Skip to content
Examples for using Sonar metric collector with Prometheus, Akumuli and InfluxDB.
Branch: master
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
samples Updated docs for MySQL sample. Jan 18, 2018
visualization/grafana/dashboards Added Prometheus dashboard Nov 5, 2017
LICENSE Update LICENSE Aug 2, 2017 Updated readme with new repository location. Oct 8, 2018


This repository has been moved to GitLab. Please check latest releases and submit issues there.


Sonar is metric collection agent implemented using .NET Core integrated with time series databases. This repository contains configuration files for deploying Sonar using Docker. For deploying Sonar to Kuberenetes as sidecar, use Helm charts repository and configuration files. Sonar can gather metrics from:

  • WMI locally or remotely(using WS-Management protocol).
  • Relational data from SQL Server
  • Windows performance counters


While there are few choices avalable for collecting performance counters or generating exporter code for specific WMI metrics, Sonar offers configuration only approach with support for multiple types of TSDBs used at the same time. Sonar supports sending metrics to Prometheus and InfluxDb. Using InfluxDb is ideal for storing events collected by Sonar from Windows OS event logs.


Sonar collects metrics from WMI queries and sends them to time series databases. Metric collection from WMI has been tested with multiple Windows versions, including Win7(SP1) and Nano Server(TP5). It can simultaneously be integrated following TDSDBs:

  • InfluxDb - using UDP protocol.
  • Prometeus - as HTTP exporter scrape endpoint.

Deployment Scenarios

Sonar can be deployed as agent or sidecar(for monitoring multiple Windows containers on the same host):

  • Windows service - see Dockerfile in WebAPI example in this repository.
  • Docker container - docs.
  • Kubernetes pod - Sonar can be deployed as sidecar to Kubernetes. More information is in Sonar charts repository.


Docs are available at knowledge base


The WebAPi sample shows how to use Prometheus or InfluxDb to monitor Windows container (Nano Server) with IIS.


The below steps describe how to use Docker to create and deploy simple environment with Sonar, InfluxDb. Telegraf is optional to monitor performance metrics privided by Docker.


  1. Clone the repository.
  2. Review Sonar WebAPI sample configuration files and WMI queries in WQL.
  3. Deploy containers.

Windows Service

The following steps are required to run sonar (sonard stands for sonar daemon) locally:

  1. Download sonar bits and modify configuration files as shown in the examples.
  2. Use the following command to configure Windows service (named sonard):
  sc.exe create sonard binpath= <path>\Sonard.exe start= auto obj= LocalSystem depend= "WinRM"
  1. Start sonar daemon as windows service.




Sonar can be configured to run WMI query for any metric without code changes. Below example shows query for Windows processes:

     <add name="Win32_Process"
             filter="select * from Win32_Process"
             resource="*" namespace="root\cimv2">
                <add name="Name" value = "Name"/>
                 <add name="ThreadCount" value="CimType.UInt32"/>
                 <add name="HandleCount" value="CimType.UInt32"/>
                 <add name="VirtualSize" value="CimType.UInt64"/>
                 <add name="WorkingSetSize" value="CimType.UInt64"/>

For event logs, you can use additional expressions. In the below example, WMI query scans Windows event log entries made in past 30 seconds:

     <add name="EventLog_System"
            filter="select TimeGenerated,Message,EventCode,ComputerName,SourceName,EventType from Win32_NTLogEvent where TimeGenerated > timeshift(30s) and LogFile='System' and EventType!=0"
            resource="*" namespace="root\cimv2" 
                <add name="ComputerName" value = "ComputerName"/>
                <add name="SourceName" value = "SourceName"/>
                <add name="EventCode" value="CimType.UInt16" />
                <add name="EventType" value="CimType.UInt8" />


Sonar allows configuring one or more endpoints for running queries. Below is simple example:

    <add name="webapi-prom" url="" username="" password="" timeoutMilliseconds="1000" authType="Negotiate"/>


Each schedule maps query to a server and specifies polling interval:

    <add name="localProcesses" query="Win32_Process" server="webapi-prom"  intervalSeconds="10" />

For more information about configuring schedules and servers, see samples in this repository and our knowledge base.



To store metrics in InfluxDb, open CLI and create new database for storing collected metrics:

  create database sonar

Review configuration in the WebAPI sample. It uses uses UDP configuration to listen on port 8092 for receiving events from Sonar container and storing them in database named 'sonar'.


Create or update Prometheus job by adding new scrape endpoint hosted by Sonar. By default, Sonar uses configuration to determine port for http://host:port/metrics


WinRM can be configured to use Basic authentication using the following commands(run as Adminstrator):

  winrm quickconfig
  winrm set winrm/config/service/auth '@{Basic="true"}'

For non-production scenarios, WinRm can be configured to use HTTP:

  winrm set winrm/config/service '@{AllowUnencrypted="true"}'

The WinRM HTTPS listener can be configured to list certificates and set thumbprint for the HTTPS listener:

  Get-ChildItem -path cert:\LocalMachine\My\        
  winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname="<hostname>";CertificateThumbprint="<thumbprint>"}


The level of diagnostic logging can be configured for Sonar. This setting can be changed to 'Information' or 'Debug' for displaying low level diagnostics.

You can’t perform that action at this time.