Endpoint Server Heartbeat to all Agents

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Endpoint Discover

Issue/Introduction

PRODUCT:

Symantec DLP

QUESTION

Is there heartbeat communication between Endpoint Servers and Agents?

Resolution

ANSWER

There is a regular heartbeat sent from the endpoint server to the agents.  This heartbeat is 4 bytes on top of the TCP header.  The agent will not send a heartbeat, but it will send a TCP ACK in response to the heartbeat.  By default, this is sent every 5 minutes. 

This can be changed by adjusting the “inactiveConnectionTimeout” property in Aggregator.properties.  The property is set in milliseconds (e.g. “inactiveConnectionTimeout = 600000” means send a heartbeat every 10 minutes.

You can find Aggregator.properties on the Endpoint server under \vontu\protect\config.

After changing the setting, a restart of the Monitor service is required in order for it to take effect.