Processes
Per-process cost: CPU, working set, handles and sustained growth.
Topic id: processes.
This topic is still rolling out. Endpoints on the general release do not send it yet.
Conditions
A condition is a state that holds for a while. The agent opens it when the host enters it, keeps it open while it lasts, and closes it when the host comes back out, so one episode answers for the whole stretch instead of one alert per sample.
| Condition | Severity | How an episode ends |
|---|---|---|
process handle count high (proc_handle_count_high) | Display | It closes when the measurement falls back past its recovery point. |
process memory growing (ram_growth_sustained) | Notice to Error | It closes on a recovery rule written for this condition, which reads more than one measurement together. |
Example
Inventory (every hour)
3 processes; top ram "sqlservr.exe" 6.4 GB.
sparklogs.data.processes.pid: 4180
sparklogs.data.processes.create_time_raw: 134284104000000000
sparklogs.data.processes.handle_count: 2400
sparklogs.data.processes.ws_growth_monotonic_snapshots: 0
sparklogs.data.processes.working_set_bytes: 6442450944
sparklogs.data.processes.working_set_pct_ram: 18.75
sparklogs.data.processes.commit_pct: 54.0
sparklogs.data.processes.commit_pct_of_ram: 81.0
sparklogs.data.processes.hard_fault_churn_sustained: false
SparkLogs: CONTEXT, Info, processes: INVENTORY: 3 processes; top ram "sqlservr.exe" 6.4 GB.
Change set (every 5 minutes)
2 changed, 1 started, 1 exited; "+svchost.exe" "-backup.exe".
sparklogs.data.processes.delta_kind: added
sparklogs.data.processes.pid: 1234
sparklogs.data.processes.create_time_raw: 134287558800000000
sparklogs.data.processes.handle_count: 820
sparklogs.data.processes.ws_growth_monotonic_snapshots: 0
SparkLogs: CONTEXT, Info, processes: DELTA: 2 changed, 1 started, 1 exited; "+svchost.exe" "-backup.exe".
Selected conditions
proc_handle_count_high
A process has a very high handle count.
Impact: The process may be near resource limits even if growth trend is not yet visible.
Example
started; "svchost.exe" handles 34000 (threshold 30000)
sparklogs.instance: process:1234|2026-07-16T10:00:00Z
sparklogs.data.processes.pid: 1234
sparklogs.data.processes.create_time_raw: 134286696000000000
sparklogs.data.processes.handle_count: 34000
sparklogs.data.processes.proc_handle_count_high_age_h: 0.0
SparkLogs: proc_handle_count_high, Display, processes: proc_handle_count_high: NOTABLE: started; "svchost.exe" handles 34000 (threshold 30000)
| Case | Severity | Ticket class |
|---|---|---|
onset | Trace to Fatal | performance |
held | Trace to Fatal | performance |
recovered | Trace to Fatal | performance |
ram_growth_sustained
A process may be leaking memory: its working set grew at every sample of a consecutive run and is now large in absolute bytes or as a share of host RAM.
Impact: The process can eventually exhaust memory or destabilize its workload.
Example
started; "leaky.exe" consecutive growing samples 10 (threshold 6)
sparklogs.instance: process:4180|2026-07-16T10:00:00Z
sparklogs.data.processes.pid: 4180
sparklogs.data.processes.create_time_raw: 134286696000000000
sparklogs.data.processes.ws_growth_monotonic_snapshots: 10
sparklogs.data.processes.working_set_bytes: 3489660928
sparklogs.data.processes.working_set_pct_ram: 40.63
sparklogs.data.processes.commit_pct: 93.0
sparklogs.data.processes.commit_pct_of_ram: 186.0
sparklogs.data.processes.hard_fault_churn_sustained: false
SparkLogs: ram_growth_sustained, Warning, processes: ram_growth_sustained: NOTABLE: started; "leaky.exe" consecutive growing samples 10 (threshold 6)
| Case | Severity | Ticket class |
|---|---|---|
onset | Trace to Fatal | performance |
held | Trace to Fatal | performance |
recovered | Trace to Fatal | performance |