01 · Overview
+Monitoring a Windows server
+ +Windows server monitoring means collecting a server's health data around the clock and getting an alert when something breaks: a service that stopped, a disk filling up, CPU or memory running out, or errors and failed logins piling up in the Event Log.
++ Most of these failures give you warning. A drive that is 97% full today was 94% full last week, and a service that crashed at 3 a.m. wrote an event when it did. Without monitoring, the first sign is a user who can't reach the app. With it, those early signs become an alert while there is still time to act. +
++ The goal of this guide: know what to watch, pick a tool that fits how many servers you run, and have alerts on the things that break. +
+ +Key takeaways
+-
+
- Watch services, disk space, CPU, memory, Event Log errors and failed logins first. +
- Alert when a drive passes 85% full, and again at 95%. +
- Performance Monitor and Event Viewer cover one server, but keep no history across servers and send no alerts. +
- The OpenTelemetry Collector, installed as a Windows service, collects counters, service status and the Event Log in one place. +
- A switched-off server sends nothing, so add an alert that fires when a server stops reporting. +
02 · Signals
+Signals to watch on a Windows server
++ Windows keeps hundreds of performance counters, but a short list catches most real problems on a web, database or file server. The alert values are starting points: raise one if it fires on a normal day. +
+ +{s.why}
+Alert when{s.alert}
+Each color marks the same signal in the config and the alerts further down.
+03 · Tools
+Windows server monitoring tools compared
++ Windows ships with tools that show every signal above for the server you are logged in to. They don't keep history across servers or send an alert to your phone. Built-in tools are fine for one server; once you have a few, you need something central that keeps history and alerts. +
+ +| Tool | Good for | Alerts | Cost |
|---|---|---|---|
| {g.group} | |||
| {t.name} | +{t.goodFor} | +{t.alerts} | +{t.cost}{t.compare && <> How Datadog pricing compares} | +
Prices and licenses from each vendor's own pages, verified October 31, 2026.
+ +Picking one
+| Your setup | Start with |
|---|---|
| {setup} | {pick} |
04 · Setup
+Monitor Windows Server with OpenTelemetry
++ The OpenTelemetry Collector is a free, open-source agent. On Windows it runs as a service, reads host metrics, service states and the Event Log, and sends them over OTLP, the OpenTelemetry protocol most monitoring backends accept. The steps use Maple as the backend; for another one, change the exporter at the end of the config. +
+-
+ {flow.map((f) => (
+
- {f.name}{f.detail} + ))} +
1. Install the Collector
+
+ The OpenTelemetry project publishes an MSI for otelcol-contrib, the Collector build that includes the Windows receivers. It installs to C:\Program Files\OpenTelemetry Collector and registers an automatic-start service named otelcol-contrib. The service runs as LocalSystem, an account that can read the Security log. In PowerShell, run as Administrator:
+
2. Write the config
+
+ Replace config.yaml in the install folder with this file. Set include_services to the services this server must keep running: W3SVC is IIS and MSSQLSERVER is SQL Server's default instance. Get-Service lists the names of the rest.
+
C:\Program Files\OpenTelemetry Collector\config.yaml
+{r.key}{r.signals.map((id) => )}
+ resource_detection adds the server's host.name to every metric and event, so data from many servers stays apart. file_storage remembers the last event each receiver read, so a restart neither skips nor resends events.
+
3. Add the key and start
+
+ The config reads the ingest key from MAPLE_INGEST_KEY. For Maple, that is the private key (maple_sk_...) under Settings → Ingestion, and EU organizations use https://ingest.eu.maple.dev as the endpoint. Set the key on the service, check the config and restart:
+
+ If the service stops right after it starts, Event Viewer has the reason under Windows Logs → Application, source otelcol-contrib. Otherwise the server appears under Infrastructure → Hosts within a minute, and its events on the Logs page under the service windows-eventlog:
+
05 · Alerts
+Alerts to set up first
++ Start with the failures that take an app down. The steps below use Maple as the example backend; any tool that receives the same OpenTelemetry data can alert on it the same way, with a threshold on the same metric or log query. Each rule covers every server that runs the Collector, so ten servers need the same rules as one. In Maple, rules live under Alerts and need a notification destination such as Slack or email. Set Minimum samples to 1 on each: the default of 50 is sized for request traffic, and a Windows server sends far fewer data points. +
+ +-
+
-
+ 01
+ +
A service stopped
Open Metrics and search for
+windows.service.status. Set Aggregate tominand Group by toattr.name, then click Create alert. Alert when the value is below4over a 5-minute window. Withmin, one stopped copy on any server pulls the value down, and the grouping opens one incident per service.
+ -
+ 02
+ +
A disk filling up
Open
system.filesystem.utilization, set Aggregate tomaxand Group by toattr.mountpoint, and click Create alert. Alert above0.85as a Warning over a 15-minute window, then click Add critical tier and set it to0.95. The value is a share, so 0.85 is 85% full, andmaxpicks the fullest server for each drive letter.
+ -
+ 03
+ +
Errors in the Event Log
Under Alerts, click New rule, then Start blank. In Query builder, count Logs where
+service.name = "windows-eventlog"andseverity = "ERROR". Alert above10over a 15-minute window. The chart replays the rule over past data: if it would have fired on a quiet day, raise the threshold.For failed logins, make a copy with
service.name = "windows-security", no severity filter, and above20over 5 minutes.
+
A server that is switched off
++ A server that is off or offline sends nothing, and a rule without data stays quiet. The Hosts page lists it under Stopped reporting after 5 minutes. To get paged for it, add a rule on the server's metrics with Alert when there is no data turned on, so missing data counts as a breach. The remote server monitoring guide has a ready-made rule that does this for each server. +
+Set it up in Maple
+Send your Windows servers to Maple
+The Hosts docs list the metrics behind each column of the Hosts page, and the alert rule docs cover thresholds, tiers and destinations.
+ +Sources and further reading
+-
+
- OpenTelemetry Collector releases (MSI installers) +
- OpenTelemetry Collector: host metrics receiver +
- OpenTelemetry Collector: Windows service receiver +
- OpenTelemetry Collector: Windows Event Log receiver +
- Microsoft Learn: Event Log query schema +
- Microsoft Learn: Create a performance counter alert and send email +
- Microsoft Learn: Windows Admin Center +
- Zabbix license · windows_exporter · PRTG pricing · Datadog pricing (verified October 31, 2026) +
- Maple docs: Hosts +
- Maple docs: Metrics +
- Maple docs: Alert rules +