Security Agents send heartbeat messages to notify the server that connection from the agent remains functional. Upon receiving a heartbeat message, the server treats the agent as online. In the agent tree, the agent’s status can either be:
Online: For regular online agents
Unreachable/Online: For online agents in the unreachable network
Security Agents do not update components or apply new settings when sending heartbeat messages. Regular agents perform these tasks during routine updates (see Security Agent Updates). Agents in the unreachable network perform these tasks during server polling.
The heartbeat feature addresses the issue of Security Agents in unreachable networks always appearing as offline even when they can connect to the server.
A setting in the web console controls how often agents send heartbeat messages. If the server did not receive a heartbeat, it does not immediately treat the agent as offline. Another setting controls how much time without a heartbeat must elapse before changing the agent’s status to:
Offline: For regular offline Security Agents
Unreachable/Offline: For offline Security Agents in the unreachable network
When choosing a heartbeat setting, balance between the need to display the latest agent status information and the need to manage system resources. The default setting is satisfactory for most situations. However, consider the following points when you customize the heartbeat setting:
Heartbeat Frequency |
Recommendation |
|---|---|
Long-interval heartbeats (above 60 minutes) |
The longer the interval between heartbeats, the greater the number of events that may occur before the server reflects the agent’s status on the web console. |
Short-interval Heartbeats (below 60 minutes) |
Short intervals present a more up-to-date agent status but may be bandwidth-intensive. |