Cherry-pick #18361 to 7.x: perfmon - remove negative counter value errors from the event output

[narph]

Cherry-pick of PR #18361 to 7.x branch. Original message:

What does this PR do?

• ignores PDH_CALC_NEGATIVE_VALUE and PDH_INVALID_DATA type errors from the event output
• adds cstatus value in the debug information

Why is it important?

When collecting a high number of counters values seems that for specific processes the counter values retrieved are negative and the win32 api returns the error:

0x800007D8 (PDH_CALC_NEGATIVE_VALUE) | A counter with a negative value was detected.

or

0xC0000BC6 (PDH_INVALID_DATA) | The data is not valid. with cstatus 0xC0000BBA (PDH_CSTATUS_INVALID_DATA) | The returned data is not valid.

Which means the counter was successfully found, but the data returned is not valid. This error can occur if the counter value is less than the previous value. (Because counter values always increment, the counter value rolls over to zero when it reaches its maximum value.) Another possible cause is a system timer that is not correct.

These errors do not cause the application to run unsuccessfully and the following calls return a positive value.
These types of errors are still logged as debug messages.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

Create a perfmon configuration with a high number of perfmon counters including Process object counters since the errors are encountered only at that level and run the perfmon metricset with a small interval.

Related issues

• Closes windows/perfmon metricset - handle win32 api errors in the events #18292

Logs

	Line 236493: 2020-05-07T18:18:27.118+0200	DEBUG	[perfmon]	perfmon/data.go:51	Counter value retrieval returned	{"error": "A counter with a negative value was detected.", "cstatus": "A counter with a negative value was detected.", "perfmon": {"query": "\\\\DESKTOP-RFOOE09\\Process(SearchFilterHost)\\IO Other Bytes/sec"}}
	Line 236494: 2020-05-07T18:18:27.144+0200	DEBUG	[perfmon]	perfmon/data.go:51	Counter value retrieval returned	{"error": "A counter with a negative value was detected.", "cstatus": "A counter with a negative value was detected.", "perfmon": {"query": "\\\\DESKTOP-RFOOE09\\Process(SearchFilterHost)\\% Processor Time"}}
	Line 273453: 2020-05-07T18:18:42.141+0200	DEBUG	[perfmon]	perfmon/data.go:51	Counter value retrieval returned	{"error": "The data is not valid.", "cstatus": "The returned data is not valid.", "perfmon": {"query": "\\\\DESKTOP-RFOOE09\\Process(backgroundTaskHost)\\IO Read Bytes/sec"}}
	Line 273454: 2020-05-07T18:18:42.159+0200	DEBUG	[perfmon]	perfmon/data.go:51	Counter value retrieval returned	{"error": "The data is not valid.", "cstatus": "The returned data is not valid.", "perfmon": {"query": "\\\\DESKTOP-RFOOE09\\Process(backgroundTaskHost)\\IO Write Operations/sec"}}

[elasticmachine]

Pinging @elastic/integrations (Team:Integrations)

[elasticmachine]

💚 Build Succeeded

Expand to view the summary

Build stats

• Build Cause: [narph commented: Jenkins run the tests please]

• Start Time: 2020-05-13T12:01:41.041+0000

• Duration: 77 min 55 sec (4615019)

Test stats 🧪

Test	Results
Failed	0
Passed	2325
Skipped	560
Total	2885

Steps errors

Expand to view the steps failures

• Name: Report to Codecov

  • Description: curl -sSLo codecov https://codecov.io/bash for i in auditbeat filebeat heartbeat libbeat metricbeat packetbeat winlogbeat journalbeat do FILE="${i}/build/coverage/full.cov" if [ -f "${FILE}" ]; then bash codecov -f "${FILE}" fi done

  • Result: FAILURE

  • Duration: 2 min 22 sec

  • Start Time: 2020-05-13T13:14:56.102+0000

  • log

[narph]

jenkins test this please

[narph]

Jenkins run the tests please