This guide uses the https://github.com/martinlindhe/wmi_exporter package. A simple installation with process monitoring looks like this:
# powershell/pwsh:
msiexec /i "${env:USERPROFILE}\Downloads\wmi_exporter-0.9.0-amd64.msi" `
ENABLED_COLLECTORS="os,cpu,cs,logical_disk,net,service,system,textfile" `
--% EXTRA_FLAGS="--collector.process.processes-where=""Name LIKE 'node%'""" /qb
Multiple processes can be specified as follows:
--% EXTRA_FLAGS="--collector.service.services-where="Name='W32Time' or Name='RemoteRegistry'""
--% EXTRA_FLAGS="--collector.process.processes-where=\"Name LIKE 'conhost%'\""
--% EXTRA_FLAGS="--collector.process.processes-where="Name LIKE 'conhost%'""
Enabling the process collection with a process filter gives us the following metrics:
# HELP wmi_process_cpu_time_total Returns elapsed time that all of the threads of this process used the processor to execute instructions by mode (privileged, user). An instruction is the basic unit of execution in a computer, a thread is the object that executes instructions, and a process is the object created when a program is run. Code executed to handle some hardware interrupts and trap conditions is included in this count.
# TYPE wmi_process_cpu_time_total counter
wmi_process_cpu_time_total{creating_process_id="2920",mode="privileged",process="firefox",process_id="4144"} 14.679694099999999
wmi_process_cpu_time_total{creating_process_id="2920",mode="user",process="firefox",process_id="4144"} 54.60035
wmi_process_cpu_time_total{creating_process_id="4144",mode="privileged",process="firefox",process_id="1916"} 0.2340015
wmi_process_cpu_time_total{creating_process_id="4144",mode="privileged",process="firefox",process_id="4348"} 3.1980204999999997
wmi_process_cpu_time_total{creating_process_id="4144",mode="privileged",process="firefox",process_id="4444"} 1.8408118
wmi_process_cpu_time_total{creating_process_id="4144",mode="privileged",process="firefox",process_id="4760"} 0.1092007
wmi_process_cpu_time_total{creating_process_id="4144",mode="privileged",process="firefox",process_id="596"} 1.4820095
wmi_process_cpu_time_total{creating_process_id="4144",mode="user",process="firefox",process_id="1916"} 0.062400399999999995
wmi_process_cpu_time_total{creating_process_id="4144",mode="user",process="firefox",process_id="4348"} 4.2900275
wmi_process_cpu_time_total{creating_process_id="4144",mode="user",process="firefox",process_id="4444"} 13.5564869
wmi_process_cpu_time_total{creating_process_id="4144",mode="user",process="firefox",process_id="4760"} 0.2808018
wmi_process_cpu_time_total{creating_process_id="4144",mode="user",process="firefox",process_id="596"} 7.862450399999999
# HELP wmi_process_handle_count Total number of handles the process has open. This number is the sum of the handles currently open by each thread in the process.
# TYPE wmi_process_handle_count gauge
wmi_process_handle_count{creating_process_id="2920",process="firefox",process_id="4144"} 975
wmi_process_handle_count{creating_process_id="4144",process="firefox",process_id="1916"} 280
wmi_process_handle_count{creating_process_id="4144",process="firefox",process_id="4348"} 230
wmi_process_handle_count{creating_process_id="4144",process="firefox",process_id="4444"} 322
wmi_process_handle_count{creating_process_id="4144",process="firefox",process_id="4760"} 290
wmi_process_handle_count{creating_process_id="4144",process="firefox",process_id="596"} 322
# HELP wmi_process_io_bytes_total Bytes issued to I/O operations in different modes (read, write, other). This property counts all I/O activity generated by the process to include file, network, and device I/Os. Read and write mode includes data operations; other mode includes those that do not involve data, such as control operations.
