Skip to main content

Reference

Data feeds​

The SparkLogs Agent reads Windows event channels and servicing log files from an endpoint, and each stream it collects is one feed. The feed list names the channels each feed binds, the event ids and provider names behind them, and every curated reason it scores. Use it to tell whether a failure you are chasing is already collected, and which reason code it arrives under.

Health topics​

The Agent also measures the endpoint directly on a schedule: disks and volumes, services, drivers, installed products, its own collection health. Each area is one topic, and a topic raises a condition while a bad state holds, an occurrence when something happens once, and a change when an inventory differs from its last report. The health topic list names what each topic measures and how many readings it can raise.

Workloads​

A workload is something a client depends on: a SQL Server, a domain controller, a Hyper-V host. SparkLogs recognizes one from evidence. Today the Agent reads that evidence off a host, from the services, writers and files present on it. SaaS tenants, cloud environments and network devices reaching us over syslog come later. Signals that touch a workload are tagged to it, and a question about the workload answers across every place it runs. The workload list names the evidence behind each one, which tells you what SparkLogs will recognize in your estate.

Config changes​

Some of what a feed carries is not a fault at all but a change somebody made: a service installed, a group given a new member, an audit policy edited. Those arrive as change rows naming the object, what was done to it and which object it was. The change catalogue lists every kind of object SparkLogs reports a change to and the sources that report it.

Diagnostic themes​

Every signal a feed or a topic produces is filed under one theme, the kind of problem it belongs to, such as crashes and hangs or patching and servicing. The theme list is where to start when you know the symptom and not yet the source.

Code reference​

Windows reports most failures as a number. The Agent decodes the number where the event is collected, and the event then carries the name Windows publishes and the meaning beside the code. The code reference publishes those tables in full for the times a code reaches you from somewhere else.