Health Topics
The SparkLogs Agent measures the endpoint itself on a schedule and reports each area as one topic. A topic raises a condition while a bad state holds, an occurrence when something happens once, and a change when an inventory differs from its last report.
| Topic | What it reports | Readings | Status |
|---|---|---|---|
| Agent overhead | What the SparkLogs agent stack itself costs the host: CPU, working set and handles. | 3 | Live |
| Agent pipeline | The agent spool and delivery pipeline: how much is queued and when it last drained. | 0 | Live |
| Collector health | Per-collector health for the shipper the agent runs. | 0 | Live |
| Crash dump configuration | Whether this host can write a usable crash dump when Windows or an application crashes. | 1 | Live |
| Crashes | Windows and application crashes with decoded error details and local dump analysis when available. | 3 | Live |
| Disk volumes | Every fixed volume: free space, fill trend, protection state and whether the filesystem is readable. | 7 | Live |
| Device drivers | The device drivers installed on the host, and what changes about them between reports. | 3 | Live |
| Feed health | Per-feed health for the inputs the agent is shipping. | 0 | Live |
| Installed products | The installed-product inventory the agent reads from the host. | 3 | Live |
| Installed product summary | A rolled-up view of installed products, including protection-category coverage. | 0 | Live |
| Host performance | Whole-host CPU and memory posture over a measured window. | 6 | Live |
| Processes | Per-process cost: CPU, working set, handles and sustained growth. | 1 | Live |
| Windows services | Service configuration and run state, including automatic services that are not running. | 3 | Live |
| Storage device IO | Per-device IO posture, including a device that is busy but moving almost nothing. | 1 | Live |
| Storage devices | The physical and virtual storage devices attached to the host. | 0 | Live |
| Storage IO | Storage throughput, queues and response time per volume. | 2 | Live |
| System information | Machine identity and posture, including whether a reboot is pending. | 5 | Live |
| Top processes | Processes selected by CPU, resident memory and read/write I/O, plus system CPU and an unlisted-process remainder. | 0 | Live |
| Volume map | How volumes map onto devices and partitions. | 0 | Live |
| VSS shadow storage | Shadow-copy storage allocation and how close it is to its cap. | 2 | Live |
| VSS writers | VSS writer state, the canonical evidence behind a failed backup. | 1 | Live |
| Windows Update agent state | Whether this host is scanning, paused, or falling behind on updates. | 2 | Live |
A planned topic is one the fleet does not send yet. Everything else is arriving from endpoints running a current Agent.