'Last Active', 'Online', and 'Endpoint Last Used' timestamps are commonly used in the 'People', 'Device', and Device details sections of Sophos Central. These fields are updated on average once an hour. Since other areas of Central will reflect changes immediately (eg. moving people/devices/logins from one to another) - this article helps to explain where this can be seen, and some scenarios that can cause confusion due to this these particular timestamps not updating immediately.
The following sections are covered:
Applies to the following Sophos products and versions Sophos Central Admin
These timestamps update by design on average once an hour timeframe.
While Event and Health service data is processed as soon as it is received in Sophos Central from the endpoint, these timestamps noted above are processed differently and will update (on average) once an hour.
Some areas where this may cause some confusion:
If you've spotted an error or would like to provide feedback on this article, please use the section below to rate and comment on the article. This is invaluable to us to ensure that we continually strive to give our customers the best information possible.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. For technical support post a question to the community. Or click here for new feature/product improvements. Alternatively for paid/licensed products open a support ticket.