Windows Process and Network Collector (app-discovery-process-netstat-win)

This collector collects process details and process-level network associations from Windows servers. This collector can run only on Windows. The collector uses the Windows Management Instrumentation (WMI) and SMB protocols to communicate with the Windows servers to be collected. The following required ports must be enabled on the firewall of these Windows servers:

WMI: TCP port 135 and a high-range random port (recommended: 1024 to 65535)
SMB: TCP port 445

The collector collects process details and long-lived network connections between processes using netstat on Windows servers.
During the collection, a shared folder named MgC_Agent_Share_safe_to_delete+<random-data-source-ID> is created in drive C on the Windows server for temporarily storing the collected process and network information. Only the Administrators group can operate the folder. The folder will be automatically deleted after the collection is complete. If the task is interrupted unexpectedly, you can manually delete the folder.

**Table 1** Parameters for configuring the Windows process and network collector
Parameter	Mandatory	Configuration
app_only	No	Specify whether to collect only process information. The options are true and false. true indicates that only process information is collected. false indicates that process and network information is collected. The default value is false.
duration	No	Specify the collection duration. If the duration exceeds the defined limit, the collection stops. The unit can be m (minute), h (hour), or d (day). The value is an integer greater than or equal to 1. The unit must be specified. If this parameter is not set, the default value 1m is used.
interval	No	Specify the collection interval, in minutes. The value is an integer ranging from 1 to 30. If this parameter is not set, the default value 1m is used.
output_path	No	Enter the path for storing the CSV output file. For example, C:\MgC-Agent\test. The default path is C:\MgC-Agent\data\collection-result\app-discovery-process-netstat-win.

Related Operations

If a collection task fails, you can perform the following operations to obtain the existing collection records:

In the task list, click the drop-down arrow to obtain the data source ID of the task. If the data source ID is not found, submit a service ticket to contact technical support for fault locating and rectification.
Locate the failed task and click View Storage Path in the Operation column to obtain the CSV file path.
Navigate to the MgC Agent installation directory and go to the path of the obtained CSV file. In the path, search for the CSV file with the same name as the obtained data source ID. If the CSV file is not found, the collection was not completed. In this case, you are advised to create a collection task again.