[metric/memory] use of wrong source for Windows swap calculations

[leehinman]

currently the windows memory module uses GlobalMemoryStatusEx to get the swap Total, Used & FreeBytes.

elastic-agent-system-metrics/metric/memory/memory_windows.go

Lines 33 to 49 in 5c1fcf2

	memoryStatusEx, err := windows.GlobalMemoryStatusEx()
	if err != nil {
	return memData, fmt.Errorf("error fetching global memory status: %w", err)
	}
	memData.Total = opt.UintWith(memoryStatusEx.TotalPhys)
	memData.Free = opt.UintWith(memoryStatusEx.AvailPhys)
	memData.Used.Bytes = opt.UintWith(memoryStatusEx.TotalPhys - memoryStatusEx.AvailPhys)
	// We shouldn't really be doing this, but we also don't want to make breaking changes right now,
	// and memory.actual is used by quite a few visualizations
	memData.Actual.Free = memData.Free
	memData.Actual.Used.Bytes = memData.Used.Bytes
	memData.Swap.Free = opt.UintWith(memoryStatusEx.AvailPageFile)
	memData.Swap.Total = opt.UintWith(memoryStatusEx.TotalPageFile)
	memData.Swap.Used.Bytes = opt.UintWith(memoryStatusEx.TotalPageFile - memoryStatusEx.AvailPageFile)

But GlobalMemoryStatusEx is really a syscall of procGlobalMemoryStatusEx which ends up being procGlobalMemoryStatusEx = modkernel32.NewProc("GlobalMemoryStatusEx")

And the documentation for MemoryStatusEx says that we should be using GetPerformanceInfo instead.

ullTotalPageFile

The current committed memory limit for the system or the current process, whichever is smaller, in bytes. To get the system-wide committed memory limit, call GetPerformanceInfo.

ullAvailPageFile

The maximum amount of memory the current process can commit, in bytes. This value is equal to or smaller than the system-wide available commit value. To calculate the system-wide available commit value, call GetPerformanceInfo and subtract the value of CommitTotal from the value of CommitLimit.

This can lead to Metricbeat showing an incorrect amount of swap, especially when swap is configured to be very small or zero.

[bczifra]

Related to: elastic/beats#19875