PRODUCT:
Symantec DLP
QUESTION
Is there heartbeat communication between Endpoint Servers and Agents?
ANSWER
There is a regular heartbeat sent from the endpoint server to the agents. This heartbeat is 4 bytes on top of the TCP header. The agent will not send a heartbeat, but it will send a TCP ACK in response to the heartbeat. By default, this is sent every 5 minutes.
This can be changed by adjusting the “inactiveConnectionTimeout” property in Aggregator.properties. The property is set in milliseconds (e.g. “inactiveConnectionTimeout = 600000” means send a heartbeat every 10 minutes.
You can find Aggregator.properties on the Endpoint server under \vontu\protect\config.
After changing the setting, a restart of the Monitor service is required in order for it to take effect.