While I can run a report looking for "Failed to update", I'm wondering if there is a way to scan all the computers and see how long it's been since they updated the agent (not activity). Example is there is one computer that has activity, but the agent hasn't updated in months (yet it still shows Green in the dashboard).
Hi There,
You can validate this through your Sophos central by navigating to devices and sorting out the "last active" tab. If you have an XDR subscription on your license, you can also use "Live Discover" to perform a query. refer to this documentation about live discover
Hello Breakingcustom,
If you see events generated on the concerned endpoints that state "Update failed," it's possible to create a report using the following navigation to show these events.
- Sign in to Sophos Central
- Select "Logs & Reports"
- Select "Events"
- De-select all sections by clicking the "Type" check-box
- Expand "Product Updates"
- Select only "Update failed"
The resulting report will show you all the "Update Failed" events generated in the past seven days. It's possible to change the report date range up to 90 days in the past. You’ll need to select the "Update" button on the upper right-hand side for the report to refresh. You may want to include the "Update succeeded" event as well in your report so that you can see if any of the systems have self-resolved over time.
To add some additional context, the "Update Failed" event typically corresponds with a product/software update. Virus definition updates will constantly be occurring in the background. So long as a device's health status is green, the components present on the device will continue to protect the device.
Let me know if this information helps.
