Windows

1. Check redis-cli

Advanced collection needs redis-cli 6.2 or newer on the agent's host — that is when --json arrived. This is the client version, not the server's.

redis-cli --version

If it is missing or older, install a current Redis CLI (for example via the Memurai or Microsoft-maintained builds, or through WSL) and make sure its directory is on the systemPATH — the agent runs as a service, so a PATH set only for your user account will not be visible to it.

[Environment]::GetEnvironmentVariable("Path", "Machine") -split ';' | Select-String redis

2. Configure the agent

Open the config file:

C:\Program Files\watchlog-agent\integration.json

Find the Redis section:

{ "service": "redis", "monitor": false, "host": "127.0.0.1", "port": "6379", "username": "", "password": "", "tls": false }

3. Change `"monitor"` to `true` and adjust `host`, `port` and the credentials:
```diff
-  "monitor": false
+  "monitor": true

Redis 6+ with an ACL user → set both username and password
Redis 5, or requirepass only → set password, leave username empty

Restart the service:
```
Restart-Service -Name "WatchlogAgent"
```

Verify

redis-cli -h 127.0.0.1 -p 6379 --pass 'your_password' --no-auth-warning INFO server
redis-cli -h 127.0.0.1 -p 6379 --pass 'your_password' --no-auth-warning INFO commandstats
redis-cli -h 127.0.0.1 -p 6379 --pass 'your_password' --no-auth-warning SLOWLOG GET 1

Each one that succeeds is a section that will populate.

If these work from your PowerShell session but the agent reports nothing, the service account most likely cannot see redis-cli on its PATH.

TLS

{
  "service": "redis",
  "monitor": true,
  "host": "redis.internal",
  "port": "6380",
  "username": "watchlog_monitor",
  "password": "your_password",
  "tls": true
}

The agent uses the Windows certificate store. A private CA must be installed into Local Computer → Trusted Root Certification Authorities, not the current user's store, because the agent runs as a service.

Slow commands

Redis SLOWLOG is on by default, so this usually needs no setup. Check the threshold:

redis-cli CONFIG GET slowlog-log-slower-than

The value is in microseconds — 10000 is 10 ms, -1 disables logging. Watchlog reads this and shows it on the dashboard so you can tell an empty slowlog from a disabled one.

Watchlog never runs SLOWLOG RESET, and command arguments are redacted on your host before they leave it. See the integration overview for what survives redaction and why.