EDR: Why is the OS Uptime less than Sensor Uptime?
search cancel

EDR: Why is the OS Uptime less than Sensor Uptime?

book

Article ID: 287660

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response) Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

On the EDR console, why would the Operating System Uptime be less than the Sensor Uptime?

Environment

  • EDR Servers:  All
  • EDR Sensors: All

Resolution

The Operating System uptime may not increase while the endpoint is asleep or hibernating.

Sensor Uptime:
The amount of time since the Carbon Black service started.  
NOTES:
* Because the "Host Uptime" value may not increase when the endpoint is asleep or hibernating, the "Sensor Uptime" value can legitimately be higher than "Host Uptime".
* If the "Sensor Uptime" is consistently a low number, it may indicate an issue with service stability.
Host Uptime:
The amount of time the operating system has been running as reported by the operating system itself.  
NOTE:
* This may not increase when the endpoint is asleep or hibernating.