Michael Reggio

WinForwarder

Below is some sample output as shown under a Logstash debug.

Service Status Monitoring

{
     "@timestamp" => "2014-03-04T20:40:07.000+11:00",
          "@tags" => "[service]",
          "@type" => "WinForwarder",
       "@message" => "Service Report",
         "source" => "SERVICE",
    "source_host" => "VS2013",
        "WSearch" => {
        "displayname" => "Windows Search",
             "status" => "Running"
    },
       "@version" => "1",
           "host" => "127.0.0.1:3361"
}

Memory Status

{
     "@timestamp" => "2014-03-04T20:41:40.000+11:00",
          "@tags" => "[memory]",
          "@type" => "WinForwarder",
       "@message" => "Memory Report",
         "source" => "MEMORY",
    "source_host" => "VS2013",
        "details" => {
       "availablephysical" => "5741",
          "totalmemory" => "8191",
          "percentfree" => "70.089122207300695885728238310"
    },
       "@version" => "1",
           "host" => "127.0.0.1:3377"
}

CPU Status

{
     "@timestamp" => "2014-05-13T12:31:44Z",
          "@tags" => "[machinecpu]",
       "@version" => "1",
          "@type" => "WinForwarder",
       "@message" => "CPU Report",
         "source" => "CPU",
     source_host" => "VS2013",
        "details" => {
          "machinecpu0" => "0",
      "machinecpuuser0" => "0",
          "machinecpu1" => "2",
      "machinecpuuser1" => "6",
          "machinecpu2" => "0",
      "machinecpuuser2" => "0",
          "machinecpu3" => "2",
      "machinecpuuser3" => "0",
     "machinecpu_Total" => "0",
 "machinecpuuser_Total" => "1"
     }
}

Disk Space

{
     "@timestamp" => "2014-03-04T20:41:39.000+11:00",
          "@tags" => "[disk,space]",
          "@type" => "WinForwarder",
       "@message" => "Disk Space Report",
         "source" => "DISK",
    "source_host" => "VS2013",
      "disktotal" => {
        "C" => "64317550592"
    },
       "diskfree" => {
        "C" => "25263054848"
    },
       "@version" => "1",
           "host" => "127.0.0.1:3376"
}

Event Logs

{
     "@timestamp" => "2014-03-04T20:41:14.000+11:00",
          "@tags" => "[eventlog,Application]",
          "@type" => "WinForwarder",
       "@message" => "Service started successfully.",
         "source" => "WFService",
    "source_host" => "vs2013",
        "details" => {
             "id" => "0",
           "user" => "",
        "keyword" => "Information"
    },
       "@version" => "1",
           "host" => "127.0.0.1:3362"
}

{
     "@timestamp" => "2014-03-04T20:41:14.000+11:00",
          "@tags" => "[eventlog,System]",
          "@type" => "WinForwarder",
       "@message" => "The Win Forwarder service entered the running state.",
         "source" => "Service Control Manager",
    "source_host" => "vs2013",
        "details" => {
             "id" => "1073748860",
           "user" => "",
        "keyword" => "Information"
    },
       "@version" => "1",
           "host" => "127.0.0.1:3363"
}