Skip to main content

SparkLogs Agent Overview

The SparkLogs Agent runs on each Windows endpoint and server and records what happens there: Windows event logs, application log files, crashes, configuration changes, performance, network health, and the state of disks, services, drivers and installed software.

It needs no configuration. On each machine it finds the operating system's logs and the logs of the applications installed there, and collects dozens of system health readings every few minutes. It analyzes what it collects on the machine, marks the events and changes that are notable, and tracks each problem as a condition until it clears.

The agent is a download under 15 MB and uses under 100 MB of memory. It is managed from the cloud and updates itself with signed updates, so you do not patch or configure each endpoint by hand.

In the SparkLogs cloud, AutoExtract finds the fields in each event and AutoClassify groups events into patterns. The device timeline shows each device's history, and your AI can answer questions across the fleet.

You deploy the agent with a registration token, and roll it out across a fleet from your RMM, GPO or Intune.

SparkLogs Agent vs Ingest Keys​

There are two ways to get data in. Pick by how you run your systems:

  • Use the SparkLogs Agent for endpoints you manage (servers, workstations) and for MSP fleets. SparkLogs keeps the agent software up to date, and in client-org mode each endpoint enrolls into its client's organization, which is created for you.
  • Use an Ingest Key when you already run a log collector (OpenTelemetry, Vector, Fluent Bit, Logstash, Beats, Grafana Alloy) or ship logs via an SDK or API.

Security Highlights​

The agent opens no inbound ports and has no way to run code remotely. It is written in pure Rust, has two signature chains (Authenticode on the installer and TUF on staged updates), and gives each agent its own credential with clone detection.

See Agent security and the Trust Center agent section for the full model.

Supported Platforms​

Windows​

Officially supported:

  • Windows 10 or later (x64)
  • Windows Server 2016 or later (x64)
  • Windows Server Core 2016 or later (x64)

Unofficially supported:

  • Windows 8.1 or later (x64)
  • Windows Server 2012 R2 or later (x64)
  • The agent will install and run on these platforms, but non-core functionality may vary based on what the system can support. For security, outbound HTTPS requires TLS 1.2 (or better). On Windows 8.1 and 2012 R2, Schannel enables TLS 1.2 by default, but customized or lightly patched hosts may need Windows updates or policy changes. See Microsoft's Enable TLS 1.2 on clients and Schannel protocol defaults by OS version.

Not supported but may be supported in the future:

  • x86 (32-bit) versions of Windows
  • ARM64 versions of Windows
  • Contact us if you'd like to see this supported so we can prioritize based on demand

Not supported and no plans to support:

  • Versions of Windows older than Windows 8.1 or Windows Server 2012 R2.

macOS and Linux​

A SparkLogs Agent for macOS and Linux is on the roadmap. Until then, ingest data from these systems with an Ingest Key and an open source log collector.

Other environments​

For anything else, use an Ingest Key with a supported open source log shipper. That covers syslog (firewall logs, for example), Azure Functions, OpenTelemetry, and the sources that Vector and the OpenTelemetry Collector read.

Network requirements​

The agent sends its data over outbound HTTPS with TLS 1.2 (or better) and needs no inbound ports.

To measure network health, the agent also probes the default gateway, an internet target and DNS every few minutes. The DNS probe looks up fresh names under conncheck.itlightning.app. If a DNS filter in front of your devices blocks unknown names, allow conncheck.itlightning.app and its subdomains so the agent can measure DNS latency. Otherwise the device shows the DNS probe as blocked by a DNS filter, and DNS latency is not measured on that network.

Next steps​

  1. Create a registration token
  2. Choose your deployment scope
  3. Download and verify the installer
  4. Deploy the agent
  5. IT Fleet Intelligence once data is flowing (chat, RCA, or MCP)