Offline clients showing online status while checking device details via REST API

Products

• Endpoint Security

Issue/Introduction

Using REST API to get Client details you notice the Portal offline clients are showing with an online Status

Example of client showing offline on the ICDm :

 

REST API call showing for the same client "agent_status": "ONLINE",

{
"id": "xyzxyz",
"os":
{ "ver": "10.0.19043", "name": "Windows 10 Professional Edition", "type": "WINDOWS_WORKSTATION", "64_bit": true, "lang": "en", "major_ver": 10, "minor_ver": 0, "sp": 0, "tz_offset": 60, "user": "xyzxyz", "user_domain": "LocalComputer", "vol_avail_mb": 186646, "vol_cap_mb": 243295 }

,
"name": "DESKTOP-",
"host": "DESKTOP-",
"domain": "WORKGROUP",
"created": "2021-06-09T09:45:05.164Z",
"modified": "2021-08-29T17:27:34.962Z",
"adapters": [
{ "addr": 

],
"device_status": "SECURE",
"parent_device_group_id": "XyXyXyxyz",
"products": [
{
"name": "Symantec Endpoint Protection",
"product_status": "SECURE",
"version": "14.3.4615.2000",
"agent_status": "ONLINE",
"last_connected_time": "2021-08-30T06:36:25.183Z",

Environment

SESC

REST API

Cause

The Device API returns whatever is in the backend database. the portal has additional logic which is not covered in the backend API.

Portal adds extra logic of setting client connection status based on time when client last submitted inventory\opstate or communicated with SPOC. If the agent has not submitted to any information in last 48 hours, portal shows it OFFLINE even if device_status is in backend API call is ONLINE.

Resolution

Broadcom is aware of the issue, the article will be updated once a solution becomes available.

Additional Information

ESCRT-7885