Investigating System Events

In the Agents portal you can easily identify problematic Agents in the system. This topic describes how to investigate system events that occurred on Agents, so that you can understand the root causes and the corrective actions (if any) to take.

To investigate system events for an Agent

1. Navigate to the Endpoints page of the Web Console (Configuration > Endpoint Management > Endpoints).

2. In the Endpoints list, in the expanded details of an Agent with an Error status, click the System Events link (or the Status link).

   If the Agent was tampered with or incurred data loss during the last week, the Tampered With icon or the Data Loss icon will be displayed alongside the Agent in the Servers list. Clicking the icon will open the System Events list filtered to display the last week's "tampered with" or "data loss" events related to this Agent. For more information, see Drilling Down to Agent Details.

   

   The System Events page opens, displaying the related system events that occurred on the Agent. For details, see System Events.

   

3. Click to expand an event to view more details, as shown above.

For information about the different event types and their possible causes and solutions, see Viewing System Events and Event Types.