Windows Integration
Performance counter metrics, event logs, and IIS/WMI monitoring for Windows Server. Monitor your Windows fleet with AI anomaly detection and security event analysis.
How It Works
Install TigerOps Agent for Windows
Run the TigerOps Windows installer (.msi) or use the PowerShell install script. The agent installs as a Windows Service and begins collecting Performance Counter and Event Log data immediately.
Configure Performance Counters
TigerOps auto-discovers standard Windows performance counters (Processor, Memory, LogicalDisk, Network Interface). Add custom counters from any installed WMI provider via the config file.
Enable Event Log Collection
Configure Windows Event Log channels to forward to TigerOps — System, Application, Security, and custom application channels. Filter by Event ID, source, and level for relevant event capture.
Monitor IIS and .NET Applications
Enable IIS and ASP.NET performance counter collection for request queues, application pool memory, and request processing times. Correlate .NET CLR metrics with IIS worker process health.
What You Get Out of the Box
Windows Performance Counter Collection
Collect any Windows Performance Counter path using standard PDH syntax. Pre-configured sets for Processor, Memory, LogicalDisk, Network Interface, and Process objects with per-instance metrics.
Windows Event Log Forwarding
Forward Windows Event Log entries from System, Application, Security, and custom channels. TigerOps parses XML event records and extracts EventID, Source, Level, and EventData fields as searchable labels.
IIS Application Pool Monitoring
Track IIS application pool request queue depth, worker process CPU and memory, active requests, connection counts, and application pool recycling events per site and application.
WMI Query Metrics
Execute custom WMI queries (SELECT * FROM Win32_Processor) on a configurable schedule and forward results as metrics. Monitor hardware sensors, RAID array health, and custom application state via WMI.
Windows Security Event Monitoring
Collect Security Event Log entries for logon/logoff, privilege escalation, account management, and policy changes. TigerOps AI detects anomalous login patterns and privilege abuse.
.NET CLR and ASP.NET Metrics
Monitor .NET CLR GC generation counts, heap size, finalization queue length, and ASP.NET request throughput, error rate, and session count. Correlate CLR GC pauses with IIS response time spikes.
TigerOps Agent Windows Configuration
Install and configure the TigerOps Windows agent via PowerShell.
# Install TigerOps agent on Windows Server
# Run as Administrator in PowerShell
$ApiKey = $env:TIGEROPS_API_KEY
# Download and install agent MSI
Invoke-WebRequest -Uri "https://install.atatus.net/agent/windows/latest/tigerops-agent.msi" `
-OutFile "$env:TEMP\tigerops-agent.msi"
Start-Process msiexec.exe -Wait -ArgumentList `
"/i $env:TEMP\tigerops-agent.msi /quiet APIKEY=$ApiKey"
# Agent config: C:\ProgramData\TigerOps\agent.yaml
# tigerops-agent.yaml
api_key: YOUR_API_KEY
endpoint: https://ingest.atatus.net
host_tags:
env: production
region: us-east-1
performance_counters:
collection_interval: 10s
counters:
- "\\Processor(_Total)\\% Processor Time"
- "\\Memory\\Available MBytes"
- "\\LogicalDisk(_Total)\\% Disk Time"
- "\\Network Interface(*)\\Bytes Total/sec"
- "\\Web Service(_Total)\\Current Connections"
- "\\ASP.NET\\Requests/Sec"
event_logs:
channels:
- name: System
level: warning
- name: Application
level: error
- name: Security
event_ids: [4624, 4625, 4648, 4720, 4728]
Restart-Service tigerops-agentCommon Questions
Which Windows versions does the TigerOps agent support?
The TigerOps Windows agent supports Windows Server 2016, 2019, 2022, and Windows 10/11. Both x86_64 and ARM64 architectures are supported. The agent requires .NET Framework 4.7.2 or later.
How do I collect custom Windows Performance Counters?
Add custom counter paths in the PDH format (\\Computer\\Object(Instance)\\Counter) to the performance_counters list in the TigerOps agent config. Any counter visible in PerfMon can be collected, including third-party application counters.
Can TigerOps monitor Windows Failover Cluster health?
Yes. Use WMI queries against the MSCluster_* WMI classes to collect cluster node state, resource group status, and network health. TigerOps alerts on cluster resource failures and node evictions.
How does TigerOps forward Windows Event Logs?
The TigerOps agent uses the Windows Event Log API (EvtQuery) with subscription-based delivery for low-latency event forwarding. Events are batched and forwarded over HTTPS with automatic retry and local disk buffering.
Is the TigerOps Windows agent compatible with Windows Server Core?
Yes. The TigerOps agent installs and runs on Windows Server Core with no GUI dependency. Use the PowerShell install script and configure the agent via the YAML config file or Group Policy registry settings.
Complete Windows Server Observability in Minutes
Performance counters, event logs, IIS metrics, and AI security anomaly detection. One MSI install covers your entire Windows fleet.