Skip to content

Windows

Setup your collectors!

Epoch Windows collectors can only be run in non-containerized environments. Only one collector is needed per host (VM or bare metal OS). Please follow the environment specific installation instructions below.

About

  • If you are viewing this documentation outside of the Epoch AOC, you may need to fill in untemplated variables in some of the steps below.
  • If you are running behind a load balancer, you will need to use the private IP address instead of the hostname ${host}.

(Consult Supported Platforms and Collector Requirements before installing.)

Installation

This section provides instructions for installation of collectors on Windows.

Download the Windows Collector installer from the below url:
https://repo.epoch.nutanix.com/stable/epoch-collectors-1.12.9-1-x86_64.msi

Note: Do not double click on the downloaded MSI. Run the commands below as an administrator using admin command prompt.

Installation modes of collectors

Epoch Windows Collector can be installed in two modes, basic and advanced.

1. Basic installation mode (Default) with EPOCH_ROLE as infra_only.

This will install and run components to monitor your infrastructure, processes, services and various out of the box integrations.

  msiexec /qb /i epoch-collectors-1.12.9-1-x86_64.msi /l*v "install.log" ^
  EPOCH_ORGANIZATION_ID=${organizationId} ^
  EPOCH_ROLE=infra_only ^
  EPOCH_RUN_PRESTART_SCRIPT=no ^
  DEPLOY_ENV=bare-metal ^
  EPOCH_DD_AGENT_LISTEN_PORT=17130 ^
  EPOCH_ENABLE_SSLSPLIT=no ^
  EPOCH_AUTOUPGRADE_COLLECTORS=no ^
  EPOCH_AOC_HOST=${your_epoch_host}

Note: If EPOCH_ROLE isn’t explicitly provided as part of the above command line parameters , Installation would proceed in the default infra_only mode.

2. Advanced installation mode with EPOCH_ROLE as collector.

This will install and run components to monitor and analyze IP traffic in your network.

Prerequisites for Advanced Mode installation

Collector in Advanced Mode requires Win10Pcap Service to capture the IP traffic and a "Stream Processor" to analyze the captured traffic.

1. Win10Pcap

To verify status of Win10Pcap on host run the following cmd from administrator cmd prompt

  #win10pcap status 
  sc query win10pcap

Win10pcap service should show in running state on host.

If win10pcap service is missing , win10Pcap isn’t installed on host. Use the below link to download win10pcap and install it on the host.

Download win10pcap

2. Stream Processor

The "Stream Processor" is a collector with EPOCH_ROLE set to "sp". Set up a standalone "Stream Processor" in any of the supported Linux Platforms as described in standalone stream processor. Information about the host and port of the Stream Processor is required in following steps.

While installing the Windows Collector in Advanced Mode, following should be provided as inputs:

EPOCH_SP_HOST_OVERRIDE = your_sp_host which refers to the ip address of Linux machine running Stream Processor.

  msiexec /qb /i epoch-collectors-1.12.9-1-x86_64.msi /l*v "install.log" ^
  EPOCH_ORGANIZATION_ID=${organizationId} ^
  EPOCH_SP_HOST_OVERRIDE=<replace_sp_host> ^
  EPOCH_SP_PORT_OVERRIDE=2005 ^
  EPOCH_ROLE=collector ^
  EPOCH_RUN_PRESTART_SCRIPT=no ^
  DEPLOY_ENV=bare-metal ^
  EPOCH_DD_AGENT_LISTEN_PORT=17130 ^
  EPOCH_ENABLE_SSLSPLIT=no ^
  EPOCH_AUTOUPGRADE_COLLECTORS=no ^
  EPOCH_AOC_HOST=${your_epoch_host} ^
  EPOCH_ANALYSIS_DEPTH=Layer7

Please refer to the following links for more information about collection only mode and standalone stream processor

Configuration

Epoch-dd-agent configuration file is located at

C:\ProgramData\nutanix\epoch-dd-agent\datadog.conf

Configuration files for various off-the-shelf integrations are in

C:\ProgramData\nutanix\epoch-dd-agent\conf.d\

Note: ProgramData is a hidden folder.

Refer Integrations section on left-side pane for enabling. Restart Epoch collector after making changes in above files to take effect.

sc stop epochagent
sc start epochagent

Viewing Information

Navigate to Dashboards tab on left-side pane. Select Windows dashboard.

Protip: Once on windows dashboard choose filter instance.host_name:xxxx for viewing data for specific host.

Some of the metrics collected in basic mode are listed below. This is not an exhaustive list, once you enable different integrations in collector , you would start seeing new metrics .

Category Metrics initials Description
Cpu cpu* cpu related metrics like idle, user, interrupt,etc
Disk system.disk.* Disk related metrics like free, total, used, etc
Network system.net.* Network related metrics like bytes_rcvd, bytes_sent etc
Memory memPhys* Memory related metrics like total, usable, free etc
Io system.io.* Io operations metrics like rkB/s, wkB/s etc
System Load system.load.1 Refers to processor queue length
Processes system.processes.* Metrics for processes enabled in process.yaml

Disclaimer: cpuWait is calculated from cpuInterrupt time.

Note: All the metrics collected from Windows Collector can be filtered with a special tag instance.tags.epoch_platform:windows. This tag can be used to filter Windows exclusive data while querying metrics in Analytics Sandbox, creating Alerts or creating custom dashboards.

Troubleshooting

Check if collector is running.

sc query epochagent

Stop collector

sc stop epochagent

Start collector

sc start epochagent

Logs are located at below locations

C:\ProgramData\nutanix\epoch-dd-agent\logs
C:\ProgramData\nutanix\epoch-collectors\logs

Reporting Troubleshooting Information

If you are having issues with your collectors, execute the following from a Command Prompt as an Administrator. It will gather troubleshooting information about the collectors, as well as any necessary logs.

  1. Generate the zip file.
powershell -ExecutionPolicy Bypass -File "C:\Program Files\nutanix\epoch\collectors\windows-inspect.ps1"

The zip file is created in the %SystemRoot%\Temp directory for example ("C:\Windows\Temp"), and the file name begins with epochcollectorsinspection_yyyy-MM-dd_HH-mm-ss.

  1. Send the zip file to Epoch support through email at epoch-support@nutanix.com

Uninstallation

To uninstall the collectors, do the following:

msiexec /qb  /x epoch-collectors-1.12.9-1-x86_64.msi

or alternatively Control Panel -> Programs -> uninstall program -> select Epoch Agent