Windows services
Service configuration and run state, including automatic services that are not running.
Topic id: services.
This topic is still rolling out. Endpoints on the general release do not send it yet.
Conditions
A condition is a state that holds for a while. The agent opens it when the host enters it, keeps it open while it lasts, and closes it when the host comes back out, so one episode answers for the whole stretch instead of one alert per sample.
| Condition | Severity | How an episode ends |
|---|---|---|
automatic service not running (svc_auto_not_running) | Notice to Severe | It closes on a recovery rule written for this condition, which reads more than one measurement together. |
svc flapping (svc_flapping) | Notice to Serious | It closes when the measurement falls back past its recovery point. |
service stuck pending (svc_stuck_pending) | Warning to Error | It closes when the host reports one of the healthy states again. |
Example
Inventory (every 6 hours)
2 automatic; 1 running, 1 expected stopped.
sparklogs.data.services.name: wuauserv
sparklogs.data.services.current_state: stopped
sparklogs.data.services.start_type: auto_delayed
sparklogs.data.services.service_is_important: false
sparklogs.data.services.svc_stopped_age_min: 0.0
sparklogs.data.services.service_role_on_host: false
sparklogs.data.services.current_state_code: 1
SparkLogs: CONTEXT, Info, services: INVENTORY: 2 automatic; 1 running, 1 expected stopped.
Change set (every minute)
2 changed, 2 stopped; "-spooler" "-wuauserv".
sparklogs.data.services.delta_kind: changed
sparklogs.data.services.name: spooler
sparklogs.data.services.current_state: stopped
sparklogs.data.services.start_type: auto
SparkLogs: CONTEXT, Info, services: DELTA: 2 changed, 2 stopped; "-spooler" "-wuauserv".
Selected conditions
svc_auto_not_running
An automatic service is not running.
Impact: Expected background functionality may be unavailable until the service starts.
Example
started; "spooler" not running for 10min (threshold 10min)
sparklogs.instance: service:spooler
sparklogs.data.services.name: spooler
sparklogs.data.services.service_is_important: false
sparklogs.data.services.svc_stopped_age_min: 10.0
sparklogs.data.services.service_role_on_host: false
sparklogs.data.services.svc_auto_not_running_age_h: 0.0
SparkLogs: svc_auto_not_running, Minor, services: svc_auto_not_running: NOTABLE: started; "spooler" not running for 10min (threshold 10min)
| Case | Severity | Ticket class |
|---|---|---|
onset | Trace to Fatal | app_stability |
held | Trace to Fatal | app_stability |
recovered | Trace to Fatal | app_stability |
svc_flapping
A Windows service is flapping.
Impact: The service may be unstable, unavailable between restarts, or masking a crash loop.
Example
started; "spooler" crashes in a day 6 (threshold 5)
sparklogs.instance: service:spooler
sparklogs.data.services.name: spooler
sparklogs.data.services.service_is_important: false
sparklogs.data.services.svc_crash_count_24h: 6
sparklogs.data.services.svc_flapping_age_h: 0.0
SparkLogs: svc_flapping, Error, services: svc_flapping: NOTABLE: started; "spooler" crashes in a day 6 (threshold 5)
| Case | Severity | Ticket class |
|---|---|---|
onset | Trace to Fatal | app_stability |
held | Trace to Fatal | app_stability |
recovered | Trace to Fatal | app_stability |
svc_stuck_pending
A Windows service is stuck pending.
Impact: The service may not be usable and SCM may need intervention.
Example
started; "wuauserv" service state 2
sparklogs.instance: service:wuauserv
sparklogs.data.services.name: wuauserv
sparklogs.data.services.current_state_code: 2
sparklogs.data.services.svc_stuck_pending_age_min: 0.0
SparkLogs: svc_stuck_pending, Warning, services: svc_stuck_pending: NOTABLE: started; "wuauserv" service state 2
| Case | Severity | Ticket class |
|---|---|---|
onset | Trace to Fatal | app_stability |
held | Trace to Fatal | app_stability |
recovered | Trace to Fatal | app_stability |