Device Health Conditions

A condition is a named state the agent scores on a schedule. An episode opens when the state turns bad, escalates or recovers while it holds, and closes when the host comes back out, so one item covers the whole stretch. An occurrence is recorded once, with no episode and no close.

Conditions

A condition opens as an episode, escalates or recovers while it holds, and closes when the host comes back out.

Condition	Topic	What it means	What closes it	Severity
app_crash_recurring	Application crash recurrence	recurring application crashes	Ends when the program has gone 7 days without a crash, and the machine has spent at least 2 days of that time awake with its Application log read without a gap.	Display to Serious
cpu_busy	Host performance	cpu busy	Ends when the CPU spends less than 70% of its time near full load, and stays that way for 20 minutes.	Display to Notice
cpu_interrupt_storm	Host performance	cpu interrupt storm	Ends when servicing hardware interrupts and deferred procedure calls takes less than 20% of total CPU time for 20 minutes.	Warning to Error
cpu_kernel_dominated	Host performance	cpu kernel dominated	Ends when CPU load drops below 60%, or kernel-mode work outside interrupt handling falls below 60% of the busy time, and stays that way for 20 minutes.	Notice
cpu_throttled_under_load	Host performance	cpu throttled under load	Ends when CPU load drops below 60% or the clock is back to 80% of rated speed, and stays that way for 20 minutes.	Warning to Error
crash_dump_page_file_too_small	Crash dump configuration	page file too small for the dump	Ends when the page file falls short of the size the configured dump type needs by 10% or less.	Notice
data_volume_space_low	Disk volumes	data volume space low	Ends when the volume has either 13% or 13 GB free for 15 minutes, or becomes read-only.	Display to Warning
disk_latency_degraded	Storage device IO	disk latency degraded	Ends when no more than 1 five-minute period in the last hour has slow disk operations, and that holds for 4 hours.	Display to Error
disk_saturated	Storage device IO	disk saturated	Ends when the disk keeps up for 30 minutes: in nine of every ten ten-second stretches, responses average under 40 ms on an SSD, 200 ms on a hard disk or 100 ms on other media; or the queue shortens, or the load falls below 100 operations a second and 10 MB/s. A disk that stalls is reported as slow or unresponsive instead.	Display to Minor
disk_unresponsive	Storage device IO	disk unresponsive	Ends when the disk completes requests again with none stuck and the slower of reads and writes averaging under 1 s, or goes idle, for 20 minutes.	Minor to Critical
dns_lookup_redirected	Host performance	dns lookup redirected	Ends when lookups return the expected public addresses again, for example once someone signs in to the portal, or when the device moves to another network.	Display to Notice
kernel_crash_recurring	Crashes	recurring kernel crashes	Ends when the machine has gone 30 days without a blue screen, and has spent at least 5 days of that time awake with its System log read without a gap.	Display to Critical
kernel_driver_flapping	Kernel drivers	kernel driver flapping	Ends when the driver has loaded 1 or fewer times in the past hour, and stays there for 1 hour.	Notice
kernel_driver_installed_repeatedly	Kernel drivers	kernel driver installed repeatedly	Ends when the driver has been installed 3 or fewer times in the past hour, and stays there for 1 hour.	Display
network_adapter_dhcp_failed	Network adapters	network adapter dhcp failed	Ends when the adapter gets an address from a DHCP server, is given a static address, or disconnects.	Notice to Error
network_adapter_emulated	Network adapters	network adapter emulated	Ends when the virtual machine's adapter is replaced by the hypervisor's paravirtual model, or the emulated adapter goes down, for 15 minutes.	Display to Notice
network_adapter_link_downshifted	Network adapters	network adapter link downshifted	Ends when the link runs faster than 50% of its recent peak speed for 15 minutes, or the adapter disconnects.	Notice to Warning
network_adapter_saturated	Host performance	network adapter saturated	Ends when the busiest wired adapter carries less than 70% of its link speed for 15 minutes.	Display to Notice
