Skip to main content

Fleet-Wide Questions

Most tickets are about one computer: an app that crashes, a slow connection, a backup that failed. Fixing it closes the ticket, but you still do not know whether other computers have the same problem, or whether the computer in the ticket is even the one causing it.

The SparkLogs Agent on each Windows device keeps a record of what happens there: event logs, crashes, driver and software changes, services, disk space, network and sign-ins. With the agent on your devices and an AI assistant such as Claude or Microsoft Copilot connected to SparkLogs, you can ask about one client, or every device you manage, in one question.

The examples below are the ones in the video, inspired by problems MSPs have found in their own fleets.

Does anyone else have this problem?​

Over three days, three people at two clinics file the same ticket: the patient intake app crashes when they scan a document. Each ticket looks like one bad PC.

Paste the three tickets into your AI, or name them if it can read your PSA, and ask for the cause.

You:  Root cause these 3 tickets.
AI:   On all 3 machines, intake.exe crashes while scanning.
      Faulting module in every crash: the scanner's TWAIN driver.
      All 3 got scanner driver 9.5.1 (from 9.4.0) on Fri 9 Oct before 04:00.
      Crashes while scanning start that morning.
      Likely cause: the scanner driver update.
      Next: roll the driver back to 9.4.0. One fix covers all 3 tickets.

Then ask about the machines that have no ticket.

You:  Who else is affected?
AI:   16 machines at 5 clients have scanner driver 9.5.1, installed Fri 9 to Mon 12 Oct.
      13 run intake.exe, and all 13 crash while scanning.
      10 of the 13 have no ticket yet. 3 of the 5 clients have not called at all.
      The other 3 do not run intake.exe and show no crashes.

You can roll the driver back on all 13 and contact the three clients that have not called. The AI knows which machines have a ticket only if it can also read your PSA. Without that, you still get the list of 13.

Open this example in the live demo.

The same question works for other failures:

  • "That same Veeam failure, did it hit other machines in the same window?"
  • "We just closed a print spooler ticket on one box. Who else is showing the early signs?"

Is the cause on a different machine?​

Sometimes the computer in the ticket is working fine, and the cause is another device at the same office.

Harbor Dental has two PCs. The office says its internet is slow every night and first thing in the morning.

You:  Harbor Dental says their internet is slow at night and first thing in the morning. Why?
AI:   hd-pc-01: internet round trip about 80 ms by day, 915 ms from 22:00 to 08:30.
      Lowest round trip stays about 45 ms on both PCs, so the delay is traffic queueing
      on a full line.
      hd-pc-02 uploads about 18 Mbit/s overnight, most of the line. Top process: filesync.exe.
      Likely cause: one PC's overnight upload fills the office's internet line.
      Next: limit filesync.exe's upload rate on hd-pc-02.

Staff start at 07:30 while the upload is still running, so mornings are slow too.

Open this example in the live demo.

The live demo has two more:

  • A clinic's front desk Wi-Fi slows down every afternoon even though the signal is strong. Another machine's afternoon backup started sending about ten times more over the same Wi-Fi after a driver update. Open the example.
  • A law firm's laptops cannot reach anything by name one morning. The domain controller's DNS Server service crashed in the night and stayed stopped. Open the example.

What needs someone today?​

Some problems have no ticket because nobody has noticed them yet. At the start of the day, ask about everything you manage.

You:  Across my fleet, what needs a person today?
AI:   Needs a person (3)
      Westbrook Design, wb-pc-04: a remote PC moved to a network that puts it directly on
        the internet, then its firewall turned off. Failed sign-ins since, now about
        100 an hour, nearly all against Administrator. None succeeded.
        Do: turn the firewall on and lock down sharing.
      Northside Legal, nl-dc-01: DNS Server service stopped at 02:14 and has not restarted.
        Do: start it, then read the System log around 02:14.
      Ridge Engineering, re-fs-01: Windows cannot make a shadow copy of D: right now,
        not enough space.
        Do: free space on D: or give shadow storage more room.
      Nothing needs a person at your other clients.

Your RMM alerts on the conditions it was set up to watch, like a full disk or an offline agent. This question also covers what nobody set up a monitor for. The PC at Westbrook is an example. Its user had no symptom to report.

Open the exposed PC example or the shadow copy example in the live demo.

To get this list every morning without asking, run the question on a schedule. Any automation tool that connects to SparkLogs over MCP, the same connection your AI assistant uses, can run it and post the answer where your team works. See Connect MCP.

Is every machine set up the way it should be?​

Ask about the software every machine at a client should have.

You:  Lakeside Clinic: which machines lack backups or endpoint protection?
AI:   12 of 14 have both running.
      reception-05 has no backup agent.
      Protection is stopped on lab-pc-02, since Mon 12 Oct 16:02.
      Do: install the backup agent on reception-05. Start protection on lab-pc-02
      and find out why it stopped.

The AI answers from the installed software and the services the agent recorded on each machine.

Which devices stopped reporting?​

You:  Which devices stopped reporting this week?

When the agent knows why a device went quiet, the answer says so: the device shut down, the agent service was stopped, or an agent upgrade started and has not finished. Start with the devices that went offline without a reason. See Collection health.

In the app, Fleet Health lists every device, with the ones that need attention at the top.

Tips​

  • Say which clients you mean: one client, or "across all clients". If you leave it out, the AI asks before it searches.
  • Give a time when you have one. "Since the driver update on Friday" narrows the search.
  • Open the devices in an answer. Each one links to its page in the app at the time the AI is talking about, so you can check the evidence before you act.
  • Ask follow-up questions. "Which of those are at Maple?" builds on the answer you already have.
  • For a full write-up of one device, run an investigation, which produces a cited report for the ticket.

What it cannot see​

  • Anything that happened before the agent was installed.
  • Devices without the agent. It runs on Windows today, and macOS and Linux agents are on the roadmap.
  • Systems that are not endpoints, such as a cloud security console or a NAS, until you send their logs to SparkLogs another way.