feat(landing): Windows server monitoring tools guide

apps/landing/src/lib/guide-highlight.ts

@@ -19,7 +19,8 @@ export type GuideLang =
     | "shell"
     | "python-logging"
     | "loguru-output"
-    | "otel-debug";
+    | "otel-debug"
+    | "powershell";
 
 const escape = (s: string) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 const span = (cls: string, text: string) => `<span class="tok-${cls}">${escape(text)}</span>`;
@@ -232,6 +233,18 @@ const otelDebug = (code: string) =>
         })
         .join("\n");
 
+// PowerShell: cmdlets as functions, quoted strings as labels, variables as
+// names. Backtick escapes stay inside their string.
+const powershell = (code: string) =>
+    tokenize(code, [
+        [/#.*/y, (m) => span("comment", m[0])],
+        [/'[^'\n]*'|"(?:[^"`\n]|`.)*"/y, (m) => span("labels", m[0])],
+        [/\$(?:env:)?\w+/y, (m) => span("name", m[0])],
+        [/\b[A-Z][a-z]+-[A-Z][A-Za-z]+\b/y, (m) => span("fn", m[0])],
+        [/\b\d+(?:\.\d+)?\b/y, (m) => span("value", m[0])],
+        [/[-\w]+/y, (m) => escape(m[0])],
+    ]);
+
 export const highlight = (code: string, lang: GuideLang) =>
     ({
         exposition,
@@ -252,4 +265,5 @@ export const highlight = (code: string, lang: GuideLang) =>
         "python-logging": pythonLogging,
         "loguru-output": loguruOutput,
         "otel-debug": otelDebug,
+        powershell,
     })[lang](code);

apps/landing/src/pages/guides/_windows-server-monitoring/config.yaml

@@ -0,0 +1,76 @@
+extensions:
+  file_storage:
+    directory: C:\ProgramData\OpenTelemetry Collector\storage
+    create_directory: true
+
+receivers:
+  host_metrics:
+    collection_interval: 30s
+    scrapers:
+      cpu:
+        metrics:
+          system.cpu.utilization:
+            enabled: true
+      memory:
+        metrics:
+          system.memory.utilization:
+            enabled: true
+      filesystem:
+        exclude_fs_types:
+          fs_types: [CDFS, UDF] # CD and DVD drives always read 100% full
+          match_type: strict
+        metrics:
+          system.filesystem.utilization:
+            enabled: true
+      load: {}
+      network: {}
+
+  windows_service:
+    include_services: [W3SVC, MSSQLSERVER] # the services this server must keep running
+
+  windows_event_log/errors:
+    storage: file_storage
+    query: |
+      <QueryList>
+        <Query Id="0">
+          <Select Path="System">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
+          <Select Path="Application">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
+        </Query>
+      </QueryList>
+    resource:
+      service.name: windows-eventlog
+
+  windows_event_log/security:
+    storage: file_storage
+    query: |
+      <QueryList>
+        <Query Id="0">
+          <Select Path="Security">*[System[(EventID=4625 or EventID=4740)]]</Select>
+        </Query>
+      </QueryList>
+    resource:
+      service.name: windows-security
+
+processors:
+  resource_detection:
+    detectors: [system]
+  batch: {}
+
+exporters:
+  otlp_http/maple:
+    endpoint: https://ingest.maple.dev
+    compression: gzip
+    headers:
+      x-maple-ingest-key: ${env:MAPLE_INGEST_KEY}
+
+service:
+  extensions: [file_storage]
+  pipelines:
+    metrics:
+      receivers: [host_metrics, windows_service]
+      processors: [resource_detection, batch]
+      exporters: [otlp_http/maple]
+    logs:
+      receivers: [windows_event_log/errors, windows_event_log/security]
+      processors: [resource_detection, batch]
+      exporters: [otlp_http/maple]

apps/landing/src/pages/guides/_windows-server-monitoring/install.ps1

@@ -0,0 +1,5 @@
+$v = '0.164.0'
+$msi = "$env:TEMP\otelcol-contrib.msi"
+Invoke-WebRequest -OutFile $msi -Uri "https://github.com/open-telemetry/opentelemetry-collector-releases/releases/download/v$v/otelcol-contrib_${v}_windows_x64.msi"
+Start-Process msiexec.exe -ArgumentList "/i `"$msi`" /qn" -Wait
+Get-Service otelcol-contrib

apps/landing/src/pages/guides/_windows-server-monitoring/start.ps1

@@ -0,0 +1,6 @@
+$dir = 'C:\Program Files\OpenTelemetry Collector'
+New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\otelcol-contrib' `
+  -Name Environment -PropertyType MultiString -Value 'MAPLE_INGEST_KEY=YOUR_INGEST_KEY' -Force
+
+& "$dir\otelcol-contrib.exe" validate --config "$dir\config.yaml"
+Restart-Service otelcol-contrib

apps/landing/src/pages/guides/index.astro

@@ -122,6 +122,13 @@ const investigationGuides = [
         description: "How a raw log line becomes named fields, with a tested OpenTelemetry Collector config for nginx, JSON, logfmt, multiline and syslog logs.",
         read: "9 min",
     },
+    {
+        href: "/guides/windows-server-monitoring",
+        label: "Infrastructure",
+        title: "Windows server monitoring tools and what to watch",
+        description: "The signals worth an alert, the built-in, open-source and commercial tools compared, and an OpenTelemetry setup with alerts for stopped services and full disks.",
+        read: "9 min",
+    },
 ];
 
 const fieldNotes = (await getCollection("blog") as BlogPost[])