In EventSentry 3.3 series and newer, there are multiple ways to check the agent status, and they are performed in this order:
Starting in EventSentry 184.108.40.206 and onwards, if the collector is enabled, these are the checks for the agent status and the order in which they are performed:
The first two options are extremely fast and require no additional settings or permissions to configure. The last option can be slow depending on network speed and the operating system load on the remote agent, and it also requires the [correct permissions to be configured] in order to succeed. In EventSentry 220.127.116.11 and onwards, if the collector is enabled the RPC check is not performed because if the agent hasn't been able to reach the collector or the database it is having a serious connection problem that should be investigated.
For the agent status to be listed as Frozen or Idle, the agent has not communicated with the collector or the database for several minutes, and the current agent status could not be verified over RPC either. The agent may have stopped working, and should be investigated.
The following collector or database activity thresholds are used for the agent status:
Sometimes an agent will change between OK, Idle, Frozen, and then back to OK again somewhat regularly. This can occur if the agent does not have data to transmit very often to meet the Active Agent criteria, and the agent status also was not verified over RPC. You can either force the agent to use the collector or database every 5 minutes and meet the Active Agent criteria, or if you are not using the collector you can [fix the RPC-based permissions] so that the agent status can always be verified regardless of activity levels.
To force the agent to use the collector or database every 5 minutes: