Agent Identity and Cloning
Every endpoint running the SparkLogs Agent has one device record in your workspace. That record carries the endpoint's history: its events, its collection health, and the organization (for most MSPs, a client) it belongs to. Great care has been taken so that the identity is preserved even under unusual conditions.
What keeps its identity
The same device record is kept across:
- Agent reinstalls, including an uninstall that wipes local enrollment state (
PURGE_STATE=1) followed by a fresh install with any registration token from your workspace. - Reimaging a machine from its own backup image, including a rebuild back to a known-good baseline.
- Daily disk-restore tools that revert the system volume on every reboot, such as Deep Freeze. A machine that is thawed and refrozen every night keeps one device record rather than adding one per day.
- Hostname changes, including the display-name churn a VPN connection can cause. A device is never given a new identity because its name changed.
A reinstall returns the endpoint to its existing device record and to the organization that record already belongs to. Any registration token in your workspace does that, not only the token the endpoint first enrolled with, so an endpoint that is rebuilt and reports a different RMM or PSA client ID is not filed as a second device under a different organization. To move a device to another organization, use Change ownership; a reinstall with a different client's token does not do it. See Moving devices and organizations.
This logic ensures a 1:1 mapping between a device and its agent identity.
Enrollment does not fail on a stale identity
An install is never failed because the identity stored on the endpoint no longer matches a device record.
- A device that changed hands, or that is restored from a backup old enough that the record it names is gone, receives a fresh identity and starts collecting.
- Enrollments of the same endpoint that start at the same moment produce one device record, not several. Scripting a rollout across a fleet, or reimaging many machines at once, does not leave you with duplicate device records for one endpoint.
The one case where enrollment is refused on purpose is a device you deleted yourself. A deleted device stays deleted through later wipes and reinstalls until you undelete it on Configure > Agents.
Change which organization owns a device
You can move a device to another organization, and the move sticks through later reinstalls and restores. See Moving devices and organizations for what moves, what stays, and what you need.
Cloned machines
An image captured with agent enrollment data still on it, then deployed to many machines, gives every one of those machines the same starting identity.
SparkLogs handles this without any action from you:
- The duplication is detected automatically, and each machine is separated onto its own identity within a short period of both machines running.
- The machine that was there first keeps the original device record and its history.
- Each other machine receives its own device record and collects under it from then on.
- A machine that is split off and later rebuilt or restored returns to the record it already owns. Repeated wipe or restore cycles do not add new records.
Until the separation completes, the machines sharing one record are reported together on Configure > Agents, so the row's name and health can move between them. That settles once each machine is on its own record.
Separation needs both machines to be running and checking in. A pair whose second machine has been powered off for a long time stays on one record until it comes back. In rare cases, two machines are such complete copies of each other that no automatic check can tell them apart, and they stay on one record. The same can happen on hardware that does not report a distinguishing identity of its own. If a pair does not separate on its own, support can move one of the machines onto a fresh record remotely, with no visit to the endpoint and no reinstall. The machine collects under its new record from then on, and the record left behind is retired separately so you decide what happens to its history. Separating a pair this way needs agent 1.9.7 or later on the endpoint.
Even though cloning without preparation is supported, preparing the clone image is still worth doing: see Prepare a golden image for the steps that let every clone enroll with its own identity from first boot.
No duplicate data
A device that comes back from a reinstall, a reimage, or a nightly restore resumes where it left off. It does not re-upload log or telemetry data that already reached SparkLogs, so a fleet of frozen machines does not re-ingest the same history on every thaw.