In EventSentry 3.3 series and newer, there are multiple ways to check the agent status, and they are performed in this order:
The first two options are extremely fast and require no additional settings or permissions to configure. The last option can be slow depending on network speed and the operating system load on the remote agent, and it also requires the [correct permissions to be configured] in order to succeed.
For the agent status to be listed as Frozen or Idle, the agent has not communicated with the collector or the database for several minutes, and the current agent status could not be verified over RPC either. The agent may have stopped working, and should be investigated.
The following collector or database activity thresholds are used for the agent status:
Sometimes an agent will change between OK, Idle, Frozen, and then back to OK again somewhat regularly. This can occur if the agent does not have data to transmit very often to meet the Active Agent criteria, and the agent status also cannot be verified over RPC. You can either force the agent to use the collector or database every 5 minutes and meet the Active Agent criteria, or you can [fix the RPC-based permissions] so that the agent status can always be verified regardless of activity levels.
To force the agent to use the collector or database every 5 minutes: