Use PDH native functions as alternative to Registry Calls

[jkroepke]

Reading the documentation about PerfCounter

• https://learn.microsoft.com/en-us/windows/win32/perfctrs/using-the-registry-functions-to-consume-counter-data
• https://learn.microsoft.com/en-us/windows/win32/perfctrs/using-the-pdh-functions-to-consume-counter-data

Microsoft highly recommends to fetch data via PHD function instead native registry. It seems like that PDH function are more performance.

We have issues like #724 and the exporter does not work well under load and the mentioned Zabbix exporter is using PDH functions, too. Also datadog and telegraf using PDF library.

Ref:

• https://github.com/zabbix/zabbix/blob/78774f702f8d222235c6e5a8b27db9490386c2e9/src/go/pkg/win32/pdh.go#L112
• https://github.com/DataDog/datadog-agent/blob/cdc12a377528f0604eaf8025c8377d2bf504762f/pkg/util/winutil/pdhutil/pdhhelper.go#L25
• https://github.com/influxdata/telegraf/blob/4c4b821aaa22cc48dc91412c10d2ef8e3fb9c7e3/plugins/inputs/win_perf_counters/pdh.go#L280

We should look into it, since the Registry supports V1 PerfCounter only, while the PDH functions support both V1 and V2.

Since telegraph is using the same OSS license, we should consider to use telegraf libraries as base instead starting from scratch. The OTEL collector is doing the same.

[breed808]

I'm very much in favour of moving to PDH, though I'm not currently in a position to implement and test this myself. Are you comfortable implementing this, if you have the time?

[jkroepke]

I play with PDH function today. However I got different values back. It seems like that the perfcounter exporter mutate the values (e.g. from 100ns to 1sec).

ref:

windows_exporter/pkg/perflib/unmarshal.go

Lines 87 to 94 in 470f5d5

	switch ctr.Def.CounterType {
	case PERF_ELAPSED_TIME:
	target.Field(i).SetFloat(float64(ctr.Value-WindowsEpoch) / float64(obj.Frequency))
	case PERF_100NSEC_TIMER, PERF_PRECISION_100NS_TIMER:
	target.Field(i).SetFloat(float64(ctr.Value) * TicksToSecondScaleFactor)
	default:
	target.Field(i).SetFloat(float64(ctr.Value))
	}

Additionally, I have no clue, what the "secondValue" is.

windows_exporter/pkg/perflib/perflib.go

Line 348 in 470f5d5

HasSecondValue: def.CounterType == averageCount64Type,

I can't find anything at the MS documentation and no clue, whats the source of windows_cpu_processor_rtc_total is.

[github-actions]

This issue has been marked as stale because it has been open for 90 days with no activity. This thread will be automatically closed in 30 days if no further activity occurs.

[jkroepke]

@breed808 I thought after the future use of PHD in favor registry based collectors.

Since we can't guarantee the exact metrics value between registry based collectors PHD, I had the idea the offer both source at once.

What did you think would be the best possible approach here?

• Dedicated collector, eg. cpu2, disk2, memory2 and leave the old one as is.
• Integrate a global toggle
• Integrate a separate toggle for each collector (similar to service collector)

---

Everyone else in the community is invited to provide feedback here.