Help Center/ Migration Center/ Tool Guide/ Tool Discovery/ Configuring Collector Parameters/ Windows Process and Network Collector (app-discovery-process-netstat-win)
Updated on 2024-05-21 GMT+08:00
View PDF
Share

Windows Process and Network Collector (app-discovery-process-netstat-win)

This collector collects process and network associations on Windows servers. This collector can run only on Windows. The collector uses the Windows Management Instrumentation (WMI) and SMB protocols to communicate with the Windows servers to be collected. The following required ports must be enabled on the firewall of these Windows servers:

  • WMI: TCP port 135 and a larger random port (default: 13475; recommended: 1024-65535)
  • SMB: TCP port 445

The collector can collect only the associations between the processes that are identified by running the netstat command and have long-term network connections.

Table 1 Parameters for configuring the Windows process and network collector

Parameter

Mandatory

Configuration

host_path

Yes

Enter the path to the CSV file that contains Windows server authorization information, for example, D:\nodes.csv.

You need to prepare the CSV file in advance. In the first row (table header) of the CSV file, enter the parameter names in the following sequence, and enter the parameter values of each Windows server to be collected in the rows below the table header. The IP, USER, and PASSWORD parameters are mandatory.

  • IP(REQUIRED)
  • PORT(REQUIRED)
  • USER(REQUIRED)
  • PASSWORD(SENSITIVE)
  • PRI_KEY_PATH(SENS_PATH)
  • CLUSTER
  • APPLICATION
  • BUSINESS_DOMAIN
  • PASSWORD(ENCRYPTED)
  • PRI_KEY_PATH(ENCRYPTED)
    CAUTION:

    The provided accounts (username and password) must have the permission to run the netstat command on the server.

app_only

No

Specify whether to collect only process information. The options are true and false. true indicates only process information is collected. false indicates only network information is collected. The default value is false.

CAUTION:

If this parameter is set to false, the time parameter is mandatory.

time

No

This parameter is mandatory when app_only is set to false.

Specify the collection duration. If the collection duration exceeds the specified value, the collection stops. The unit can be m (minute), h (hour), or d (day). The value is an integer greater than or equal to 1.

interval

No

Specify the collection interval, in minutes. The value is an integer ranging from 1 to 30. If this parameter is not set, the default value 1 m is used.

output_path

No

Enter the storage path of the collection result file (app-discovery-process-netstat-win-xxx.csv). If this parameter is left blank, the storage path defaults to <Collector installation path>\output\file.

Example: C:\Edge\tools\plugins\collectors\app-discovery-collectors\python\mgc-app-discovery-collectors\app-discovery-process-netstat-win\output\file\app-discovery-process-netstat-win-xxx.csv