SystemGuardian Service Documentation
Overview
SystemGuardian is an advanced Windows service that provides automated system monitoring, protection, and recovery capabilities. It implements real-time component tracking, automatic recovery points, and intelligent event handling to maintain system stability and integrity.
Key Features
- Real-time WMI-based event monitoring
- Automated recovery point management
- Registry state tracking and backup
- Component integrity verification
- Intelligent thread pool management
- SQLite-based component and event tracking
- Automated system restoration capabilities
- Smart component isolation and quarantine
System Requirements
Hardware Requirements
- Windows Operating System (Windows 10/11 recommended)
- Minimum 4GB RAM
- 1GB free disk space for recovery points
Software Prerequisites
- Python 3.8 or higher
- Required Python packages:
win32serviceutil
wmi
psutil
win10toast
sqlite3
Directory Structure
C:/ProgramData/SystemGuardian/
+-- logs/ # Rotating log files
+-- backups/ # Registry and component backups
+-- recovery_points/ # System recovery points
+-- quarantine/ # Isolated components
+-- guardian.db # SQLite database
Database Schema
Components Table
CREATE TABLE components (
name TEXT PRIMARY KEY,
type TEXT,
path TEXT,
dependencies TEXT,
hash TEXT,
last_modified REAL,
status TEXT
);
name TEXT PRIMARY KEY,
type TEXT,
path TEXT,
dependencies TEXT,
hash TEXT,
last_modified REAL,
status TEXT
);
Recovery Points Table
CREATE TABLE recovery_points (
timestamp REAL PRIMARY KEY,
components TEXT,
registry_backup TEXT,
description TEXT
);
timestamp REAL PRIMARY KEY,
components TEXT,
registry_backup TEXT,
description TEXT
);
Events Table
CREATE TABLE events (
id INTEGER PRIMARY KEY,
timestamp REAL,
type TEXT,
component TEXT,
description TEXT,
severity TEXT
);
id INTEGER PRIMARY KEY,
timestamp REAL,
type TEXT,
component TEXT,
description TEXT,
severity TEXT
);
Service Installation
Basic Installation
python SystemGuardian.py install
Service Management
- Start service
python SystemGuardian.py start
- Stop service
python SystemGuardian.py stop
- Update service
python SystemGuardian.py update
- Remove service
python SystemGuardian.py remove
Recovery System
Recovery Points
- Automatic creation before critical operations
- Maximum retention: 5 recovery points
- Includes:
- Full registry state
- Component database snapshot
- System state metadata
Recovery Point Creation
Recovery points are automatically created:
- At service startup
- Before critical component modifications
- Before component isolation
- During service shutdown
- On-demand via API
Recovery Point Restoration
# Example restoration code
guardian_service.restore_recovery_point(timestamp)
guardian_service.restore_recovery_point(timestamp)
Monitoring System
WMI Event Monitoring
- Real-time event capture
- Efficient event filtering
- Resource-aware processing
- Automated response triggers
Component Integrity
- SHA-256 hash verification
- Dependency validation
- Path existence checking
- Permission verification
Thread Management
Thread Pool
- Maximum workers: 4
- Automatic task distribution
- Resource-aware scheduling
- Graceful shutdown handling
Event Queue
- Maximum size: 1000 events
- FIFO processing
- Overflow protection
- Priority handling
Configuration
Service Configuration
class Config:
MAX_QUEUE_SIZE = 1000
MAX_THREADS = 4
MAX_RECOVERY_POINTS = 5
MAX_BACKUP_AGE_DAYS = 7
EVENT_CHECK_INTERVAL = 5
CACHE_UPDATE_INTERVAL = 3600
BACKUP_INTERVAL = 86400
MAX_QUEUE_SIZE = 1000
MAX_THREADS = 4
MAX_RECOVERY_POINTS = 5
MAX_BACKUP_AGE_DAYS = 7
EVENT_CHECK_INTERVAL = 5
CACHE_UPDATE_INTERVAL = 3600
BACKUP_INTERVAL = 86400
Registry Monitoring
Monitored paths:
CRITICAL_REG_PATHS = [
r"SYSTEM\CurrentControlSet\Services",
r"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32",
r"SYSTEM\CurrentControlSet\Control\Class"
]
r"SYSTEM\CurrentControlSet\Services",
r"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32",
r"SYSTEM\CurrentControlSet\Control\Class"
]
Component Management
Component States
- Active: Component running normally
- Warning: Minor issues detected
- Critical: Major problems identified
- Isolated: Component quarantined
- Recovered: Restored from backup
Isolation Process
- Create recovery point
- Backup component files
- Disable/stop component
- Update database status
- Notify administrator
Recovery Process
- Verify recovery point integrity
- Restore registry state
- Restore component files
- Validate restoration
- Update component status
Logging System
Log Rotation
- Daily log files
- Maximum size: 10MB
- Retention: 5 files
- Format:
guardian_YYYYMMDD.log
Log Levels
- INFO: Normal operations
- WARNING: Potential issues
- ERROR: Operation failures
- CRITICAL: System failures
Performance Considerations
Resource Usage
- CPU: <5% average
- Memory: ~100MB baseline
- Disk: ~1GB for recovery points
- Database: ~50MB typical
Optimization
- Event batching
- Efficient WMI queries
- Thread pool management
- Queue size limits
Security Features
Component Verification
- File hash validation
- Path verification
- Permission checking
- Dependency validation
Backup Security
- Encrypted storage
- Access control
- Integrity verification
- Secure deletion
Troubleshooting
Common Issues
-
Service Start Failure
- Check database permissions
- Verify directory access
- Review WMI permissions
- Check log files
-
Recovery Point Creation Failure
- Verify disk space
- Check backup directory permissions
- Review database connectivity
- Check registry access
-
Component Isolation Issues
- Verify administrative rights
- Check component dependencies
- Review isolation logs
- Verify backup creation
Diagnostic Steps
- Check service status
Get-Service SystemGuardian | Format-List *
- Review recent logs
Get-Content "C:\ProgramData\SystemGuardian\logs\guardian_*.log" -Tail 100
- Check recovery points
SELECT * FROM recovery_points ORDER BY timestamp DESC LIMIT 5;
- Verify component status
SELECT name, status FROM components WHERE status != 'Active';
Best Practices
Maintenance
- Regular database cleanup
- Log rotation verification
- Recovery point validation
- Component status review
Monitoring
- Regular log review
- Performance tracking
- Resource usage monitoring
- Event pattern analysis
Backup Strategy
- Regular recovery point testing
- Backup retention management
- Storage space monitoring
- Integrity verification
Support and Updates
Update Process
- Stop service
- Backup database
- Update Python script
- Verify configuration
- Restart service
Health Checks
- Database integrity
- Recovery point validity
- Component status
- Resource usage
Error Codes and Troubleshooting
Common Error Codes
- 1001: Database connection failure
- 1002: Recovery point creation failed
- 1003: Component isolation error
- 1004: Registry backup failed
- 1005: WMI monitoring error
Resolution Steps
Detailed for each error code in the logs with specific troubleshooting procedures and recovery steps.
<Windows 11 Home - Insider Preview build Production 09/02/25>