Windows services

3readings

3conditions

1themes fed

Livestatus

Service configuration and run state, including automatic services that are not running.

Topic id: services.

Full inventory every 6 hours. Supported changes are reported when the agent observes them.

Fields

Service configuration, identity and observed run state.

Field	Type	Unit	Meaning
sparklogs.data.services.name	string		The service's name.
sparklogs.data.services.current_state	string		The service's current SCM state.
sparklogs.data.services.current_state_code	integer		Windows Service Control Manager numeric code for current_state.
sparklogs.data.services.pid	integer		ID of the process hosting this service. Absent when the service is not running.
sparklogs.data.services.start_type	string		Configured service startup type. Absent when the configuration could not be read.
sparklogs.data.services.auto_start	bool		Whether the service is configured to start automatically.
sparklogs.data.services.has_triggers	bool		Whether the service has startup triggers. A trigger-start service can legitimately be stopped.
sparklogs.data.services.delayed_in_boot_grace	bool		Whether this service is a delayed-auto-start service still inside its boot grace period.
sparklogs.data.services.stopped_with_an_error	bool		Whether the service's last stop carried a non-zero exit code.
sparklogs.data.services.stopped_exit_code	integer		The Win32 exit code the service last stopped with. Absent while the service is not stopped.
sparklogs.data.services.is_critical_category	bool		Whether the enrichment store's product-category inventory marks this service critical (for example an RMM agent). Absent when that inventory is stale or has not run.
sparklogs.data.services.service_is_important	bool		Whether the pack's service class table marks this service's tier important. false when the table does not classify the service or marks it ordinary or suppress.
sparklogs.data.services.service_is_classified	bool		Whether the Data Feed Pack classifies this service. False for an unclassified service.
sparklogs.data.services.service_class	string		The pack's service class for this service (backup, edr_av, database, mail, directory, virtualization, profiles, rmm, or platform). Omitted for a service the table does not mention.
sparklogs.data.services.service_class_code	integer		Numeric code for service_class.
sparklogs.data.services.service_role_on_host	bool		Whether this device has the role associated with the service class. False if the class has no role, the device lacks it, or role detection has not run.
sparklogs.data.services.svc_stopped_age_min	float	minutes	Minutes the service has been stopped. Absent while running or within its boot grace period.
sparklogs.data.services.svc_crash_count_24h	integer	count	How many times this service has crashed in the last 24 hours. Absent until the event-log crash scan has first run after a start, or while its reading is stale; zero when the scan ran and found none.
sparklogs.data.services.svc_crash_count_24h_by_id	object		The same 24-hour crash count broken out by the Windows Event Log id that recorded each crash.
sparklogs.data.services.svc_crash_first_seen_ts	string	timestamp	When the oldest crash counted in the current window was recorded.
sparklogs.data.services.svc_crash_last_seen_ts	string	timestamp	When the newest crash counted in the current window was recorded.
sparklogs.data.services.svc_crash_truncated	bool		Whether the crash count hit its cap: more crashes happened than the counter kept individually.
sparklogs.data.services.svc_crash_unresolved_count	integer	count	How many crash records could not be attributed to a specific service.
sparklogs.data.services.svc_crash_measured_at	string	timestamp	When this row's crash counts were measured.
sparklogs.data.services.service_auto_not_running_age_basis	string		onset: witnessed start. observed: already present when first seen, making age a lower bound. unknown_ongoing: no meaningful onset time.
sparklogs.data.services.service_auto_not_running_age_h	float	hours	How long this condition has been open, in hours.
sparklogs.data.services.service_flapping_age_basis	string		onset: witnessed start. observed: already present when first seen, making age a lower bound. unknown_ongoing: no meaningful onset time.
sparklogs.data.services.service_flapping_age_h	float	hours	How long this condition has been open, in hours.
sparklogs.data.services.service_stuck_pending_age_min	float	minutes	How long this condition has been open, in minutes.

Conditions

A condition is a state that holds for a while. The agent opens it when the host enters it, keeps it open while it lasts, and closes it when the host comes back out, so one episode answers for the whole stretch instead of one alert per sample.

Condition	Severity	How an episode ends
automatic service not running (service_auto_not_running)	Notice to Severe	It closes on a recovery rule written for this condition, which reads more than one measurement together.
service flapping (service_flapping)	Notice to Error	It closes when the measurement falls back past its recovery point.
service stuck pending (service_stuck_pending)	Warning to Error	It closes on a recovery rule written for this condition, which reads more than one measurement together.

Example

Inventory (every 6 hours)

2 automatic; 1 running, 1 expected stopped.

sparklogs.data.services.name: wuauserv
sparklogs.data.services.current_state: stopped
sparklogs.data.services.start_type: auto_delayed
sparklogs.data.services.service_is_important: true
sparklogs.data.services.service_class_code: 9
sparklogs.data.services.svc_stopped_age_min: 0.0
sparklogs.data.services.service_role_on_host: false
sparklogs.data.services.service_is_classified: true

SparkLogs: CONTEXT, Info, services: INVENTORY: 2 automatic; 1 running, 1 expected stopped.