# TYPE wmi_process_io_bytes_total counter
wmi_process_io_bytes_total{creating_process_id="2920",mode="other",process="firefox",process_id="4144"} 2.916329e+06
wmi_process_io_bytes_total{creating_process_id="2920",mode="read",process="firefox",process_id="4144"} 1.42778162e+08
wmi_process_io_bytes_total{creating_process_id="2920",mode="write",process="firefox",process_id="4144"} 1.57806965e+08
wmi_process_io_bytes_total{creating_process_id="4144",mode="other",process="firefox",process_id="1916"} 8392
wmi_process_io_bytes_total{creating_process_id="4144",mode="other",process="firefox",process_id="4348"} 1596
wmi_process_io_bytes_total{creating_process_id="4144",mode="other",process="firefox",process_id="4444"} 52804
wmi_process_io_bytes_total{creating_process_id="4144",mode="other",process="firefox",process_id="4760"} 8066
wmi_process_io_bytes_total{creating_process_id="4144",mode="other",process="firefox",process_id="596"} 17554
wmi_process_io_bytes_total{creating_process_id="4144",mode="read",process="firefox",process_id="1916"} 6.3781891e+07
wmi_process_io_bytes_total{creating_process_id="4144",mode="read",process="firefox",process_id="4348"} 8.5173184e+07
wmi_process_io_bytes_total{creating_process_id="4144",mode="read",process="firefox",process_id="4444"} 7.6326773e+07
wmi_process_io_bytes_total{creating_process_id="4144",mode="read",process="firefox",process_id="4760"} 6.4150849e+07
wmi_process_io_bytes_total{creating_process_id="4144",mode="read",process="firefox",process_id="596"} 6.6705539e+07
wmi_process_io_bytes_total{creating_process_id="4144",mode="write",process="firefox",process_id="1916"} 3120
wmi_process_io_bytes_total{creating_process_id="4144",mode="write",process="firefox",process_id="4348"} 1.02741e+07
wmi_process_io_bytes_total{creating_process_id="4144",mode="write",process="firefox",process_id="4444"} 7.98828e+06
wmi_process_io_bytes_total{creating_process_id="4144",mode="write",process="firefox",process_id="4760"} 33260
wmi_process_io_bytes_total{creating_process_id="4144",mode="write",process="firefox",process_id="596"} 2.254676e+06
# HELP wmi_process_io_operations_total I/O operations issued in different modes (read, write, other). This property counts all I/O activity generated by the process to include file, network, and device I/Os. Read and write mode includes data operations; other mode includes those that do not involve data, such as control operations.
# TYPE wmi_process_io_operations_total counter
wmi_process_io_operations_total{creating_process_id="2920",mode="other",process="firefox",process_id="4144"} 138689
wmi_process_io_operations_total{creating_process_id="2920",mode="read",process="firefox",process_id="4144"} 126324
wmi_process_io_operations_total{creating_process_id="2920",mode="write",process="firefox",process_id="4144"} 209322
wmi_process_io_operations_total{creating_process_id="4144",mode="other",process="firefox",process_id="1916"} 954
wmi_process_io_operations_total{creating_process_id="4144",mode="other",process="firefox",process_id="4348"} 480
wmi_process_io_operations_total{creating_process_id="4144",mode="other",process="firefox",process_id="4444"} 2362
wmi_process_io_operations_total{creating_process_id="4144",mode="other",process="firefox",process_id="4760"} 720
wmi_process_io_operations_total{creating_process_id="4144",mode="other",process="firefox",process_id="596"} 1321
wmi_process_io_operations_total{creating_process_id="4144",mode="read",process="firefox",process_id="1916"} 1081
wmi_process_io_operations_total{creating_process_id="4144",mode="read",process="firefox",process_id="4348"} 138428
wmi_process_io_operations_total{creating_process_id="4144",mode="read",process="firefox",process_id="4444"} 54615
wmi_process_io_operations_total{creating_process_id="4144",mode="read",process="firefox",process_id="4760"} 1497
wmi_process_io_operations_total{creating_process_id="4144",mode="read",process="firefox",process_id="596"} 24097
wmi_process_io_operations_total{creating_process_id="4144",mode="write",process="firefox",process_id="1916"} 41
wmi_process_io_operations_total{creating_process_id="4144",mode="write",process="firefox",process_id="4348"} 105988
wmi_process_io_operations_total{creating_process_id="4144",mode="write",process="firefox",process_id="4444"} 27834
wmi_process_io_operations_total{creating_process_id="4144",mode="write",process="firefox",process_id="4760"} 148
wmi_process_io_operations_total{creating_process_id="4144",mode="write",process="firefox",process_id="596"} 10802
# HELP wmi_process_page_faults_total Page faults by the threads executing in this process. A page fault occurs when a thread refers to a virtual memory page that is not in its working set in main memory. This can cause the page not to be fetched from disk if it is on the standby list and hence already in main memory, or if it is in use by another process with which the page is shared.
