Agent Overview page shows wrong total number of agents in each state
book
Article ID: 276596
calendar_today
Updated On:
Products
Data Loss Prevention Endpoint SuiteData Loss Prevention Endpoint DiscoverData Loss Prevention Endpoint Prevent
Issue/Introduction
You are viewing the System | Agents | Overview page in the Enforce console.
You notice that the total number of agents in the Warning or Critical state does not equal the sum of the number of agent alerts in the corresponding alert type categories. Example below:
Environment
DLP Enforce console 15.x, 16.x
Cause
Regarding the State Summary Totals:
Although an agent may exhibit both 'Warning' and 'Critical' alert types it can only be counted in the total of one of those categories.
Critical alert types supersede Warning alert types, so any agent displaying both types will only count towards the total of the Critical state.
Once the Critical state symptoms are resolved, if the agent still has any 'Warning' symptoms it will appear under the total of agents in a Warning state.
Regarding the Alert Type Count
The alert types are the total number of agents affected by that symptom
Alert types are not mutually exclusive, so any agent may be displaying none, one or several of them. In the screenshot example, 6187 agents have an old agent but, of those same machines, any number up to 1828 may also be affected by the Edge extension not being deployed.
Resolution
The Agent Overview screen should be interpreted according to the rules above.