Security Agents log unauthorized device access instances and send the logs to the server. Any agent that runs continuously aggregates the logs and sends them after a 1-hour time period. Any agent that got restarted checks the last time the logs were sent to the server. If the elapsed time exceeds 1 hour, the agent sends the logs immediately.
To keep the size of logs from occupying too much space on the hard disk, manually delete logs or configure a log deletion schedule. For more information about managing logs, see Log Management.