perfmon - remove negative counter value errors from the event output

[narph]

What does this PR do?

• ignores PDH_CALC_NEGATIVE_VALUE and PDH_INVALID_DATA type errors from the event output
• adds cstatus value in the debug information

Why is it important?

When collecting a high number of counters values seems that for specific processes the counter values retrieved are negative and the win32 api returns the error:

0x800007D8 (PDH_CALC_NEGATIVE_VALUE) | A counter with a negative value was detected.

or

0xC0000BC6 (PDH_INVALID_DATA) | The data is not valid. with cstatus 0xC0000BBA (PDH_CSTATUS_INVALID_DATA) | The returned data is not valid.

Which means the counter was successfully found, but the data returned is not valid. This error can occur if the counter value is less than the previous value. (Because counter values always increment, the counter value rolls over to zero when it reaches its maximum value.) Another possible cause is a system timer that is not correct.

These errors do not cause the application to run unsuccessfully and the following calls return a positive value.
These types of errors are still logged as debug messages.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

Create a perfmon configuration with a high number of perfmon counters including Process object counters since the errors are encountered only at that level and run the perfmon metricset with a small interval.

Related issues

• Closes windows/perfmon metricset - handle win32 api errors in the events #18292

Logs

	Line 236493: 2020-05-07T18:18:27.118+0200	DEBUG	[perfmon]	perfmon/data.go:51	Counter value retrieval returned	{"error": "A counter with a negative value was detected.", "cstatus": "A counter with a negative value was detected.", "perfmon": {"query": "\\\\DESKTOP-RFOOE09\\Process(SearchFilterHost)\\IO Other Bytes/sec"}}
	Line 236494: 2020-05-07T18:18:27.144+0200	DEBUG	[perfmon]	perfmon/data.go:51	Counter value retrieval returned	{"error": "A counter with a negative value was detected.", "cstatus": "A counter with a negative value was detected.", "perfmon": {"query": "\\\\DESKTOP-RFOOE09\\Process(SearchFilterHost)\\% Processor Time"}}
	Line 273453: 2020-05-07T18:18:42.141+0200	DEBUG	[perfmon]	perfmon/data.go:51	Counter value retrieval returned	{"error": "The data is not valid.", "cstatus": "The returned data is not valid.", "perfmon": {"query": "\\\\DESKTOP-RFOOE09\\Process(backgroundTaskHost)\\IO Read Bytes/sec"}}
	Line 273454: 2020-05-07T18:18:42.159+0200	DEBUG	[perfmon]	perfmon/data.go:51	Counter value retrieval returned	{"error": "The data is not valid.", "cstatus": "The returned data is not valid.", "perfmon": {"query": "\\\\DESKTOP-RFOOE09\\Process(backgroundTaskHost)\\IO Write Operations/sec"}}

[elasticmachine]

Pinging @elastic/integrations (Team:Integrations)

[elasticmachine]

💚 Build Succeeded

Expand to view the summary

Build stats

• Build Cause: [Pull request perfmon - remove negative counter value errors from the event output #18361 updated]

• Start Time: 2020-05-12T10:45:08.729+0000

• Duration: 71 min 53 sec (4253435)

Test stats 🧪

Test	Results
Failed	0
Passed	3022
Skipped	756
Total	3778

[ChrsMark]

Overall looks good to me. Left only some minor comments.