Introduction to Prometheus and Grafana Monitoring on Windows Server 2019

Prometheus is an open-source time-series monitoring system originally developed at SoundCloud, now a Cloud Native Computing Foundation (CNCF) project. It collects metrics by scraping HTTP endpoints exposed by exporters on monitored systems. Grafana is a visualization and dashboarding platform that queries Prometheus (and many other data sources) to create rich, interactive dashboards. Together, Prometheus and Grafana form a powerful open-source monitoring stack that can monitor Windows Server 2019 infrastructure alongside Linux servers, Kubernetes clusters, and cloud services. The Windows Exporter (formerly WMI Exporter) is the component installed on Windows Server 2019 that exposes system metrics in Prometheus format. This guide covers installing the full stack, configuring collectors, and building dashboards.

Installing Windows Exporter on Windows Server 2019

The Windows Exporter is a Go-based agent that collects Windows performance counters, WMI metrics, and service states, then exposes them on an HTTP endpoint that Prometheus scrapes. Download the latest Windows Exporter MSI from the GitHub releases page at github.com/prometheus-community/windows_exporter/releases.

Install it with a specific set of enabled collectors. The following PowerShell command installs Windows Exporter with a comprehensive set of collectors suitable for Windows Server 2019:

msiexec /i windows_exporter-0.27.1-amd64.msi ENABLED_COLLECTORS="cpu,cs,logical_disk,net,os,service,system,memory,iis,process,tcp,textfile" TEXTFILE_DIR="C:Program Fileswindows_exportertextfile_inputs" /quiet

This installs Windows Exporter as a Windows service that starts automatically. By default it listens on TCP port 9182. Verify it is running:

Get-Service -Name windows_exporter

Test the metrics endpoint by opening a browser or using PowerShell:

Invoke-WebRequest -Uri "http://localhost:9182/metrics" -UseBasicParsing | Select-Object -ExpandProperty Content | Select-Object -First 50

Configuring Windows Firewall for Prometheus Scraping

By default, Windows Firewall blocks inbound connections to port 9182. Open the port to allow your Prometheus server to scrape metrics. Replace 192.168.1.50 with your Prometheus server’s IP address:

New-NetFirewallRule -DisplayName "Windows Exporter Prometheus" -Direction Inbound -Protocol TCP -LocalPort 9182 -RemoteAddress 192.168.1.50 -Action Allow -Profile Any

For environments where multiple Prometheus servers scrape metrics, specify a range or CIDR block in -RemoteAddress. Avoid opening port 9182 to all sources (0.0.0.0/0) as the metrics endpoint can expose sensitive system information.

Installing Prometheus on a Monitoring Server

Prometheus itself typically runs on a Linux server or in a container, but it can also run on Windows. Download the latest Prometheus binary from prometheus.io/download. The following instructions use a Linux-based Prometheus server that scrapes the Windows Server 2019 target.

On the Linux Prometheus server, create or edit the prometheus.yml configuration file to add the Windows Server 2019 target. Each Windows server should be a separate scrape target:

global:
  scrape_interval: 15s
  evaluation_interval: 15s

scrape_configs:
  - job_name: 'windows_servers'
    static_configs:
      - targets:
          - '192.168.1.10:9182'
          - '192.168.1.11:9182'
          - '192.168.1.12:9182'
    labels:
      environment: 'production'
      os: 'windows'

Restart Prometheus after editing the configuration:

systemctl restart prometheus

Verify targets are being scraped by opening the Prometheus UI at http://prometheus-server:9090/targets. All Windows Server targets should show State: UP.

Key Windows Exporter Metrics to Monitor

The Windows Exporter exposes hundreds of metrics. The most operationally important metrics for Windows Server 2019 include:

CPU utilization: windows_cpu_time_total — use a rate() query to compute CPU usage percentage per core and overall. Memory: windows_os_physical_memory_free_bytes and windows_os_physical_memory_bytes — calculate used percentage. Disk I/O: windows_logical_disk_read_bytes_total and windows_logical_disk_write_bytes_total — rate() to get throughput. Disk space: windows_logical_disk_free_bytes and windows_logical_disk_size_bytes. Network: windows_net_bytes_received_total and windows_net_bytes_sent_total. Services: windows_service_state — alert on any service expected to be running showing state != running. Uptime: windows_system_system_up_time.

Configuring Prometheus Alerting Rules

Create alerting rules in Prometheus to fire when Windows Server metrics cross critical thresholds. Create a file /etc/prometheus/rules/windows_alerts.yml:

groups:
  - name: windows_server_alerts
    rules:
      - alert: WindowsHighCPU
        expr: 100 - (avg by(instance) (rate(windows_cpu_time_total{mode="idle"}[5m])) * 100) > 90
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "High CPU on {{ $labels.instance }}"
          description: "CPU usage is above 90% for 5 minutes."

      - alert: WindowsLowDiskSpace
        expr: (windows_logical_disk_free_bytes / windows_logical_disk_size_bytes) * 100 < 10
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "Low disk space on {{ $labels.instance }}"
          description: "Volume {{ $labels.volume }} has less than 10% free."

      - alert: WindowsServiceDown
        expr: windows_service_state{state="running"} == 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "Windows service down on {{ $labels.instance }}"
          description: "Service {{ $labels.name }} is not running."

Reference this rules file in prometheus.yml by adding:

rule_files:
  - "/etc/prometheus/rules/*.yml"

Installing and Configuring Grafana

Install Grafana on the monitoring server. For Ubuntu/Debian:

apt-get install -y apt-transport-https software-properties-common
wget -q -O - https://packages.grafana.com/gpg.key | apt-key add -
echo "deb https://packages.grafana.com/oss/deb stable main" > /etc/apt/sources.list.d/grafana.list
apt-get update && apt-get install -y grafana
systemctl enable grafana-server && systemctl start grafana-server

Grafana listens on port 3000 by default. Open a browser to http://grafana-server:3000 and log in with admin/admin (change the password on first login). Navigate to Configuration > Data Sources > Add data source > Prometheus. Set the URL to http://localhost:9090 and click Save and Test.

Importing the Windows Exporter Grafana Dashboard

The Grafana dashboard library includes ready-made dashboards for Windows Exporter. In Grafana, go to Dashboards > Import. Enter dashboard ID 14694 (Windows Exporter Full — a comprehensive community dashboard for Windows nodes) and click Load. Select your Prometheus data source and click Import.

The imported dashboard includes panels for CPU usage per core, memory utilization, disk I/O, network throughput, disk space per volume, and top processes by CPU and memory. You can customize panels by clicking the panel title and selecting Edit, then modifying the PromQL query or visualization settings.

Setting Up Alertmanager for Notifications

Alertmanager handles routing and delivery of Prometheus alerts. Configure it to send email notifications for Windows Server alerts. Create /etc/alertmanager/alertmanager.yml:

global:
  smtp_smarthost: 'smtp.company.com:587'
  smtp_from: '[email protected]'
  smtp_auth_username: '[email protected]'
  smtp_auth_password: 'smtp-password'

route:
  group_by: ['alertname', 'instance']
  group_wait: 30s
  group_interval: 5m
  repeat_interval: 4h
  receiver: 'ops-team'

receivers:
  - name: 'ops-team'
    email_configs:
      - to: '[email protected]'

Start Alertmanager and reference it in prometheus.yml under alerting.alertmanagers. Prometheus will automatically route firing alerts to Alertmanager, which delivers the notifications according to the routing tree.