Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

CB Protection: What Does the "Agent Deleted Events" Event Mean?

CB Protection: What Does the "Agent Deleted Events" Event Mean?

Environment

  • CB Protection Console: All versions
  • CB Protection Agent: All versions

Question

What does the "Agent Deleted Events" event mean?

Answer

The “Agent Deleted Events” means the agent has purged old events from its local cache.

Additional Notes

  • The Cb Protection Agent keeps a local cache of events (the default is 5,000) regardless of whether the agent is connected or not.
  • This allows them to be relayed to the server in the event of a DR senior.
  • For agents that are offline for long periods of time and hit the threshold where the agents start purging events from their cache, hey’ will retain information on blocks and malware. However, they’ll purge health check and info type events.
  • This is to prevent resource consumption on the endpoints and is expected behavior.
  • This can even be expected on connected agents with a high level of activity. Therefore for agents that aren’t offline for a long period of time, it is expected that these events have already been sent to the server.

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎02-13-2019
Views:
407
Contributors