Windows servers#

Monitors CPU, memory, disk, network, Windows services and event logs. The agent runs as a Windows service and is installed with PowerShell.

Requirements#

Windows Server 2016 or later, or Windows 10 and 11. PowerShell 5.1 or later, administrator rights, and outbound HTTPS on port 443.

Install#

Run PowerShell as Administrator:

$env:OBSERVEIQ_API_KEY = "obs_your_key_here"
$env:OBSERVEIQ_ENDPOINT = "https://app.observeiq.io"

iwr -useb "$env:OBSERVEIQ_ENDPOINT/api/v1/docs/vm-agent.ps1" | iex

This installs to C:\Program Files\ObserveIQ, writes C:\ProgramData\ObserveIQ\agent.yaml, registers the ObserveIQAgent service and starts it.

With options:

& ([scriptblock]::Create((iwr -useb "$env:OBSERVEIQ_ENDPOINT/api/v1/docs/vm-agent.ps1"))) `
    -Hostname "sql-prod-01" -Environment "production" -Tags "role=database,team=data"

Note

If script execution is blocked, allow it for the current process only: Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass. This does not change machine policy.

Verify#

Get-Service ObserveIQAgent
Get-Content "C:\ProgramData\ObserveIQ\logs\agent.log" -Tail 40

What is collected#

Group	Metrics
CPU	Utilisation per core, processor queue length, context switches
Memory	Committed bytes, available bytes, page faults, pool usage
Disk	Read and write throughput, IOPS, average queue length, latency
Logical disk	Free space and percentage free per volume
Network	Bytes and packets per adapter, errors, discards
System	Uptime, process and thread counts, handle count
Services	State of each Windows service you nominate

Monitoring SQL Server from the agent#

If the server runs Microsoft SQL Server, the same agent can collect database metrics. This is the equivalent of running a SQL exporter on the box, and it has two advantages over connecting to the instance from outside:

Port 1433 does not need to be reachable from anywhere else.
Windows authentication works, so there is no SQL login and no stored password.

Grant the account the agent runs as read-only visibility, once:

CREATE LOGIN [DOMAIN\SQLMonitorAccount] FROM WINDOWS;
GRANT VIEW SERVER STATE TO [DOMAIN\SQLMonitorAccount];
GRANT VIEW ANY DEFINITION TO [DOMAIN\SQLMonitorAccount];
GRANT VIEW ANY DATABASE TO [DOMAIN\SQLMonitorAccount];

Then add the instance to the agent:

& ([scriptblock]::Create((iwr -useb "$env:OBSERVEIQ_ENDPOINT/api/v1/docs/vm-agent.ps1"))) `
    -Endpoint $env:OBSERVEIQ_ENDPOINT -ApiKey $env:OBSERVEIQ_API_KEY `
    -MssqlInstance "localhost" -MssqlInterval 60 -Install

For a named instance use -MssqlInstance "localhost\SQLEXPRESS". To use SQL authentication instead of Windows authentication, add -MssqlUser and -MssqlPassword.

Note

SQL Server is polled on its own interval, 60 seconds by default, rather than the host interval. The dynamic management view queries are heavier than host counters and running them every 30 seconds adds load without adding insight.

What it collects#

Sessions and blocked requests, blocking chains with the statement holding the lock, wait statistics, buffer cache hit ratio and page life expectancy, deadlocks and lock timeouts, the most expensive statements with rows read and CPU time, lock waits and escalations per table, open transactions, database sizes, time since last full backup, and Always On replica health.

None of this requires Query Store. Statement statistics come from the plan cache, which is present on every instance with no configuration.

The metric names are identical to those produced when ObserveIQ connects to the instance directly, so the same dashboard and the same alert rules apply either way.

Choosing between agent and direct connection#

	Agent on the server	ObserveIQ connects directly
Network	Outbound HTTPS only	Inbound access to port 1433
Credentials	Windows authentication, no password	SQL login with a stored password
Suits	On-premises and domain-joined servers	Managed cloud databases, Azure SQL, RDS

Both produce the same metrics. Use whichever fits the network, and do not run both against one instance or every value is collected twice.

Rolling out with Group Policy#

Place the install script on a share and call it from a startup script, passing the API key from a secure variable. The installer is idempotent: if the service is already present it upgrades in place rather than reinstalling.

Uninstall#

Stop-Service ObserveIQAgent
& "C:\Program Files\ObserveIQ\uninstall.ps1"