App Control: What Happens When an Agent Is Disconnected or the Server Is Offline?
search cancel

App Control: What Happens When an Agent Is Disconnected or the Server Is Offline?

book

Article ID: 289406

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

What happens on the endpoint when the Agent cannot communicate with the Server, such as during a Server upgrade or other communication outage?

Environment

  • App Control Agent: All Supported Versions
  • App Control Server: All Supported Versions

Resolution

  • Agents¬†will not be able to receive new Rules, Approvals, Bans, Agent Management, or any other data that would involve communication with the Server.
  • Agents will continue to enforce according to Policy settings (Rules > Policies > relevant Policy > Disconnected Enforcement). By default Disconnected and Connected Enforcement are the same.
  • Agents will store up to 5,000 Events locally, and send the Events once the connection is restored.

Additional Information

Should the 5,000 Event threshold be reached; Agents will purge Health Check and Informational type Events from the local cache before purging Block and Malware related Events.