What Prometheus collects from Windows services and why

Prometheus is monitoring software that watches your computer's services and records how they behave — whether they're running, how much memory they use, how many times they restart. To collect this data from Windows services, you need a small program called the Windows Exporter, which sits on your computer and feeds information to Prometheus in a format Prometheus understands.

Windows services are background programs that run without you opening them — things like Windows Update, your antivirus, or backup software. Monitoring them tells you when one crashes, when one is consuming too much CPU, or when one stops responding. This is useful if you run a home server, manage multiple computers, or want to understand why your machine feels slow.

The process has three parts: install the Windows Exporter on the computer you want to monitor, tell Prometheus where to find it, and then Prometheus starts collecting the data. None of this requires you to be a programmer — it's configuration, not coding.

Key Takeaways

  • The Windows Exporter is a small program you install once on each Windows computer you want to monitor, and it runs as a service itself.
  • Prometheus connects to the Windows Exporter on port 9182 by default and reads service status, CPU usage, memory, and restart counts every 15 seconds or however often you configure it.
  • You configure Prometheus by editing a single text file called prometheus.yml to tell it which computers to monitor and what to call them.
  • After Prometheus starts collecting data, you can see it in Prometheus's built-in dashboard or send it to a separate graphing tool like Grafana.

Installing the Windows Exporter

read the Windows Exporter from the official Prometheus GitHub releases page. Look for the file named windows_exporter-X.X.X-amd64.msi (the numbers change with each version). read the most recent version unless you have a specific reason not to.

Run the installer by double-clicking the .msi file. The installer asks where to put the program — the default location (usually C:\Program Files\windows_exporter) is fine. It also asks which collectors to enable. Leave the defaults checked; they include the service collector, which is what you need. Click through to finish the installation.

The installer automatically starts the Windows Exporter as a Windows service. To confirm it's running, open Services (press Windows key, type "services.msc", and press Enter). Look for an entry called "windows_exporter". If it shows "Running" in the Status column, the installation worked. If it shows "Stopped", right-click it and select "Start".

Configuring Prometheus to find the Windows Exporter

Prometheus reads its instructions from a file called prometheus.yml. This file lives in the same folder where you installed Prometheus. Open it with Notepad or any text editor (not Word).

Find the section that starts with scrape_configs:. Under it, you'll see a job called "prometheus" that monitors Prometheus itself. Add a new job below it for your Windows service. Here's what it looks like:

- job_name: 'windows-services' static_configs: - targets: ['localhost:9182'] labels: instance: 'my-computer'

Replace 'localhost' with the actual computer name or IP address if you're monitoring a different machine on your network. If you're monitoring the same computer Prometheus runs on, 'localhost' is correct. The port 9182 is the default port the Windows Exporter listens on — don't change it unless you changed it during installation. The instance label is just a name you choose to identify this computer in your data; use something you'll recognize.

Save the file. Restart Prometheus. If Prometheus is running as a service, open Services again, find "Prometheus", right-click it, and select "Restart". If you run Prometheus from the command line, stop it (Ctrl+C) and start it again.

Checking that data is flowing

Open a web browser and go to http://localhost:9090 (or the IP address of your Prometheus computer if it's on another machine). This opens Prometheus's built-in dashboard.

Click the "Graph" tab. In the text box labeled "Expression", type windows_service_state and press Enter. This shows the state of all Windows services the exporter found. Each service appears as a line with a value of 1 (running) or 0 (stopped).

If you see results, Prometheus is collecting data. If you see "No data queried", wait 30 seconds and try again — Prometheus needs time to contact the Windows Exporter for the first time. If you still see no data, check that the Windows Exporter is running (go back to Services and confirm), and that you used the correct IP address or computer name in prometheus.yml.

Understanding the service data Prometheus collects

The Windows Exporter sends several pieces of information about each service. The most useful ones are:

  • windows_service_state — 1 if the service is running, 0 if it's stopped.
  • windows_service_start_mode — 1 if the service is set to start automatically, 0 if it's manual or disabled.
  • windows_service_info — the service name and display name (useful for identifying which service is which).

