How to monitor a Windows server with an agent

You monitor a Windows server with inping through an agent that one PowerShell command sets up as a Windows service. It reports CPU, memory, disks and scheduled tasks, runs under the virtual account NT SERVICE\inping-agent and needs no open port. After the start it appears in inping within a minute.

What do you see afterwards?

• Under Agents: hostname and system, status Online and the gauges for CPU, memory and disks.
• The agent's overview: the history of these values, version, architecture and cores.
• Jobs: the tasks from Windows Task Scheduler with schedule, command and user.
• Project → Packages: runtimes and packages of the projects on the server, read from the lock files, for example NuGet, Composer or npm. Known vulnerabilities appear within a day.
• Accounts: CPU, memory and processes per account, if you use the -AccountMetrics switch (see below).

Not reported on Windows: the load average, installed programs and host packages. Disks and network per account are not measured either.

What matters on a Windows server?

• CPU: individual spikes, from updates or the virus scanner for instance, are normal. What tells you something is high usage over several minutes, which is why inping by default only alerts after 5 minutes above 90%.
• Memory: inping calculates total minus available. Staying above 90% means that Windows increasingly falls back on the page file and applications slow down. Depending on its settings, SQL Server takes a lot of memory on its own; on such a server, adjust the limit.
• Disks: full drives stop databases and Windows updates. The default of 90% applies to every drive and immediately. On a small system partition a rule with a lower value is worthwhile.
• Availability: the agent reports the host, not the website on it. Whether IIS serves a page is checked by the runners over HTTP(S) when you enter the URL in the project.

Requirements

• Windows Server 2019 or newer, Windows 10 or 11, on x64 or ARM64
• PowerShell 5.1 or 7, started as administrator
• outgoing HTTPS to www.inping.io on port 443; the script and download use TLS 1.2 and follow no redirects
• a running Windows Time service: reports more than 60 seconds ahead of the platform's clock are rejected
• a free inping account

Step by step

1. Create the agent and copy the command

In inping under Agents → Add agent or in the project under Servers → Add agent. The dialog shows the registration token exactly once, and it is valid for 24 hours. The command for Windows is ready there, with token, address and project ID. All systems and downloads are in the app under Agents → Installation and downloads (/agents/install).

2. Run the command in PowerShell

$env:INPING_TOKEN = '<token>'; & ([scriptblock]::Create((irm https://www.inping.io/install.ps1))) -Project '<project-id>=D:\sites\shop'

<token> and <project-id> are placeholders here; the project ID is under Project → Settings. You specify several projects like this:

-Project '<id1>=D:\sites\shop', '<id2>=D:\sites\blog'

The script checks the SHA-256 sum of the download, installs the program, writes the configuration, creates the service inping-agent, registers the agent, starts the service and sets up the scheduled task inping-agent-update. The script does not check a minisign signature on Windows; the update task later on does install only signed versions. At the end you see inping: inping-agent <version> installed and running.

3. Give read access to the project

Without this grant the project is reported as "nothing".

icacls 'D:\sites\shop' /grant 'NT SERVICE\inping-agent:(OI)(CI)RX' /T
Restart-Service inping-agent

How do you check that it works?

Get-Service inping-agent                                        # Status Running
Get-WinEvent -ProviderName inping-agent -MaxEvents 20 | Format-List TimeCreated, Message
Get-ScheduledTask inping-agent-update                           # State Ready

The event log contains the lines msg=starting and msg=configuration. In inping the agent changes from Not registered yet to Online within a minute, and the history starts from the second measurement.

CPU and memory per account (optional)

The service account may not see who owns other processes. So with -AccountMetrics the scheduled task inping-agent-accounts reads them every minute as SYSTEM and stores the result for the service; the service keeps its low privileges.

& ([scriptblock]::Create((irm https://www.inping.io/install.ps1))) -AccountMetrics
Get-ScheduledTask inping-agent-accounts                         # State Ready

This is how a shared host tells its customers apart: IIS application pools with their own identity appear as an account, such as IIS APPPOOL\shop. Services under SYSTEM or NETWORK SERVICE add up there. The metric for accounts has to be selected for the agent under Settings → Collected metrics. -NoAccountMetrics or -Uninstall remove the task again.

Thresholds and alerts

Every new agent starts with CPU above 90% for 5 minutes, memory above 90% for 5 minutes and every disk above 90% immediately. You create your own rules on the agent's page under Settings → Alert rules: above, below or equal to a value, for 0 to 1440 minutes. Rules on load have no effect on Windows, because the value is missing.

After three missed reports, so by default after 3 minutes, the agent counts as offline and an alert opens. For you to hear about it, the assigned project needs a notification rule, for example for Server threshold exceeded or Agent offline, by mail or webhook.

The agent can also send the Windows event log: in the agent under Log sources you choose a channel; with nothing entered it is System. This is off until you create a source.

Update

The task inping-agent-update runs the update every 6 hours as SYSTEM and installs only newer, signed versions. By hand, in a PowerShell as administrator:

& "$env:ProgramFiles\inping\inping-agent.exe" update --config "$env:ProgramData\inping\agent.toml"

The install command without $env:INPING_TOKEN also updates and keeps the configuration.

Uninstall

& ([scriptblock]::Create((irm https://www.inping.io/install.ps1))) -Uninstall   # service, task and binary
& ([scriptblock]::Create((irm https://www.inping.io/install.ps1))) -Purge       # also configuration and state

Then delete the agent in inping under Agents → (agent) → Settings → Delete agent.

When nothing arrives

• run in an elevated PowerShell: start PowerShell as administrator.
• the service could not be set up: an older service with the same name is stuck. Run sc.exe delete inping-agent and start the command again.
• The service stops immediately: open the Application log; the first error names the cause. Usually it is cannot start (missing or unreadable token in %ProgramData%\inping\state) or configuration unusable.
• A proxy in the network: the service account has no proxy settings. Set HTTPS_PROXY as a system environment variable or allow direct HTTPS to the platform.
• Metrics arrive, packages do not: the icacls grant from step 3 is missing.
• registration failed: the token has expired (24 hours) or has already been used. You create a new one on the agent's page under New registration token.

Frequently asked questions

Further reading

• All the ways to connect servers and websites to inping
• Monitor a Linux server
• Monitor Docker containers
• Overview: server monitoring with inping
• Plans and limits for agents
• Full installation guide for all systems