Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[IIS] [application_pool] Element Not Found for Application Pools with 'No Managed Code' #41596

Open
lucian-ioan opened this issue Nov 12, 2024 · 1 comment · May be fixed by #42274
Open

[IIS] [application_pool] Element Not Found for Application Pools with 'No Managed Code' #41596

lucian-ioan opened this issue Nov 12, 2024 · 1 comment · May be fixed by #42274
Assignees
@lucian-ioan @stefans-elastic
Labels
Team:Obs-InfraObs Label for the Observability Infrastructure Monitoring team

Comments

@lucian-ioan
Copy link
Contributor

lucian-ioan commented Nov 12, 2024 •
edited
Loading

Application pools configured with "No Managed Code" are for applications that do not use .NET's CLR (Common Language Runtime), such as PHP or native applications.

In this case, the .NET CLR counters such as Exceptions will not be associated with the w3wp process because those counters are specific to managed code environments. This leads to errors being thrown in the logs by metricbeat.

The goal of this issue is to bypass errors for those specific environments for counters, such as:

Element not found.failed to expand counter path (query= "%v")\.NET CLR Exceptions(w3wp*)\# of Finallys / sec
Element not found.failed to expand counter path (query= "%v")\.NET CLR Exceptions(w3wp*)\# of Exceps Thrown / sec
Element not found.failed to expand counter path (query= "%v")\.NET CLR Exceptions(w3wp*)\# of Exceps Thrown
Element not found.failed to expand counter path (query= "%v")\.NET CLR Exceptions(w3wp*)\# of Filters / sec
Element not found.failed to expand counter path (query= "%v")\.NET CLR Exceptions(w3wp*)\Throw To Catch Depth / sec
@lucian-ioan lucian-ioan added the Team:Obs-InfraObs Label for the Observability Infrastructure Monitoring team label Nov 12, 2024
@lucian-ioan lucian-ioan self-assigned this Nov 12, 2024
@stefans-elastic
Copy link
Contributor

I've researched this and here is what I've found out:

  • the error log comes from here
  • how it happens is:
  • GetCounterPaths gets called here
  • ExpandWildCardPath gets called in GetCounterPaths
  • GetCounterPaths returns PdhErrno(syscall.ERROR_NOT_FOUND) error
  • so back in GetCounterPaths there is no check for PdhErrno(syscall.ERROR_NOT_FOUND) error. Which results in Element not found. being logged.

The main question here is why PdhErrno(syscall.ERROR_NOT_FOUND) error is returned from ExpandWildCardPath and not one of PDH_CSTATUS_NO_COUNTER, PDH_CSTATUS_NO_COUNTERNAME, PDH_CSTATUS_NO_INSTANCE, PDH_CSTATUS_NO_OBJECT when there is no such counter? I'm not sure I have a good answer since I'm not really familiar with windows and .NET but it seems to me that the counter itself exists but has no data for w3wp process. And that is why syscall to PDH (specifically https://learn.microsoft.com/en-us/windows/win32/api/pdh/nf-pdh-pdhexpandwildcardpathw) doesn't return an error but also doesn't return any data.

I suggest adding a check for PdhErrno(syscall.ERROR_NOT_FOUND) error in this condition. I've tried doing so - Element not found.f logs go away.

P.S I'm not sure I've done a great job explaining everything so feel free to ask questions

@stefans-elastic stefans-elastic linked a pull request Jan 9, 2025 that will close this issue
Open
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@lucian-ioan lucian-ioan

@stefans-elastic stefans-elastic

Labels
Team:Obs-InfraObs Label for the Observability Infrastructure Monitoring team
Projects
None yet
Milestone
No milestone
2 participants
@lucian-ioan @stefans-elastic