banshee/windows-collection/windows/ssh/diskio

Disk activity of a Windows, by SSH

Returns, for each physical disk of a Windows, the operations and the throughput of reads and writes, the mean wait of an operation, the share of time the disk was busy and the operations waiting in its queue. Four watches are proposed, each one set on the probe. The space of the volumes is the collector windows/ssh/volumes.

Versions

Windows Server 2012 and later, Windows 8 and later: Windows PowerShell 3.0, which the collector needs, ships with each of them; the OpenSSH server is built in from Windows Server 2019 and Windows 10 1809, installed from Win32-OpenSSH before. Generic: no folder of version. That every release answers alike is assumed, not yet checked on a real Windows.

How it works

The collector runs one PowerShell command that reads the raw counters of Win32_PerfRawData_PerfDisk_PhysicalDisk, one object per physical disk:

powershell -NoProfile -NonInteractive -Command "ConvertTo-Json -Compress -InputObject @(Get-CimInstance Win32_PerfRawData_PerfDisk_PhysicalDisk | Select-Object Name, DiskReadsPerSec, DiskWritesPerSec, DiskReadBytesPerSec, DiskWriteBytesPerSec, AvgDiskSecPerRead, AvgDiskSecPerRead_Base, AvgDiskSecPerWrite, AvgDiskSecPerWrite_Base, PercentIdleTime, CurrentDiskQueueLength, Timestamp_Sys100NS, Frequency_PerfTime)"

Each counter adds up since boot; the collector returns its rate between two runs: - operations per second, from DiskReadsPerSec and DiskWritesPerSec; - throughput, from DiskReadBytesPerSec and DiskWriteBytesPerSec, in MiB/s; - the mean wait of an operation, from AvgDiskSecPerRead (the waits added up, in ticks of Frequency_PerfTime) over AvgDiskSecPerRead_Base (the operations), in ms; the same for writes; - the busy share, 1 − idle / clock, from PercentIdleTime against the clock Timestamp_Sys100NS.
CurrentDiskQueueLength is not a counter: the operations waiting at the time of the reading.
The raw counters, not the formatted ones: a formatted rate needs two samples taken by the same process, and each run starts a new PowerShell. Their names are English whatever the language of Windows.
A disk is named as Windows names it, its number then the letters of its volumes: 0 C:, 1 D: E:. The _Total object is left out.
The first run has no interval yet: it is skipped. So is a run where every disk had a counter going backwards.
No disk at all, or an answer that is not the expected JSON, stops the collector as misconfigured: never a green light without a measure.

Nothing is written to the Windows: the command only reads.

Prerequisites

The OpenSSH server of Windows, installed and started: - on Windows Server 2019 and later, Windows 10 (version 1809 and later) and Windows 11, where it is built in: the optional feature "OpenSSH Server" (Settings, Optional features; or Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 in PowerShell), then the service sshd started and set to start automatically; - on Windows Server 2012, 2012 R2 and 2016, Windows 8, 8.1 and the earlier Windows 10, where it is not built in: OpenSSH for Windows installed from its Microsoft release (Win32-OpenSSH), then the service sshd started and set to start automatically.
The default shell of the OpenSSH server left at cmd.exe, as it is installed: the collector starts PowerShell itself, and a command meant for cmd.exe would be read differently by a PowerShell default shell.
Windows PowerShell 3.0 or later, as shipped with every Windows from Server 2012 and Windows 8 on (3.0 on Server 2012, 4.0 on 2012 R2, 5.1 from 2016 on).
An account for monitoring, without administrator rights, member of the local groups "Performance Monitor Users" and "Event Log Readers", so that the performance counters and the System log are not refused to it. banshee reads it in protocol:ssh:user, with its password in protocol:ssh:password or its key in protocol:ssh:private-key (the public key then in C:\Users\<account>.ssh\authorized_keys).
The fingerprint of the server's host key, set in protocol:ssh:fingerprint (on the server, C:\ProgramData\ssh\ssh_host_ed25519_key.pub); not needed when the Security settings trust the first SSH fingerprint presented.
The Windows firewall open to the poller on TCP 22 (the rule "OpenSSH SSH Server (sshd)", created with the feature).

Outputs

Name	Label	Unit	Per instance
`read-iops`	Reads	op/s	yes, per disk
`write-iops`	Writes	op/s	yes, per disk
`read-rate`	Read throughput	MiB/s	yes, per disk
`write-rate`	Write throughput	MiB/s	yes, per disk
`read-wait`	Mean read wait	ms	yes, per disk
`write-wait`	Mean write wait	ms	yes, per disk
`busy`	Busy time	%	yes, per disk
`queue`	Operations in the queue	—	yes, per disk

Watches

Name	Title	Kind	Defaults	Checked by default
`read-latency`	Slow reads	above a threshold, on `read-wait`	warning above 50 ms, critical above 200 ms, for 5 min	yes
`write-latency`	Slow writes	above a threshold, on `write-wait`	warning above 50 ms, critical above 200 ms, for 5 min	yes
`busy`	Disk saturated	above a threshold, on `busy`	warning above 90 %, for 10 min; no critical	no
`queue-long`	Long disk queue	above a threshold, on `queue`	no threshold: to set on the probe; for 5 min	no

Limits

Values arrive from the second run on; a probe whose interval is long averages over it.
The busy share only means something for a disk that serves one operation at a time: an SSD, or a volume of a disk array, at 100 % may still serve many more.
The wait of a read or a write only exists if there was one during the interval: a disk that did not read returns no read wait.
WMI declares the wait counters on 32 bits: a counter that wraps around between two runs gives no wait for that run.
The queue is a moment, read once per run.