procstat plugin does not work on Windows Server and pattern searches with WMI query

[Dubdelo]

Hello,
found a bug with monitoring a Windows process.
If you use pattern searches with forms of a WMI query.
It does not work with telegraf versions newer as v1.14.5.

Example Config (working with telegraf 1.14.5):

[[inputs.procstat]]
   pattern = "%tomcat%"
   pid_finder = "native"
   interval = "1m"

System info:

OS Windows Server 2016 / 2019
Version telegraf-1.14.5_windows_amd64.zip

Steps to reproduce:

1. Use telegraf 1.14.5 and setup a process to monitor like my example above
2. Now update telegraf to an newer version. With the WMI query, it says process is not running.

Configured as the readme says:
https://github.com/influxdata/telegraf/tree/master/plugins/inputs/procstat

Test output:

Telegraf 1.14.5

procstat_lookup,host=serverdev12,pattern=%tomcat%,pid_finder=native,result=success pid_count=3i,result_code=0i,running=3i 1606464960000000000

Telegraf 1.15.0

procstat_lookup,host=serverdev12,pattern=%tomcat%,pid_finder=native,result=success pid_count=0i,result_code=0i,running=0i 1606470057000000000

Telegraf 1.16.2

procstat_lookup,host=serverdev12,pattern=%tomcat%,pid_finder=native,result=success pid_count=0i,result_code=0i,running=0i 1606464970000000000

Telegraf 1.17.0

procstat_lookup,host=serverdev12,pattern=%tomcat%,pid_finder=native,result=success pid_count=0i,result_code=0i,running=0i 1606464970000000000

[Dubdelo]

any news on this bug?

[powersj]

Hi,

Sorry no one ever got back to you.

Would you be willing to reproduce with the latest telegraf?

Thanks

[Dubdelo]

Hi @powersj thanks for your reply

I thought nothing was going to happen here.
So iam surprised 😉

Unfortunately the problem still exists.
Tried with latest telegraf 1.23.3.

Failed output from test:

procstat_lookup,host=serverdev05,pattern=%spoolsv%,pid_finder=native,result=success pid_count=0i,result_code=0i,running=0i 1660289342000000000

Use older version telegraf 1.14.5 it works and I get the process count

procstat_lookup,host=serverdev05,pattern=%spoolsv%,pid_finder=native,result=success pid_count=1i,result_code=0i,running=1i 1660290073000000000

[powersj]

This took a bit of digging, but it appears that #7641 removed the ability to query based on WMI format. I was a bit confused when I started looking at this as the pattern you are giving is not a valid regex.

pattern = "%tomcat%"

Becuase the WMI parser was removed, the pattern you provide is directly read in as a Golang regular expression and in your case that becomes literally the string "%tomcat%", which probably won't match anything.

If I launch two vim instances on Windows 10 and run with your pattern, I also get 0 pid count and running. However, if I change it to vim or vim* I get the correct count of 2 for pid count and running.

I'm disappointed that it took nearly 2 years for someone to get back to you, but I believe if you update your pattern not to be a WMI format, this should begin to work again.

Thanks!

[Dubdelo]

@powersj thanks that trick works.
Sad that WMI filter was removed and no notice about that 😞

So you found the cause after such a long time 👍

So i close the issue