Sebastian Solnica edited this page Sep 10, 2016 · 16 revisions


Musketeer is a Windows Service responsible for monitoring applications on the server. Firstly it reads the configuration of the IIS and Windows services and confronts it with the configuration stored in Diagnostics Castle (to verify which applications should be monitored). For applications which are enabled it starts collecting performance data (from performance counters) and IIS logs (for web applications). The service and IIS configuration cached in Musketeer is refreshed every 30 minutes.


Download the Musketeer binaries from http://www.lowleveldesign.org/diagnosticskit. Unzip it to some folder (let's assume it's c:\tools\musketeer) and open the Musketeer.exe.config file in notepad.

You need to define the destination server for Musketeer logs. There are two options available (you may use both at the same time):

  • Diagnostics Castle
  • LogStash with Beats input enabled

To use the Diagnostics Castle output set the diagnosticsurl in the appsettings section with a valid url to the Diagnostics Castle, eg.:

  <add key="lowleveldesign.diagnostics.url" value="http://diagnostics.local/apps/" />

For LogStash you need to specify the LogStash server address, eg.:

  <add key="logstash:url" value="tcp://logstash.local:5000" />

If you want to send logs over SSL use ssl:// in place of tcp:// in the LogStash url.

Then run install.bat, which will install the LowLevelDesign.Diagnostics.Musketeer service and create a new LowLevelDesign-Diagnostics event log. After installation it will start the service. The example output might look as follows:

========= Installing Musketeer Service =========

Running a transacted installation.

Beginning the Install phase of the installation.
Installing service LowLevelDesign.Diagnostics.Musketeer...
Service LowLevelDesign.Diagnostics.Musketeer has been successfully installed.

The Install phase completed successfully, and the Commit phase is beginning.

The Commit phase completed successfully.

The transacted install has completed.

Starting the Musketeer service

Press any key to continue...


Simply run uninstall.bat from the Musketeer installation folder. The example output:

========= Uninstalling Musketeer Service =========

Stopping the Musketeer service

The uninstall is beginning.
Removing EventLog source LowLevelDesign.Diagnostics.Musketeer.
Service LowLevelDesign.Diagnostics.Musketeer is being removed from the system...

Service LowLevelDesign.Diagnostics.Musketeer was successfully removed from the s

The uninstall has completed.

Press any key to continue...

Other configuration options

All configuration of the musketeer service is done through the appSettings section. The table below describes available options.

Name Obligatory Type Description
lowleveldesign.diagnostics.url NO Url An url to the Diagnostics Castle
logstash:url NO Url An url to the LogStash service with a beats input listening (accepted schemes are tcp:// and ssl://). Example url might look as follows: tcp://localhost:5044. Also, if using SSL, make sure the remote server certificate is valid.
job:perf-monitor-cron NO Cron expression Defines how often Musketeer will collect values from performance counters (every 3 minutes by default)
job:iis-logs-read-cron NO Cron expression Defines how often Musketeer will read IIS applications logs (every minute by default)
exclude-services NO String Semicolon seperated list of regex expressions which are matched against service names and define which Windows services will be excluded from monitoring
include-services NO String Semicolon seperated list of regex expressions which are matched against service names and define which Windows services will be included in monitoring (exclusion list has higher priority)
include-http-success-logs NO true/false Musketeer will also send information about successful requests (i.e. requests with statuses 20x or 30x) retrieved from IIS application log files. WARNING: This will probably generate a much higher logs throughput. Make sure your log store is able to handle it and check Musketeer event log for warnings.
logstash:certthumb NO String The certificate which will be used to authenticate Musketeer to the logstash server (the certificate must be installed in the Personal cert store of the user under which the Musketeer service is running)

Logstash configuration

Musketeer works only with BEATS protocol, so in order to connect it to Logstash you need to allow this input in the Logstash configuration file, example:

input {
  beats {
    port => 5044
#    ssl => true
#    ssl_certificate => "c:\temp\logstash\logstash.pem"
#    ssl_key => "c:\temp\logstash\logstash.key"
#    ssl_key_passphrase => "test1234"

output {
  if [type] =~ "Musketeer.PerfCounter" {
    elasticsearch {
        index => "mperfstash-%{+YYYY.MM.dd}"
        template_name => "mperfstash"
  } else {
    file { path => "c:\temp\skipped.out" }
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.
Press h to open a hovercard with more details.