Monitoring Windows Update Performance

Use the Splunk search below to list the duration of Windows Update activities that art part of the machine boot process\. In addition to the Windows Update processing time, the search returns the disk IO incurred by the update process\.

A fundamental component of good endpoint management is Windows Update management\. All devices must be kept up to date in order to provide as few opportunities as possible for malware to attack\.

However, applying Windows updates also means stopping work for users, because typically the computer has to be restarted for this purpose\. This is because Windows updates are installed during the computer startup\.

Administrators are therefore keen to ensure that everything runs smoothly during the installation of updates in order to minimize the waiting time for users\. So they need a way to monitor the performance of the update installation\.

uberAgent provides a deep insight into the computer startup performance of Windows endpoints in the dashboard Boot Duration\. Every computer startup is divided into phases based on the Microsoft document Windows On/Off Transitions Solutions Guide\. The installation of Windows updates is not a separate phase, but only a sub\-phase\.

Nevertheless, the installation of Windows Updates can be monitored with uberAgent, because uberAgent determines the runtime, command line and performance for each process that ran during boot\.

Windows updates are installed by the Windows Update service\. This is an instance of the svchost.exe process and can be identified by the following command line: svchost.exe -k netsvcs -p -s wuauserv\.

The performance of processes at boot is best measured by the number of disk accesses (IOs)\. Many IOs means that the application or service has a negative impact on boot performance\.