters_ProcessorInformation
  period: 10s
  fields:
    - Name
    - name: PercentProcessorTime
      int: true
    - name: PercentProcessorUtility
      int: true
  whereclause: Name Like "%,_Total"

For each class we can define: the wmi namespace, the polling period, the fields and the whereclause. Fields can either be a string, or an object with a name and int boolean argumentc which if set to true will convert the string value returned from WMI to an integer value. This is useful for Win32_PerfFormattedData_Counters_ProcessorInformation where PercentProcessorTime and PercentProcessorUtility are returned as strings from WMI but are actually numerical values.

If there are multiple results, for any WMI class, WMIbeat will add the results as arrays. If you need some help with what classes/fields, you can try WMI Explorer. Note that many of the more interesting classes are "Perf" classes, which has a special checkbox to see in that tool.

Run

To run WMIbeat with debugging output enabled, run:

./wmibeat -c wmibeat.yml -e -d "*"

Build your own Beat

Beats is open source and has a convenient Beat generator, from which this project is based. For further development, check out the beat developer guide.