Change set (every minute)

2 changed, 2 stopped; "-spooler" "-wuauserv".

sparklogs.data.services.delta_kind: changed
sparklogs.data.services.name: spooler
sparklogs.data.services.current_state: stopped
sparklogs.data.services.start_type: auto
sparklogs.data.services.svc_stopped_age_min: 0.0

SparkLogs: CONTEXT, Info, services: DELTA: 2 changed, 2 stopped; "-spooler" "-wuauserv".

Selected conditions

service_auto_not_running

An automatic service is not running.

Also reported by: Windows services

Impact: Expected background functionality may be unavailable until the service starts.

Example

started; service "spooler" state stopped, exit code 1067, stopped 0h03m (threshold 0h03m)

sparklogs.instance: service:spooler
sparklogs.data.services.name: spooler
sparklogs.data.services.service_is_important: true
sparklogs.data.services.service_class_code: 9
sparklogs.data.services.svc_stopped_age_min: 3.0
sparklogs.data.services.service_role_on_host: false
sparklogs.data.services.service_is_classified: true
sparklogs.data.services.service_auto_not_running_age_h: 0.0

SparkLogs: service_auto_not_running, Notice, services: service_auto_not_running: NOTABLE: started; service "spooler" state stopped, exit code 1067, stopped 0h03m (threshold 0h03m)

Example

cleared after 0h15m, peaked Error, relapses 1; service "spooler" state running (clears after 0h03m)

sparklogs.instance: service:spooler
sparklogs.data.services.name: spooler
sparklogs.data.services.service_is_important: true
sparklogs.data.services.service_class_code: 9
sparklogs.data.services.service_role_on_host: false
sparklogs.data.services.service_is_classified: true

SparkLogs: service_auto_not_running, Info, services: service_auto_not_running: RECOVERED: cleared after 0h15m, peaked Error, relapses 1; service "spooler" state running (clears after 0h03m)

Case	Severity	Ticket class
onset	Trace to Fatal	app_stability
held	Trace to Fatal	app_stability
recovered	Trace to Fatal	app_stability

service_flapping

A Windows service keeps crashing and restarting.

Also reported by: Windows services

Impact: The service may be unstable, unavailable between restarts, or masking a crash loop.

Example

started; service "spooler" crashes 24h 6 (threshold 3)

sparklogs.instance: service:spooler
sparklogs.data.services.name: spooler
sparklogs.data.services.service_is_important: true
sparklogs.data.services.svc_crash_count_24h: 6
sparklogs.data.services.service_flapping_age_h: 0.0

SparkLogs: service_flapping, Error, services: service_flapping: NOTABLE: started; service "spooler" crashes 24h 6 (threshold 3)

Example

cleared after 0h29m, peaked Error, relapses 1; service "spooler" crashes 24h 0 (clears at or below 1)

sparklogs.instance: service:spooler
sparklogs.data.services.name: spooler
sparklogs.data.services.service_is_important: true
sparklogs.data.services.svc_crash_count_24h: 0

SparkLogs: service_flapping, Info, services: service_flapping: RECOVERED: cleared after 0h29m, peaked Error, relapses 1; service "spooler" crashes 24h 0 (clears at or below 1)

Case	Severity	Ticket class
onset	Trace to Fatal	app_stability
held	Trace to Fatal	app_stability
recovered	Trace to Fatal	app_stability

service_stuck_pending

A Windows service is stuck pending.

Also reported by: Windows services

Impact: The service may not be usable and SCM may need intervention.

Example

started; service "wuauserv" state start_pending (Warning after 0h05m, Error after 0h30m)

sparklogs.instance: service:wuauserv
sparklogs.data.services.name: wuauserv
sparklogs.data.services.service_stuck_pending_age_min: 0.0

SparkLogs: service_stuck_pending, Warning, services: service_stuck_pending: NOTABLE: started; service "wuauserv" state start_pending (Warning after 0h05m, Error after 0h30m)

Example

cleared after 0h07m, peaked Warning, relapses 1; service "wuauserv" state running (settled threshold 0h05m)

sparklogs.instance: service:wuauserv
sparklogs.data.services.name: wuauserv

SparkLogs: service_stuck_pending, Info, services: service_stuck_pending: RECOVERED: cleared after 0h07m, peaked Warning, relapses 1; service "wuauserv" state running (settled threshold 0h05m)

Case	Severity	Ticket class
onset	Trace to Fatal	app_stability
held	Trace to Fatal	app_stability
recovered	Trace to Fatal	app_stability