missing IIS net_clr appPoolCounters

[AlexDF2017]

Hi all, on a fresh installation of metricbeat 7.17.24 under Windows Server 2022, IIS metricbeat module activated, we have the following repeating errors in metricbeat logs:

2024-10-21T20:05:42.285+0200	ERROR	[application_pool]	application_pool/reader.go:106	Element not found.failed to expand counter path (query= "%v")\.NET CLR Exceptions(w3wp*)\# of Exceps Thrown
2024-10-21T20:05:42.285+0200	ERROR	[application_pool]	application_pool/reader.go:106	Element not found.failed to expand counter path (query= "%v")\.NET CLR Exceptions(w3wp*)\# of Filters / sec
2024-10-21T20:05:42.288+0200	ERROR	[application_pool]	application_pool/reader.go:106	Element not found.failed to expand counter path (query= "%v")\.NET CLR Exceptions(w3wp*)\# of Exceps Thrown / sec
2024-10-21T20:05:42.288+0200	ERROR	[application_pool]	application_pool/reader.go:106	Element not found.failed to expand counter path (query= "%v")\.NET CLR Exceptions(w3wp*)\Throw To Catch Depth / sec
2024-10-21T20:05:42.290+0200	ERROR	[application_pool]	application_pool/reader.go:106	Element not found.failed to expand counter path (query= "%v")\.NET CLR Exceptions(w3wp*)\# of Finallys / sec

It seems that all net_clr appPoolCounters aren't available on OS, how to fix? No particular requirement is reported on metricbeat installation documentation for IIS monitoring.

[lucian-ioan]

Hi @AlexDF2017,

Firstly, make sure ASP.NET is installed as this might be similar to: elastic/integrations#7992

Let me know if you still encounter the error afterwards.

[AlexDF2017]

Hi @lucian-ioan , sorry but we had already installed the required features & roles, the same as indicated in elastic/integrations#7992. We rebooted the server after installation to be sure, but the problem is the same,

To confirm:

2024-10-23T13:56:38.714+0200	ERROR	[application_pool]	application_pool/reader.go:106	Element not found.failed to expand counter path (query= "%v")\.NET CLR Exceptions(w3wp*)\# of Finallys / sec
2024-10-23T13:56:38.717+0200	ERROR	[application_pool]	application_pool/reader.go:106	Element not found.failed to expand counter path (query= "%v")\.NET CLR Exceptions(w3wp*)\# of Exceps Thrown
2024-10-23T13:56:38.717+0200	ERROR	[application_pool]	application_pool/reader.go:106	Element not found.failed to expand counter path (query= "%v")\.NET CLR Exceptions(w3wp*)\# of Filters / sec
2024-10-23T13:56:38.719+0200	ERROR	[application_pool]	application_pool/reader.go:106	Element not found.failed to expand counter path (query= "%v")\.NET CLR Exceptions(w3wp*)\# of Exceps Thrown / sec
2024-10-23T13:56:38.719+0200	ERROR	[application_pool]	application_pool/reader.go:106	Element not found.failed to expand counter path (query= "%v")\.NET CLR Exceptions(w3wp*)\Throw To Catch Depth / sec

[lucian-ioan]

Thanks for confirming, I have already tried to replicate this with our existing virtual machine running IIS with no luck.

I'll try setting up a new VM from scratch and come back to you on this.

[yomduf]

Hello @lucian-ioan , were you able to reproduce the problem ?

[lucian-ioan]

Hi @yomduf

We will likely change the beats code so such errors are no longer logged.

The errors you are encountering in the Metricbeat logs occur because the .NET CLR Exceptions performance counters are being queried, but they are not available for the w3wp process in your environment.

This is different on servers where IIS runs application pools with the .NET CLR Version set to "v4.0" instead of "No Managed Code" as on those servers the .NET CLR counter categories do show w3wp.

[yomduf]

Thanks @lucian-ioan !

[lucian-ioan]

This was solved in #42274. Closing this issue.