Windows Update agent state
Whether this host is scanning, paused, or falling behind on updates.
Topic id: windows_update_agent_state.
This topic is still rolling out. Endpoints on the general release do not send it yet.
Conditions
A condition is a state that holds for a while. The agent opens it when the host enters it, keeps it open while it lasts, and closes it when the host comes back out, so one episode answers for the whole stretch instead of one alert per sample.
| Condition | Severity | How an episode ends |
|---|---|---|
update scan is stale (patch_scan_stale) | Warning | It closes when the measurement falls back past its recovery point. |
updates paused (patch_updates_paused) | Notice to Error | It closes when any one of the several recovery conditions is met. |
Example
Inventory (every 6 hours)
windows update posture.
sparklogs.data.windows_update_agent_state.updates_paused: false
sparklogs.data.windows_update_agent_state.wuauserv_start_type: auto_delayed
sparklogs.data.windows_update_agent_state.last_scan_age_h: 6.0
SparkLogs: CONTEXT, Info, windows_update_agent_state: INVENTORY: windows update posture.
Selected conditions
patch_scan_stale
Windows Update scan data is stale.
Impact: Patch status may be unknown and pending updates may be missed.
Example
started; last scan 700.08h (threshold 336h)
sparklogs.data.windows_update_agent_state.last_scan_age_h: 700.08
SparkLogs: patch_scan_stale, Warning, windows_update_agent_state: patch_scan_stale: NOTABLE: started; last scan 700.08h (threshold 336h)
| Case | Severity | Ticket class |
|---|---|---|
onset | Trace to Fatal | patching |
held | Trace to Fatal | patching |
recovered | Trace to Fatal | patching |
patch_updates_paused
Windows Updates are paused for too long.
Impact: Security and reliability updates may be deferred past policy intent.
Example
started; paused for 504.08h (threshold 336h)
sparklogs.data.windows_update_agent_state.updates_paused: true
sparklogs.data.windows_update_agent_state.updates_paused_age_h: 504.08
SparkLogs: patch_updates_paused, Error, windows_update_agent_state: patch_updates_paused: NOTABLE: started; paused for 504.08h (threshold 336h)
| Case | Severity | Ticket class |
|---|---|---|
onset | Trace to Fatal | patching |
held | Trace to Fatal | patching |
recovered | Trace to Fatal | patching |