Skip to main content

Manage and Verify Agents

After you deploy, manage the fleet from Configure > Agents. Home dashboard notices for agents that need attention or are offline open this list with the matching filter (sub-orgs included).

When data is flowing, ask questions with AI or confirm a citation in Explore.

The Agents list​

Each row combines device type (workstation, server, or ingest key), connectivity, and collection in one badge.

Filter chips:

  • All
  • Needs attention (collection or health problems)
  • Offline (not checking in)
  • Inactive (silent for a long time)

Sort by health, name, or last check-in. Include sub-orgs is on by default so MSP fleets see client endpoints without an extra toggle.

You can still edit description, delete and undelete, and rely on clone detection (shared credential, for example a cloned image that did not re-enroll).

If a row says the agent is waiting for its data feed pack, classic Event Log collection has not started yet. That should clear quickly; if it lasts about an hour, see Troubleshooting.

Agent detail​

Select a row. The pane repeats the same status pills as the list, plus a plain-language line when the agent needs attention (including a stop reason when the Windows service stopped for shutdown, uninstall, or upgrade, instead of looking like a mystery offline).

Expanders:

  • Properties: organization, description.
  • System Details: OS, device class (workstation vs server, domain-controller role when reported), agent version, data feed pack version, update status, last ingest / health times.
  • Data feeds: per-feed collection (quiet and caught up vs behind or stuck), skipped-event notices on Event Log feeds, matched-file counts on file sources.

How automatic updates work​

The agent is cloud-managed. It checks the signed CDN for a newer build on your workspace release ring (canary, early-access, or stable), verifies signatures, and applies the update without a technician visit per endpoint.

How soon a published build is picked up depends on the ring: canary is about hourly, early-access is a few hours, stable is about once a day. The first check waits until after startup so a fleet reboot does not stampede the CDN. You can still force or pause updates according to workspace policy; the detail pane's update line is the operator view of that state.

See version and pack version on System Details after a successful apply (next check-in).

Confirm install on an endpoint​

The reliable presence check is the Windows service, not the MSI product code (the GUID changes across versions). The service name is SparkLogsAgent and its display name is "SparkLogs Agent":

Get-Service SparkLogsAgent

Use this same check in RMM and Intune detection rules. See RMM mass-deploy, NinjaOne, and Microsoft Intune.

Verify data is arriving​

Open Explore and confirm events from the endpoint are arriving in the expected organization.

If an agent does not appear or no data arrives, see Troubleshooting.

Uninstall and reinstall​

Uninstalling the agent removes the Windows service and binaries. By default, local enrollment data and agent state stay on the host, including any captured log data not yet uploaded. A reinstall on the same machine usually continues the same agent enrollment (same agent ID, organization, and workspace).

To wipe local enrollment data during uninstall, pass PURGE_STATE=1 on the uninstall command. This removes local identity and all agent state on the endpoint, including buffered log data not yet uploaded, agent logs, and crash dumps. It leaves the agent's Windows Event Log message file and event source registration in place, so the agent's past events still render correctly in Event Viewer. It does not delete the agent record in SparkLogs. Reinstalling after a purge is a fresh install and requires the registration token again. Even after a purge and reinstall, if you use the same registration token, the agent will usually be able to reconnect to its previous cloud identity based on the machine's system ID.

Silent uninstall with purge:

# Read MSI product code from registry
$productCode = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\SparkLogs\Agent' -Name ProductCode -ErrorAction Stop).ProductCode
# Uninstall the agent with PURGE_STATE=1 to clear agent identity and state
$p = Start-Process msiexec -Wait -PassThru -ArgumentList '/x',$productCode,'/qn','PURGE_STATE=1','/l*v',"$env:TEMP\SparkLogsAgent-uninstall.log"
# Exit code 0 means success, or 3010 means a reboot is required before uninstall is complete (uncommon)
$p.ExitCode

Omit PURGE_STATE=1 or uninstall via any other method for the agent to keep its identity and state. NinjaOne's native Uninstall Program is a non-purge path; see NinjaOne.