One or more sensors are marked Offline in the EDR console even though they are checking in regularly.
Time is not properly synced between the EDR server(s) and endpoints
- Enable NTP across all server nodes and endpoints
- Ensure time is synced across devices
- By default, Sensors will attempt to check into the EDR server every 1 minute.
- By default, the EDR server will mark a sensor as 'Offline' if the endpoint hasn't checked in for 5 minutes.
- If the time difference between devices is more than 5 minutes, then this issue will occur.
- This symptom will not prevent event telemetry from being uploaded to the EDR server