Metricbeat shows swap usage after disabling Windows paging file

[ErnestoBezanilla]

Reproduced with 7.5 / 7.6 + Win 2016 Server / Win 10

After disabling the paging file on Windows systems via System Properties → Advanced → Performance → Advanced → Virtual memory metricbeat still shows swap usage.

Current library version gets swap info from the windows syscall GlobalMemoryStatusEx. Newer versions of the library have switched to an alternate approach, using the Windows system utility wmic, i.e. wmic pagefile list full

[elasticmachine]

Pinging @elastic/integrations-services (Team:Services)

[elasticmachine]

Pinging @elastic/integrations-platforms (Team:Platforms)

[narph]

@ErnestoBezanilla I had a look at the type of information GlobalMemoryStatusEx returns and it looks like this:

ullTotalPageFile The current committed memory limit for the system or the current process, whichever is smaller, in bytes.

ullAvailPageFile The maximum amount of memory the current process can commit, in bytes. This value is equal to or smaller than the system-wide available commit value.

The committed memory limit here could be thought as the maximum potential pagefile usage if pagefile is enabled and it will still be counted in systems with no pagefile.
Either way, it does not seem to reflect the current pagefile usage.

I would not go on the wmic path since we had cpu and memory high usage issues in the past but it looks like another option might be the using the '\Paging File(*)\% Usage' performance counters.

At the moment users can try the windows/perfmon metricset to get this information.

That said, the documentation should either be clarified on the windows side or a new implementation should be considered here.

[martinscholz83]

The ullTotalPageFile is the physical RAM + pagefile.sys. I think the only way to detect how much of the swap memory is used, is to check with performance counters. Because although you have enough free physical memory windows is still using the pagefile for internal stuff. So the calculation in metricbeat doesn't reflect the swap usage at all instead the whole memory usage.

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!