Windows service plugin - not detecting RPC service

1

We have been using the Windows service plugin on our mixed Windows environment(Windows 2008, 2012, 2016, & 2019).

Up to now we have not had any issues with this plugin. We create the custom.conf file and restart Telegraf; then start sending the metrics into Wavefront. We were creating a base conf file to send services in like Windows activation service and RPC service. For some reason this service is not detected by Telegraf. Just wondering where should start troubleshooting this issue.

Here is the conf file we are using:

[[inputs.win_services]]

Names of the services to monitor. Leave empty to monitor all the available services on the host. Globs accepted.

name_prefix = “prod.compute_services.machine_metrics.”
service_names = [
“Dhcp”,
“Dnscache”,
“LanmanServer”,
“lmhosts”,
“EventLog”,
“LanmanWorkstation”,
“WAS”,
“RpcSs”,
]

Also, I don’t see any errors in C:\Program Files\telegraf\telegraf.log indicating there is an error finding the service. Normally I would see something like this if the service was not found:

[inputs.win_services] could not open service: ‘WAS’: The specified service does not exist as an installed service.
2022-05-13T23:30:00Z E! [inputs.win_services] could not open service: ‘RabbitMQ’: The specified service does not exist as an installed service.
2022-05-13T23:30:00Z

Thanks in advance.

image
image605×693 60.6 KB

2

Ok, I found the root cause. It looks like some type of GPO is over-riding admin permissions and locking down services that run under the “network service” account. It’s good to know this isn’t a Telegraf issue but I think a GPO issue.

image
image604×699 28.3 KB

1 Like
3

The solution seems to be here :

You must have the SERVICE_QUERY_STATUS right.
More information about this right :