# TYPE wmi_process_page_faults_total counter
wmi_process_page_faults_total{creating_process_id="2920",process="firefox",process_id="4144"} 264504
wmi_process_page_faults_total{creating_process_id="4144",process="firefox",process_id="1916"} 9415
wmi_process_page_faults_total{creating_process_id="4144",process="firefox",process_id="4348"} 189677
wmi_process_page_faults_total{creating_process_id="4144",process="firefox",process_id="4444"} 137831
wmi_process_page_faults_total{creating_process_id="4144",process="firefox",process_id="4760"} 15697
wmi_process_page_faults_total{creating_process_id="4144",process="firefox",process_id="596"} 51761
# HELP wmi_process_page_file_bytes Current number of bytes this process has used in the paging file(s). Paging files are used to store pages of memory used by the process that are not contained in other files. Paging files are shared by all processes, and lack of space in paging files can prevent other processes from allocating memory.
# TYPE wmi_process_page_file_bytes gauge
wmi_process_page_file_bytes{creating_process_id="2920",process="firefox",process_id="4144"} 1.30433024e+08
wmi_process_page_file_bytes{creating_process_id="4144",process="firefox",process_id="1916"} 3.8977536e+07
wmi_process_page_file_bytes{creating_process_id="4144",process="firefox",process_id="4348"} 1.20631296e+08
wmi_process_page_file_bytes{creating_process_id="4144",process="firefox",process_id="4444"} 1.24407808e+08
wmi_process_page_file_bytes{creating_process_id="4144",process="firefox",process_id="4760"} 4.0787968e+07
wmi_process_page_file_bytes{creating_process_id="4144",process="firefox",process_id="596"} 5.4890496e+07
# HELP wmi_process_pool_bytes Pool Bytes is the last observed number of bytes in the paged or nonpaged pool. The nonpaged pool is an area of system memory (physical memory used by the operating system) for objects that cannot be written to disk, but must remain in physical memory as long as they are allocated. The paged pool is an area of system memory (physical memory used by the operating system) for objects that can be written to disk when they are not being used. Nonpaged pool bytes is calculated differently than paged pool bytes, so it might not equal the total of paged pool bytes.
# TYPE wmi_process_pool_bytes gauge
wmi_process_pool_bytes{creating_process_id="2920",pool="nonpaged",process="firefox",process_id="4144"} 92192
wmi_process_pool_bytes{creating_process_id="2920",pool="paged",process="firefox",process_id="4144"} 719736
wmi_process_pool_bytes{creating_process_id="4144",pool="nonpaged",process="firefox",process_id="1916"} 31616
wmi_process_pool_bytes{creating_process_id="4144",pool="nonpaged",process="firefox",process_id="4348"} 28848
wmi_process_pool_bytes{creating_process_id="4144",pool="nonpaged",process="firefox",process_id="4444"} 46984
wmi_process_pool_bytes{creating_process_id="4144",pool="nonpaged",process="firefox",process_id="4760"} 33280
wmi_process_pool_bytes{creating_process_id="4144",pool="nonpaged",process="firefox",process_id="596"} 39872
wmi_process_pool_bytes{creating_process_id="4144",pool="paged",process="firefox",process_id="1916"} 434776
wmi_process_pool_bytes{creating_process_id="4144",pool="paged",process="firefox",process_id="4348"} 623400
wmi_process_pool_bytes{creating_process_id="4144",pool="paged",process="firefox",process_id="4444"} 634176
wmi_process_pool_bytes{creating_process_id="4144",pool="paged",process="firefox",process_id="4760"} 456104
wmi_process_pool_bytes{creating_process_id="4144",pool="paged",process="firefox",process_id="596"} 601896
# HELP wmi_process_priority_base Current base priority of this process. Threads within a process can raise and lower their own base priority relative to the process base priority of the process.
# TYPE wmi_process_priority_base gauge
wmi_process_priority_base{creating_process_id="2920",process="firefox",process_id="4144"} 8
wmi_process_priority_base{creating_process_id="4144",process="firefox",process_id="1916"} 8
wmi_process_priority_base{creating_process_id="4144",process="firefox",process_id="4348"} 8
wmi_process_priority_base{creating_process_id="4144",process="firefox",process_id="4444"} 8
wmi_process_priority_base{creating_process_id="4144",process="firefox",process_id="4760"} 8
wmi_process_priority_base{creating_process_id="4144",process="firefox",process_id="596"} 8
# HELP wmi_process_private_bytes Current number of bytes this process has allocated that cannot be shared with other processes.
