Installing The Prometheus Exporter For Windows Clients

Prometheus is an open-source monitoring solution that our Linux team has been using for several years. More recently, we began using it for our Windows-based servers too. (I’ll post a writeup about Prometheus in the future)

One of the obstacles to implementing Prometheus monitoring on our Windows servers was finding and installing an agent. We ultimately decided to use the windows_exporter agent available in the Prometheus Community on GitHub. The exporter is free to use under an MIT license and supports an extensive list of WMI metrics that are grouped into Collectors.

The exporter’s msi installer is very simple (supports 7 parameters) and will only take a few seconds to complete. Of the supported parameters, ENABLED_COLLECTORS is the one that most people will need. This parameter specifies which metric collections are enabled (eg. IIS, MSSQL, Exchange, Active Directory, etc.). Note: installing unnecessary collectors (eg. MSSQL on a server without SQL Server installed) will result in errors being logged to the Application event log each time the collector is initiated (ie. every 30 seconds).

Using a PowerShell script to automate the (remote) installation of the exporter encountered a few minor issues. The first issue was the UAC prompt when executing the msi remotely. The second issue was scoping the exporter’s firewall rule (no IP restrictions by default). Another problem, that we discovered during testing, was that the windows_exporter service occasionally fails to auto-start after the server has been rebooted. Typically this occurs when the reboot is part of the monthly patching process. And the last issue was deciding how/where to stage the installer, so it could be run on the servers.

• Resolving the UAC prompt was accomplished by using an Invoke-Command script block to remotely start msiexec.exe on the Windows server using Start-Process with the ‘-Verb RunAs’.
• The service auto-start problem was resolved by extending the restart period to 5 minutes.
• The firewall exception was scoped to our local Prometheus server using the Get-NetFirewallRule and Set-NetFirewallAddressFilter PowerShell commandlets.
• Since the current and all previous versions of the exporter are included in the GitHub repo, we opted to download the installer at runtime. Using an InstallerPath parameter in the PowerShell script allowed us to specify the path to the current (internally preferred) stable version, but also allow people to specify a different installer version/path at run time.

<#
.SYNOPSIS
Installs Prometheus windows_exporter on Windows servers.

.PARAMETER $ServerName
Name of Window server to install windows_exporter on.

.PARAMETER $InstallerPath
Path and filename for installer

.PARAMETER $Collectors
Collectors to enable on the Windows server.

.PARAMETER $FirewallIP
IP of the Prometheus server collecting metrics

.EXAMPLE
Install-Windows_Exporter -ServerName TestServer
#>

Param(
    [string]$ServerName,
    [string]$InstallerPath = "https://github.com/prometheus-community/windows_exporter/releases/download/v0.18.0/windows_exporter-0.18.0-amd64.msi", 
    [string]$Collectors = "cpu,cs,logical_disk,net,os,service,system,textfile,memory,iis,mssql,exchange",
    [string]$FirewallIP = "192.168.10.120"
)
# Get installer filename from path
$InstallerFilename = Split-Path -Path $InstallerPath -Leaf;

Invoke-Command -ComputerName $ServerName -ScriptBlock {
    If ( -not (Test-Path -Path "C:\Temp")){   
        New-Item -Path "C:\" -Name "Temp" -ItemType "directory";
    }
    # Download installer to c:\temp folder
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 
    Invoke-WebRequest -Uri $using:InstallerPath -OutFile "c:\Temp\$using:InstallerFilename"
    # Run msiexec as Admin (UAC) to install exporter service
    $ArgStmt = "/i ""c:\Temp\$using:InstallerFilename"" ENABLED_COLLECTORS=""$using:Collectors""";
    Start-Process -FilePath msiexec.exe -ArgumentList $ArgStmt -Verb RunAs -Wait;
    # Remove installer 
    Remove-Item -Path "c:\Temp\$using:InstallerFilename" -Force;
    # Scope exporter firewall rule to Prometheus server IP
    Get-NetFirewallRule -DisplayName 'windows_exporter (HTTP )' | Get-NetFirewallAddressFilter | Set-NetFirewallAddressFilter -RemoteAddress $using:FirewallIP;
    # Modify exporter service to reset fail count after 1 day and restart service after 5 minutes to allow for server patching reboots
    Start-Process -FilePath sc.exe -ArgumentList "\\$using:ServerName failure windows_exporter reset=86400 actions=restart/300000" -Verb RunAs -Wait;
}