Windows server monitoring

01 · Overview

Monitoring a Windows server

Most of these failures give you warning. A drive that is 97% full today was 94% full last week, and a service that crashed at 3 a.m. wrote an event when it did. Without monitoring, the first sign is a user who can't reach the app. With it, those early signs become an alert while there is still time to act.

The goal of this guide: know what to watch, pick a tool that fits how many servers you run, and have alerts on the things that break.

02 · Signals

Signals to watch on a Windows server

Windows keeps hundreds of performance counters, but a short list catches most real problems on a web, database or file server. The alert values are starting points: raise one if it fires on a normal day.

Each color marks the same signal in the config and the alerts further down.

03 · Tools

Windows server monitoring tools compared

Windows ships with tools that show every signal above for the server you are logged in to. They don't keep history across servers or send an alert to your phone. Built-in tools are fine for one server; once you have a few, you need something central that keeps history and alerts.

Prices and licenses from each vendor's own pages, verified October 31, 2026.

Picking one

04 · Setup

Monitor Windows Server with OpenTelemetry

The OpenTelemetry Collector is a free, open-source agent. On Windows it runs as a service, reads host metrics, service states and the Event Log, and sends them over OTLP, the OpenTelemetry protocol most monitoring backends accept. The steps use Maple as the backend; for another one, change the exporter at the end of the config.

1. Windows Servercounters, services, Event Log
2. otelcol-contribthe Collector, as a Windows service
3. OTLP over HTTPSthe OpenTelemetry protocol
4. Your backendMaple in this example

1. Install the Collector

The OpenTelemetry project publishes an MSI for otelcol-contrib, the Collector build that includes the Windows receivers. It installs to C:\Program Files\OpenTelemetry Collector and registers an automatic-start service named otelcol-contrib. The service runs as LocalSystem, an account that can read the Security log. In PowerShell, run as Administrator:

$v = '0.164.0'
$msi = "$env:TEMP\otelcol-contrib.msi"
Invoke-WebRequest -OutFile $msi -Uri "https://github.com/open-telemetry/opentelemetry-collector-releases/releases/download/v$v/otelcol-contrib_${v}_windows_x64.msi"
Start-Process msiexec.exe -ArgumentList "/i `"$msi`" /qn" -Wait
Get-Service otelcol-contrib

2. Write the config

Replace config.yaml in the install folder with this file. Set include_services to the services this server must keep running: W3SVC is IIS and MSSQLSERVER is SQL Server's default instance. Get-Service lists the names of the rest.

extensions:
  file_storage:
    directory: C:\ProgramData\OpenTelemetry Collector\storage
    create_directory: true

receivers:
  host_metrics:
    collection_interval: 30s
    scrapers:
      cpu:
        metrics:
          system.cpu.utilization:
            enabled: true
      memory:
        metrics:
          system.memory.utilization:
            enabled: true
      filesystem:
        exclude_fs_types:
          fs_types: [CDFS, UDF] # CD and DVD drives always read 100% full
          match_type: strict
        metrics:
          system.filesystem.utilization:
            enabled: true
      load: {}
      network: {}

  windows_service:
    include_services: [W3SVC, MSSQLSERVER] # the services this server must keep running

  windows_event_log/errors:
    storage: file_storage
    query: |
      <QueryList>
        <Query Id="0">
          <Select Path="System">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
          <Select Path="Application">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
        </Query>
      </QueryList>
    resource:
      service.name: windows-eventlog

  windows_event_log/security:
    storage: file_storage
    query: |
      <QueryList>
        <Query Id="0">
          <Select Path="Security">*[System[(EventID=4625 or EventID=4740)]]</Select>
        </Query>
      </QueryList>
    resource:
      service.name: windows-security

processors:
  resource_detection:
    detectors: [system]
  batch: {}

exporters:
  otlp_http/maple:
    endpoint: https://ingest.maple.dev
    compression: gzip
    headers:
      x-maple-ingest-key: ${env:MAPLE_INGEST_KEY}

service:
  extensions: [file_storage]
  pipelines:
    metrics:
      receivers: [host_metrics, windows_service]
      processors: [resource_detection, batch]
      exporters: [otlp_http/maple]
    logs:
      receivers: [windows_event_log/errors, windows_event_log/security]
      processors: [resource_detection, batch]
      exporters: [otlp_http/maple]

resource_detection adds the server's host.name to every metric and event, so data from many servers stays apart. file_storage remembers the last event each receiver read, so a restart neither skips nor resends events.

3. Add the key and start

The config reads the ingest key from MAPLE_INGEST_KEY. For Maple, that is the private key (maple_sk_...) under Settings → Ingestion, and EU organizations use https://ingest.eu.maple.dev as the endpoint. Set the key on the service, check the config and restart:

$dir = 'C:\Program Files\OpenTelemetry Collector'
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\otelcol-contrib' `
  -Name Environment -PropertyType MultiString -Value 'MAPLE_INGEST_KEY=YOUR_INGEST_KEY' -Force

& "$dir\otelcol-contrib.exe" validate --config "$dir\config.yaml"
Restart-Service otelcol-contrib

If the service stops right after it starts, Event Viewer has the reason under Windows Logs → Application, source otelcol-contrib. Otherwise the server appears under Infrastructure → Hosts within a minute, and its events on the Logs page under the service windows-eventlog:

05 · Alerts

Alerts to set up first

Start with the failures that take an app down. The steps below use Maple as the example backend; any tool that receives the same OpenTelemetry data can alert on it the same way, with a threshold on the same metric or log query. Each rule covers every server that runs the Collector, so ten servers need the same rules as one. In Maple, rules live under Alerts and need a notification destination such as Slack or email. Set Minimum samples to 1 on each: the default of 50 is sized for request traffic, and a Windows server sends far fewer data points.

1. 01

   A service stopped

   Open Metrics and search for windows.service.status. Set Aggregate to min and Group by to attr.name, then click Create alert. Alert when the value is below 4 over a 5-minute window. With min, one stopped copy on any server pulls the value down, and the grouping opens one incident per service.

   

2. 02

   A disk filling up

   Open system.filesystem.utilization, set Aggregate to max and Group by to attr.mountpoint, and click Create alert. Alert above 0.85 as a Warning over a 15-minute window, then click Add critical tier and set it to 0.95. The value is a share, so 0.85 is 85% full, and max picks the fullest server for each drive letter.

3. 03

   Errors in the Event Log

   Under Alerts, click New rule, then Start blank. In Query builder, count Logs where service.name = "windows-eventlog" and severity = "ERROR". Alert above 10 over a 15-minute window. The chart replays the rule over past data: if it would have fired on a quiet day, raise the threshold.

   For failed logins, make a copy with service.name = "windows-security", no severity filter, and above 20 over 5 minutes.