Skip to main content
SparkLogs Foundry · Cohort intake open

Bring agentic IT diagnostics to your service desk.

An invitation-only program for MSPs to work with us on an IT fleet intelligence layer so engineers can close hard tickets in minutes, not hours.

Learn More
diagnose a failing laptoplive demo
Watch a live investigation
A real SparkLogs MCP session with Claude
9 chapters~3 mininteractive
Open the demo
Fleet-wide IT Intelligence

Hunt issues proactively. Uncover the blast radius.

SparkLogs curates data from every endpoint 24/7. Ask across the fleet to hunt issues, analyze security risks, and discover blast radius. Get who is affected, what they have in common, and what to do next.

Northridge50 endpointsLakeview112 endpointsHarborview62 endpointsWestgate92 endpoints
316 endpoints · 4 clients · 57 serversPick a question to sweep the fleet
Sources drawn on:Storage IOWindows servicingSystem logSystem identity
Connected to SparkLogs
Claude · Copilot · Codex · MCP
Answers name the sources they drew on.Connect your AI
Root-cause Analysis

Simultaneously analyze every signal relevant to a tough ticket. Fix it faster.

Every endpoint sends logs and health metrics to SparkLogs continuously. We curate that into named signals by source and ticket theme plus pattern groups. Your team can then use AI to analyze all the data all at once to pinpoint the root-cause behind IT issues. See all data feeds

It crashed or hungCrashes and hangsDisk is full or failingStorage and filesystemBackups failingBackup and VSSPatch broke somethingPatching and servicingAccount compromisedSecurity and identityNetwork flakyNetworkWhy is this server slowPerformance and capacityWhat changed on this boxConfiguration drift
Windows event log feeds · curated event streams
System log1 channel · 75 curated reasons
Application log1 channel · 44 curated reasons
Security log1 channel · 60 curated reasons
Microsoft Defender2 channels · 13 curated reasons
Windows servicingSetup log, CBS log, DISM log · 32 curated reasons
Device health topics, measured on the machine
StorageVolumes, Device IO, Devices, Storage IO, Volume map · 10 signals
Backup and VSSShadow storage, Writers · 3 signals
System identityMachine identity and posture, including whether a reboot is pending.
curated today (# of signals)drawn on for this answerno signal yetAll 34 feeds and topics, 8 themes
Connected to SparkLogs
Claude · Copilot · Codex · MCP
Answers name the sources they drew on.Connect your AI
Tracked problems

Track and correlate problems across time and severity on curated signals.

Event logs only show a moment. SparkLogs tracks each problem over time: how severe it is now, whether it's getting better or worse, and related events and metrics. This allows your engineers + AI to catch and fix problems early.

MonTueWedThuFriSatSun
patch window
now
Northridge
disk latency degradednr-fs-01
open 4d · subsiding
disk latency degradednr-app-02
cleared Sat
storage controller resetnr-db-01
5 occurrences
DCOM activation timeoutnr-dc-01
first seen · cleared
Lakeview
logon failed ×41lv-ws-114
Thu 3:39pm to 3:43pm
security agent service terminatedlv-ws-041
open 3d · unchanged
Kerberos PAC verification failedlv-dc-01
Thu 3:47pm
Harborview
IIS app pool failurehv-web-01
cleared · then again Thu
data volume space low · D:hv-fs-02
open 3d · rising
shadow storage near caphv-fs-02
open
VSS writer failedhv-fs-02
SQL Server writer · nightly 01:58
audit log clearedhv-fs-02
Thu 4:02pm
NoticeWarningSeriousCriticaloccurrenceepisode, open to cleared
Connected to SparkLogs
Claude · Copilot · Codex · MCP

How it works

01

Capture

Our lightweight agent captures logs plus deep system state and health on every endpoint you manage; other data (e.g., firewall logs) can be ingested via open source shippers and protocols.

02

Curate

Each stream is analyzed in realtime and becomes named signals with graded severity and grouped into patterns. Notable conditions are tracked over time as problems arise.

03

Ask

Use your own AI systems (Claude, Codex, Copilot, any MCP). Run /sparklogs-investigate through MCP or the skills plugin. Analyze one device or 1000s. Every finding links to the data behind it for further inspection.

Foundation

Petabyte-scale data engine

Schemaless ingest with no indexes to configure. Query hundreds of billions of events in under 10 seconds. Explore with full-text search, adaptive-scale querying, histogram zoom, pattern analysis, and field pivots. Optionally replicate data to your own object storage archive.

Workloads and signals we monitor

All 34 feeds and topics
WorkloadSQL Server6 sources cover itWorkloadDomain controller4 sources cover itWorkloadDNS server2 sources cover itWorkloadHyper-V host5 sources cover itEvent feedSystem logThe System channel: service, driver, disk, network, cluster and hardware faults from the operating system itself.Event feedSecurity logThe Security channel: sign-in outcomes, privilege use, directory changes and audit policy changes.Device healthStorage5 sources · 10 signalsDevice healthBackup and VSS2 sources · 3 signals

Make IT problems die young

IT Fleet Intelligence
Ask your fleet anything
- what new failures are happening this week we haven't seen before?
- strange IO slowdowns after patch tuesday. why? who's affected?
- we just fixed VPN flakiness on the lakeview ts. anyone else affected?
- bob's account got hacked at 3:43pm. audit everything. impact?
Any question, any scope
One host, one client, or the whole fleet
Logs plus deep system state
CPU, RAM, IO and disk trends, projected forward. Snapshots plus instant deltas: services and VSS, BitLocker, leaks and blue screens, patch and servicing state, installs, event logs
Fleet-wide patterns before they become tickets
Spot issues emerging across clients from curated endpoint data
Learn about IT Fleet Intelligence
Agentic RCA · cited evidence
From question to root-cause and ticket-ready report
- ticket 7623 is off track. dig in and write it up
- backups failed on fs-02 three nights running. why?
- why is lakeview file server super slow every afternoon?
- why did dc-01 at northridge reboot at 2am last night?
/sparklogs-investigate writes the report
Your agent queries fleet evidence, follows what it finds, and returns a cited root-cause report in minutes
Works where you work
Claude, Microsoft Copilot, Cursor, Codex, or your own MCP agents
Open-source skills, cited reports
/sparklogs-investigate writes the ticket-ready report; click any claim to verify the evidence; then dive deep into likely root causes and fixes
Connect your AI
A note from our founder

“We didn’t start with a product idea. We started with a problem we couldn’t put down.”

Twenty years building Axcient for 5,000+ MSPs meant fighting an ocean of logs every day. SparkLogs is the data layer we wished we had: petabyte scale, near zero overhead to manage, and with automatic pattern analysis and data extraction.

AI changed what one engineer can get done in a day, but an agent is only as good as the evidence it can see. Our mission: put the joy back into IT, so your team can deliver service clients rave about and be home in time for dinner.

Kevin Hoffman
Kevin Hoffman
Founder & CEOPreviously co-founder, Axcient
Our story
Ticket #4781 · same data, two paths
FILE SERVER IS INTERMITTENTLY SLOW
"Started this morning, no recent changes reported."
Manual today
Senior engineer, by hand
~60 min
With SparkLogs
Same engineer plus AI partner
~5 min
Time reclaimed12× faster
Find Out How