Skip to main content

IT Fleet Intelligence

You already have an RMM. Keep it. It fires when a known condition is on its list, and it rolls the rest up so the console stays usable.

The expensive tickets are the ones outside that list: a backup that fails with a useless error code, a lockout no monitor watches, "is this one box or is it starting across the client?" Those still cost a senior engineer an RDP session and an hour of reading logs.

IT fleet intelligence is being able to ask those questions in plain language, across one host, one client, or every endpoint you manage.

The lightweight SparkLogs Agent on each endpoint records the logs plus the system state a senior engineer would collect by hand (CPU, memory and disk over time, installed software, service and VSS writer state, patch results), and SparkLogs lets the AI tools you already use query all of it. Agentic RCA is the multi-step version: your AI decides what to look at next from what it just found, and comes back with findings you can open and check.

Ask a question​

With the plugin or MCP connected, ask in plain language.

  • "Why did this file server reboot at 2am?"
  • "Backups on this client have failed three nights running. What changed?"
  • "This server crawls every afternoon. What is it doing?"
  • "Who ran PowerShell on this box yesterday, and what did it touch?"
  • "How many endpoints at this client saw account lockouts today?"
  • "Alice's account was compromised yesterday at 3:32pm. What did it reach afterwards?"
  • "What is failing across my fleet today that was not failing last week?"

Keep asking follow-ups. Chat is a conversation with the data and goes as deep as the issue warrants.

Two commands add a document on top of that conversation:

  • /sparklogs-investigate writes the ticket version: a cited system-condition report of what was observed in the window, links you can open in Explore, and an explicit list of what it could not see. Run it when you want the write-up, not because the question is hard.
  • /sparklogs-analyze-cause takes that report and proposes candidate causes, each with what would confirm or refute it.

Two ways in​

  1. Skills plugin. Claude Code, Cursor, or Codex. Ask about a client, investigate a ticket, and produce the write-up without leaving the tool you work in. Follows the agentskills.io standard. Connect the plugin.

  2. MCP (your automation). If you already wire PSA, RMM, and other tools into custom agents, add SparkLogs as the evidence source. Same workspace, scoped tokens. Connect MCP.

What to evaluate​

The log usually names the symptom. The cause usually lives in state nobody logged: disk pressure at job time, a VSS writer that was already failed, what installed that morning, memory that had been climbing for a week.

So the question to ask of any AI answer is what data it actually saw. Answers here cite the query behind each claim, and investigations list what stayed outside visibility. That is what you can put on a ticket and stand behind with a client.

FAQ​

Next​