[x-pack][metricbeat][iis] improve error handling on pdh counters in a…

…pplication_pool data stream (#42274) (#42313) * [x-pack][metricbeat][iis] improve error handling on pdh counters in application_pool data stream * change error checking to errors.Is * update CHANGELOG-developer.next.asciidoc * improve error handling * add comments to the changes (cherry picked from commit a3cefc0) Co-authored-by: stefans-elastic <[email protected]>
elastic · Jan 15, 2025 · 9187331 · 9187331
1 parent dcfd194
commit 9187331
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 5 deletions.
diff --git a/CHANGELOG-developer.next.asciidoc b/CHANGELOG-developer.next.asciidoc
@@ -109,6 +109,7 @@ The list below covers the major changes between 7.0.0-rc2 and main only.
 - Fix flaky test in cel and httpjson inputs of filebeat. {issue}40503[40503] {pull}41358[41358]
 - Fix documentation and implementation of raw message handling in Filebeat http_endpoint by removing it. {pull}41498[41498]
 - Fix flaky test in filebeat Okta entity analytics provider. {issue}42059[42059] {pull}42123[42123]
+- Fix IIS module logging errors in case application pool PDH counter is not found. {pull}42274[42274]
 
 ==== Added
 

diff --git a/x-pack/metricbeat/module/iis/application_pool/reader.go b/x-pack/metricbeat/module/iis/application_pool/reader.go
@@ -10,6 +10,7 @@ import (
 	"errors"
 	"fmt"
 	"strings"
+	"syscall"
 
 	"github.com/elastic/beats/v7/metricbeat/helper/windows/pdh"
 	"github.com/elastic/elastic-agent-libs/mapstr"
@@ -111,16 +112,27 @@ func (r *Reader) initAppPools() error {
 		r.log.Info("no running application pools found")
 		return nil
 	}
+	// Helper function to identify known PDH errors, such as missing counters or instances.
+	// These errors are expected in certain cases (e.g. "No Managed Code" environments).
+	isPDHError := func(err error) bool {
+		return errors.Is(err, pdh.PdhErrno(syscall.ERROR_NOT_FOUND)) ||
+			errors.Is(err, pdh.PDH_CSTATUS_NO_COUNTER) ||
+			errors.Is(err, pdh.PDH_CSTATUS_NO_COUNTERNAME) ||
+			errors.Is(err, pdh.PDH_CSTATUS_NO_INSTANCE) ||
+			errors.Is(err, pdh.PDH_CSTATUS_NO_OBJECT)
+	}
 	var newQueries []string
 	r.workerProcesses = make(map[string]string)
 	for key, value := range appPoolCounters {
 		childQueries, err := r.query.GetCounterPaths(value)
 		if err != nil {
-			if errors.Is(err, pdh.PDH_CSTATUS_NO_COUNTER) || errors.Is(err, pdh.PDH_CSTATUS_NO_COUNTERNAME) || errors.Is(err, pdh.PDH_CSTATUS_NO_INSTANCE) || errors.Is(err, pdh.PDH_CSTATUS_NO_OBJECT) {
+			// Handle known PDH errors as informational (e.g. missing counters).
+			if isPDHError(err) {
 				r.log.Infow("Ignoring non existent counter", "error", err,
-					logp.Namespace("application pool"), "query", value)
+					logp.Namespace("application pool"), "query", value,
+				)
 			} else {
-				r.log.Error(err, `failed to expand counter path (query= "%v")`, value)
+				r.log.Errorf(`failed to expand counter path (query= "%v"): %w`, value, err)
 			}
 			continue
 		}
@@ -210,7 +222,6 @@ func (r *Reader) mapEvents(values map[string][]pdh.CounterValue) map[string]mb.E
 					}
 				}
 			}
-
 		}
 	}
 	return events
@@ -227,7 +238,7 @@ func getApplicationPools(names []string) ([]ApplicationPool, error) {
 	if err != nil {
 		return nil, err
 	}
-	var appPools = make(map[string][]int)
+	appPools := make(map[string][]int)
 	for key, value := range processes {
 		appPools[value] = append(appPools[value], key)
 	}