You can also see CPU and memory usage for each service, disk I/O, and network activity. These appear as separate metrics with names like process_cpu_seconds_total and process_resident_memory_bytes.

In Prometheus's query box, you can combine these metrics to answer questions. For example, typing windows_service_state{name="WinDefend"} shows only the Windows Defender service. Typing windows_service_state == 0 shows only stopped services. These queries help you spot problems quickly.

Sending data to Grafana for better graphs

Prometheus's built-in dashboard is functional but basic. Grafana is a separate program that creates nicer, more detailed graphs and can send you alerts when something goes wrong.

read and install Grafana from grafana.com. During installation, it asks where to store data — the defaults are fine. After installation, open a browser and go to http://localhost:3000. Log in with username "admin" and password "admin" (Grafana prompts you to change this on first login).

Click "Add your first data source". Select "Prometheus". In the URL field, type http://localhost:9090 (or the IP address of your Prometheus computer). Click "Save and test". If it says "Data source is working", you're connected.

Now you can create a dashboard. Click "Create" and then "Dashboard". Click "Add a new panel". In the "Metrics" section, type windows_service_state and select it. Grafana draws a graph. You can add more panels for other metrics, change colors, add titles, and save the dashboard. This gives you a single view of all your services in one place.

Troubleshooting common problems

If Prometheus shows "No data queried" when you search for service metrics, the most common cause is that the Windows Exporter isn't running or Prometheus can't reach it. Check Services to confirm windows_exporter is running. If it's stopped, start it. If it keeps stopping on its own, the installer may have failed — uninstall it (Control Panel > Programs > Uninstall a program), restart your computer, and reinstall.

If Prometheus can reach the Windows Exporter but shows no service data, the service collector may not be enabled. Reinstall the Windows Exporter and make sure you don't uncheck the "service" collector during installation. If you need to change which collectors are enabled after installation, you can edit the Windows Exporter's configuration file at C:\Program Files\windows_exporter\config.yml, but this requires restarting the service afterward.

If you're monitoring a computer on your network and Prometheus can't find it, make sure you used the correct IP address or computer name in prometheus.yml. Test the connection by opening a command prompt on the Prometheus computer and typing ping [computer-name]. If ping fails, the computer name is wrong or the network connection is down. Also check that Windows Firewall on the monitored computer isn't blocking port 9182 — you may need to add an exception in Windows Firewall settings.

Frequently Asked Questions

Can I monitor services on multiple computers at once?

Yes. Add a separate job in prometheus.yml for each computer. Give each one a different job name and a different IP address or computer name. Prometheus will collect data from all of them and label each one with the instance name you provide, so you can tell them apart in your graphs.

How often does Prometheus collect data from the Windows Exporter?

By default, every 15 seconds. You can change this by adding a scrape_interval line to the job in prometheus.yml. For example, scrape_interval: 30s collects every 30 seconds. More frequent collection uses more disk space and network bandwidth but gives you more detailed history.

What happens if a service crashes — will Prometheus alert me?

Prometheus records that the service stopped, but it doesn't send alerts on its own. To get alerts, you need to set up alerting rules in Prometheus or use Grafana's alert feature. Both let you define conditions (like "if a service is stopped for more than 5 minutes") and send notifications to email, Slack, or other services.

Do I need to install Prometheus and the Windows Exporter on the same computer?

No. Prometheus can run on any computer on your network and monitor Windows Exporters on other computers. Just use the correct IP address or computer name in prometheus.yml instead of localhost. Both computers need to be on the same network and able to reach each other.

Can I see which services are installed but not running?

Yes. The Windows Exporter reports all services, whether they're running or stopped. In Prometheus, query windows_service_state == 0 to see only stopped services, or windows_service_state == 1 to see only running ones. You can also filter by service name using windows_service_state{name="ServiceName"}.