Windows Update agent state
Whether this host is scanning, paused, or falling behind on updates.
Topic id: windows_update_agent_state.
Full inventory every 6 hours. Supported changes are reported when the agent observes them.
Fields
Update scan activity and the age of available results.
| Field | Type | Unit | Meaning |
|---|---|---|---|
sparklogs.data.windows_update_agent_state.updates_paused | bool | Whether Windows Update is currently paused on this host. | |
sparklogs.data.windows_update_agent_state.updates_paused_age_h | float | hours | How long the pause has been in force. Absent when the pause start stamp is present but cannot be parsed, which leaves the posture on the row and the duration unclaimed. |
sparklogs.data.windows_update_agent_state.last_scan_age_h | float | hours | How long since Windows Update last completed a scan for updates. |
sparklogs.data.windows_update_agent_state.wuauserv_start_type | string | The start type configured for the Windows Update service: boot, system, auto, auto_delayed, manual or disabled, or missing when the service is not installed. Absent when the service table or its configuration could not be read, never a reassuring default. | |
sparklogs.data.windows_update_agent_state.patch_updates_paused_basis | string | onset: witnessed start. observed: already present when first seen, making age a lower bound. unknown_ongoing: no meaningful onset time. |
Conditions
A condition is a state that holds for a while. The agent opens it when the host enters it, keeps it open while it lasts, and closes it when the host comes back out, so one episode answers for the whole stretch instead of one alert per sample.
Example
Inventory (every 6 hours)
windows update posture; last scan 6h00m ago, service auto_delayed.
sparklogs.data.windows_update_agent_state.updates_paused: false
sparklogs.data.windows_update_agent_state.wuauserv_start_type: auto_delayed
sparklogs.data.windows_update_agent_state.last_scan_age_h: 6.0
SparkLogs: CONTEXT, Info, windows_update_agent_state: INVENTORY: windows update posture; last scan 6h00m ago, service auto_delayed.
Selected conditions
patch_scan_stale
Windows Update scan data is stale.
Also reported by: Windows Update agent state
Impact: Patch status may be unknown and pending updates may be missed.
Example
started; last scan 700h04m ago (threshold 336h00m)
sparklogs.data.windows_update_agent_state.last_scan_age_h: 700.08
SparkLogs: patch_scan_stale, Warning, windows_update_agent_state: patch_scan_stale: NOTABLE: started; last scan 700h04m ago (threshold 336h00m)
Example
cleared after 0h15m, peaked Warning, relapses 1; last scan 1h19m ago (clears below 336h00m)
sparklogs.data.windows_update_agent_state.last_scan_age_h: 1.33
SparkLogs: patch_scan_stale, Info, windows_update_agent_state: patch_scan_stale: RECOVERED: cleared after 0h15m, peaked Warning, relapses 1; last scan 1h19m ago (clears below 336h00m)
| Case | Severity | Ticket class |
|---|---|---|
onset | Trace to Fatal | patching |
held | Trace to Fatal | patching |
recovered | Trace to Fatal | patching |
patch_updates_paused
Windows Updates are paused for too long.
Also reported by: Windows Update agent state
Impact: Security and reliability updates may be deferred past policy intent.
Example
started; paused for 504h04m (threshold 336h00m)
sparklogs.data.windows_update_agent_state.updates_paused: true
sparklogs.data.windows_update_agent_state.updates_paused_age_h: 504.08
SparkLogs: patch_updates_paused, Error, windows_update_agent_state: patch_updates_paused: NOTABLE: started; paused for 504h04m (threshold 336h00m)
Example
cleared after 0h15m, peaked Error, relapses 1; updates resumed
sparklogs.data.windows_update_agent_state.updates_paused: false
SparkLogs: patch_updates_paused, Info, windows_update_agent_state: patch_updates_paused: RECOVERED: cleared after 0h15m, peaked Error, relapses 1; updates resumed
| Case | Severity | Ticket class |
|---|---|---|
onset | Trace to Fatal | patching |
held | Trace to Fatal | patching |
recovered | Trace to Fatal | patching |