network_ipv6_broken	Host performance	network ipv6 broken	Ends when fewer than 50% of recent IPv6 pings to the internet fail for 30 minutes. It also ends when more than 10% of IPv4 pings fail too, or the network stops routing IPv6.	Display to Notice
os_volume_space_low	Disk volumes	OS volume space low	Ends when the Windows volume has either 18% or 13 GB free for 10 minutes.	Notice to Severe
patch_scan_stale	Windows Update agent state	update scan is stale	Ends when the last completed Windows Update scan is less than 14 days old.	Warning
patch_updates_paused	Windows Update agent state	updates paused	Ends when Windows Update is resumed, or the pause in force is less than 1 day old.	Notice to Error
power_wake_loop	Host performance	power wake loop	Ends after 2 hours with no unattended wake.	Display
process_handle_count_high	Processes	process handle count high	Ends when the process holds fewer than 800,000 handles for 10 minutes, or the process exits.	Display
ram_commit_near_limit	Host performance	committed memory near its limit	Ends when committed memory drops below 86% of the most Windows can commit, with Windows no longer flagging commit as nearly exhausted, for 30 minutes.	Notice to Critical
ram_pressure	Host performance	memory pressure	Ends when available memory is back to 8% or more and paging is back to normal, for 1 hour.	Notice to Severe
service_auto_not_running	Windows services	automatic service not running	Ends when the service runs again, stops without an error, or is no longer set to start automatically, for 10 minutes. A service that hangs while starting or stopping is reported as stuck instead.	Display to Severe
service_flapping	Windows services	service flapping	Ends when the service has crashed 1 or fewer times in the past day, and stays there for 12 hours.	Display to Serious
service_stuck_pending	Windows services	service stuck pending	Ends when the service settles as running, stopped or paused for 30 minutes. A trigger-start service waiting in Starting for its trigger counts as settled.	Display to Severe
sparklogs_agent_cpu_over_budget	Agent overhead	sparklogs agent cpu over budget	Ends when the agent process averages under 16% of one CPU core for 6 minutes.	Notice
sparklogs_agent_handle_over_budget	Agent overhead	sparklogs agent handle over budget	Ends when the agent process averages fewer than 3,200 open handles for 6 minutes.	Notice
sparklogs_agent_memory_over_budget	Agent overhead	sparklogs agent memory over budget	Ends when the agent and its log collector together average under 280 MB of memory for 4 minutes.	Notice
volume_bitlocker_protection_dropped	Disk volumes	BitLocker protection dropped	Ends when BitLocker protection on the volume is back on for 10 minutes.	Notice
volume_fill_rate_high	Disk volumes	volume filling fast	Ends when the volume fills slower than 0.8 GB an hour, or stops filling, for 20 minutes.	Display
volume_unreadable	Disk volumes	volume unreadable	Ends when the volume is mounted with a readable file system for 15 minutes.	Serious to Severe
vss_snapshots_failing_for_space	VSS shadow storage	shadow copies failing for space	Ends when shadow copy failures on the volume in the past week drop below 1.	Notice to Error
vss_writer_failed	VSS writers	VSS writer failed	Ends when the writer has been out of a failed state for 6 hours, or missing from the list that long. A writer that leaves the list is not counted as recovered.	Display to Warning

Occurrences

An occurrence is recorded once, with no episode and no close.

Occurrence	Topic	What it means	Severity
host_booted	Host and agent lifecycle	host booted	Not scored
host_clock_stepped	Host and agent lifecycle	host clock stepped	Not scored
host_resume_settled	Host and agent lifecycle	host resume settled	Not scored
host_shutdown	Host and agent lifecycle	host shutdown	Not scored
host_sleep_entered	Host and agent lifecycle	host sleep entered	Not scored
host_sleep_exited	Host and agent lifecycle	host sleep exited	Not scored
host_unexpected_shutdown	Host and agent lifecycle	host unexpected shutdown	Not scored
kernel_crash	Crashes	kernel crash	Not scored
network_context_changed	Host performance	network context changed	Not scored
process_crash	Crashes	process crash	Not scored
sparklogs_agent_started	Host and agent lifecycle	sparklogs agent started	Not scored
sparklogs_agent_stopped	Host and agent lifecycle	sparklogs agent stopped	Not scored