Environment
- App Control Console: All versions
- App Control Agent: All versions
Question
What does the "Agent Deleted Events" event mean?
Answer
The “Agent Deleted Events” means the agent has purged old events from its local cache.
Additional Notes
- The App Control Agent keeps a local cache of events (the default is 5,000) regardless of whether the agent is connected or not.
- This allows them to be relayed to the server in the event of a DR scenario.
- For agents that are offline for long periods of time and hit the threshold where the agents start purging events from their cache, hey’ will retain information on blocks and malware. However, they’ll purge health check and info type events.
- This is to prevent resource consumption on the endpoints and is expected behavior.
- This can even be expected on connected agents with a high level of activity. Therefore for agents that aren’t offline for a long period of time, it is expected that these events have already been sent to the server.
Related Content
