After installing trial with a collector, then removing the collector, Agents appear Disconnect or Frozen

+1 vote
asked May 29, 2019 in EventSentry by marcusrjones (240 points)
I don't think I need a collector since everything is on one network, so I have removed it.

I have 2 Windows 10 machines with agents but one appears Frozen and one is Disconnected. They are both OK on network ping.

I have looked at this KB item and tried to check that Software inventory is enabled on both systems (running ver of EventSentry and Agents so interval should be OK). I have it set to log to the primary database.

When I look at the eventLog on one of the machines I can see EventSentry events happening still - so I assume the agent is running OK. EventSentry is shown as running in Services as well.

Could removing the collector have caused an issue for these agents? Is there a way to re-configure/re-install without the collector?

2 Answers

+1 vote
answered May 29, 2019 by Sally (2,460 points)
selected May 30, 2019 by marcusrjones
Best answer
Did you go and tell your actions to stop using the collector after you got rid of it?  To double-check, scroll down the left side of the EventSentry console until you get to the Actions section, and then select each action and view its settings on the right side, and then look in the bottom left corner of the settings and make sure the "Use Collector" box has been turned off.  It's possible to have more than one collector, and to uninstall and reinstall the collector if you're trying to troubleshoot something, so uninstalling the collector from one server would not automatically turn off the "Use Collector" setting in all the actions.

The collector also would have been managing your configuration updates (unless you changed that) so your agents need to receive any configuration changes manually from now on.  If you haven't pushed the configuration manually yet the configuration they have would be from when you were still using the collector, and until they receive a configuration update as far as the agents know they're still supposed to be using the collector and you'll have missing web reports data and agent status errors.

After making sure the "Use Collector" checkbox is turned off for every action, push the configuration (Groups > Push Configuration > Go) and if that doesn't resolve the problem within 5-6 minutes you can force the agents to reload (Groups > Other Actions > Restart Agent > Go) and everything should be fine when the next heartbeat scan finishes.  You can double-check that the agents are able to successfully write to the database by going into the web reports menu and choosing Settings > Agent Status.  The "event log" column (any column besides Heartbeat really) indicates that the agent is able to write to the database and a healthy agent should have written at least one event log item in the last 10 minutes.
commented May 30, 2019 by anonymous
Thanks. I did not realise I needed to do that and that the collector performed other useful functions - so I will re-instate it I think.
+1 vote
answered May 29, 2019 by Ingmar (7,190 points)
We generally recommend using the collector, even for smaller installations - there is no significant downside other than having an additional service installed. The collector manages agent patches and configuration updates and generally provides a more accurate status of the remote agents.
commented May 30, 2019 by anonymous
I'll put it back again then. Looks like it is worth using.
Welcome to EventSentry Q&A, where you can ask questions and receive answers from other members of the community.