Skip to main content

Manage and Verify Agents

After you deploy, manage your fleet from the Agents list and confirm each endpoint is reporting.

The Agents list​

Open Configure in the sidebar, then the Agents tab. The Agents list shows:

  • Last-seen freshness for each agent, so you can spot endpoints that stopped reporting.
  • Edit description to label an agent.
  • Delete and undelete, so a removed agent can be restored.
  • Clone detection, which flags agents that share a credential (for example, an image cloned without re-enrolling).

Confirm install on an endpoint​

The reliable presence check is the Windows service, not the MSI product code (the GUID changes across versions). The service name is SparkLogsAgent and its display name is "SparkLogs Agent":

Get-Service SparkLogsAgent

Use this same check in RMM and Intune detection rules. See RMM mass-deploy and Microsoft Intune.

Verify data is arriving​

Open Explore and confirm events from the endpoint are arriving in the expected organization.

If an agent does not appear or no data arrives, see Troubleshooting.

Uninstall and reinstall​

Uninstalling the agent removes the Windows service and binaries. By default, local enrollment data and agent state stay on the host, including any captured log data not yet uploaded. A reinstall on the same machine usually continues the same agent enrollment (same agent ID, organization, and workspace).

To wipe local enrollment data during uninstall, pass PURGE_STATE=1 on the uninstall command. This removes local identity and all agent state on the endpoint, including buffered log data not yet uploaded, agent logs, and crash dumps. It leaves the agent's Windows Event Log message file and event source registration in place, so the agent's past events still render correctly in Event Viewer. It does not delete the agent record in SparkLogs. Reinstalling after a purge is a fresh install and requires the registration token again. Even after a purge and reinstall, if you use the same registration token, the agent will usually be able to reconnect to its previous cloud identity based on the machine's system ID.

Silent uninstall with purge:

# Read MSI product code from registry
$productCode = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\SparkLogs\Agent' -Name ProductCode -ErrorAction Stop).ProductCode
# Uninstall the agent with PURGE_STATE=1 to clear agent identity and state
$p = Start-Process msiexec -Wait -PassThru -ArgumentList '/x',$productCode,'/qn','PURGE_STATE=1','/l*v',"$env:TEMP\SparkLogsAgent-uninstall.log"
# Exit code 0 means success, or 3010 means a reboot is required before uninstall is complete (uncommon)
$p.ExitCode

Omit PURGE_STATE=1 or uninstall via any other method for the agent to keep its identity and state.