Agent Overview page shows wrong total number of agents in each state

Products

• Data Loss Prevention Endpoint Suite
• Data Loss Prevention Endpoint Discover
• Data Loss Prevention Endpoint Prevent

Issue/Introduction

You are viewing the System | Agents | Overview page in the Enforce console. 

You notice that the total number of agents in the Warning or Critical state does not equal the sum of the number of agent alerts in the corresponding alert type categories. Example below: 

Environment

DLP Enforce console 15.x, 16.x

Cause

Regarding the State Summary Totals: 

• Although an agent may exhibit both 'Warning' and 'Critical' alert types it can only be counted in the total of one of those categories.
• Critical alert types supersede Warning alert types, so any agent displaying both types will only count towards the total of the Critical state. 
• Once the Critical state symptoms are resolved, if the agent still has any 'Warning' symptoms it will appear under the total of agents in a Warning state. 

Regarding the Alert Type Count

• The alert types are the total number of agents affected by that symptom
• Alert types are not mutually exclusive, so any agent may be displaying none, one or several of them. In the screenshot example, 6187 agents have an old agent but, of those same machines, any number up to 1828 may also be affected by the Edge extension not being deployed.

Resolution

The Agent Overview screen should be interpreted according to the rules above.