Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

EDR: Why is the OS Uptime less than Sensor Uptime?

EDR: Why is the OS Uptime less than Sensor Uptime?

Environment

  • EDR Servers:  All
  • EDR Sensors: All

Question

On the EDR console, why would the Operating System Uptime be less than the Sensor Uptime?

Answer

The Operating System uptime may not increase while the endpoint is asleep or hibernating.

Sensor Uptime:
The amount of time since the Carbon Black service started.  
NOTES:
* Because the "Host Uptime" value may not increase when the endpoint is asleep or hibernating, the "Sensor Uptime" value can legitimately be higher than "Host Uptime".
* If the "Sensor Uptime" is consistently a low number, it may indicate an issue with service stability.
Host Uptime:
The amount of time the operating system has been running as reported by the operating system itself.  
NOTE:
* This may not increase when the endpoint is asleep or hibernating.




 

Related Content


Labels (2)
Tags (3)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎08-31-2022
Views:
273
Contributors