# TYPE wmi_process_private_bytes gauge
wmi_process_private_bytes{creating_process_id="2920",process="firefox",process_id="4144"} 1.30433024e+08
wmi_process_private_bytes{creating_process_id="4144",process="firefox",process_id="1916"} 3.8977536e+07
wmi_process_private_bytes{creating_process_id="4144",process="firefox",process_id="4348"} 1.20631296e+08
wmi_process_private_bytes{creating_process_id="4144",process="firefox",process_id="4444"} 1.24407808e+08
wmi_process_private_bytes{creating_process_id="4144",process="firefox",process_id="4760"} 4.0787968e+07
wmi_process_private_bytes{creating_process_id="4144",process="firefox",process_id="596"} 5.4890496e+07
# HELP wmi_process_start_time Time of process start.
# TYPE wmi_process_start_time gauge
wmi_process_start_time{creating_process_id="2920",process="firefox",process_id="4144"} 1.5768373864281e+09
wmi_process_start_time{creating_process_id="4144",process="firefox",process_id="1916"} 1.576839533348e+09
wmi_process_start_time{creating_process_id="4144",process="firefox",process_id="4348"} 1.5768373880869e+09
wmi_process_start_time{creating_process_id="4144",process="firefox",process_id="4444"} 1.5768373889119e+09
wmi_process_start_time{creating_process_id="4144",process="firefox",process_id="4760"} 1.5768373918231e+09
wmi_process_start_time{creating_process_id="4144",process="firefox",process_id="596"} 1.5768375480435e+09
# HELP wmi_process_thread_count Number of threads currently active in this process. An instruction is the basic unit of execution in a processor, and a thread is the object that executes instructions. Every running process has at least one thread.
# TYPE wmi_process_thread_count gauge
wmi_process_thread_count{creating_process_id="2920",process="firefox",process_id="4144"} 62
wmi_process_thread_count{creating_process_id="4144",process="firefox",process_id="1916"} 18
wmi_process_thread_count{creating_process_id="4144",process="firefox",process_id="4348"} 11
wmi_process_thread_count{creating_process_id="4144",process="firefox",process_id="4444"} 20
wmi_process_thread_count{creating_process_id="4144",process="firefox",process_id="4760"} 19
wmi_process_thread_count{creating_process_id="4144",process="firefox",process_id="596"} 20
# HELP wmi_process_virtual_bytes Current size, in bytes, of the virtual address space that the process is using. Use of virtual address space does not necessarily imply corresponding use of either disk or main memory pages. Virtual space is finite and, by using too much, the process can limit its ability to load libraries.
# TYPE wmi_process_virtual_bytes gauge
wmi_process_virtual_bytes{creating_process_id="2920",process="firefox",process_id="4144"} 8.05810176e+08
wmi_process_virtual_bytes{creating_process_id="4144",process="firefox",process_id="1916"} 4.18328576e+08
wmi_process_virtual_bytes{creating_process_id="4144",process="firefox",process_id="4348"} 4.4058624e+08
wmi_process_virtual_bytes{creating_process_id="4144",process="firefox",process_id="4444"} 6.17639936e+08
wmi_process_virtual_bytes{creating_process_id="4144",process="firefox",process_id="4760"} 4.54447104e+08
wmi_process_virtual_bytes{creating_process_id="4144",process="firefox",process_id="596"} 5.3682176e+08
# HELP wmi_process_working_set Maximum number of bytes in the working set of this process at any point in time. The working set is the set of memory pages touched recently by the threads in the process. If free memory in the computer is above a threshold, pages are left in the working set of a process even if they are not in use. When free memory falls below a threshold, pages are trimmed from working sets. If they are needed, they are then soft-faulted back into the working set before they leave main memory.
# TYPE wmi_process_working_set gauge
wmi_process_working_set{creating_process_id="2920",process="firefox",process_id="4144"} 1.94957312e+08
wmi_process_working_set{creating_process_id="4144",process="firefox",process_id="1916"} 3.6622336e+07
wmi_process_working_set{creating_process_id="4144",process="firefox",process_id="4348"} 3.7113856e+07
wmi_process_working_set{creating_process_id="4144",process="firefox",process_id="4444"} 1.33541888e+08
wmi_process_working_set{creating_process_id="4144",process="firefox",process_id="4760"} 4.2827776e+07
wmi_process_working_set{creating_process_id="4144",process="firefox",process_id="596"} 7.002112e+07