Difference Between Connected and All devices is large? How come

Hello StephanieGelder,

is it normal?
from your enquiry I get it that you think it's not [:)]. Naturally an outsider can't tell from the numbers alone. Could be the main site and a branch office in another time zone. Or computers used in shifts. Or a lot of them laptops and not always on the LAN. Or the ALL (you should rather consider Managed in this case) not reflecting the actually deployed machines but also comprising some already decommissioned. On one of my servers 50% (of several thousand) connected during the day is normal, on the other 95%.

12 out of date
the Dashboard's Out-of-date computers considers only Managed connected out-of-date computers, see the View: drop down between the Dashboard and the tabs.

Go to the Computer Details tab, sort the Last message time column. This should help to identify endpoints which haven't reported for some period of time and to determine whether the 250 could be normal or not.

Christian

Out of the 350ish.

I have 44 that haven't talked to the server in the last week.  30 of those have talked to the server in October.

That leaves 14 devices that haven't talked to the server since September or earlier.

Which is why I would have thought the CONNECTED should show a lot more devices, I was just assuming it would show say all but 44 at most, or even all but the 14 that haven't connected this month.

I've no idea if it's Normal for systems to have connected as only 60% of the devices or not, as I would assume 300 plus have connected this week so would be in connected.

Does connected mean ones that have talked to the server in the last x minutes? as i have more that have a last message time from 8:30 this morning, than i have in connected. 

If so then I guess that makes sense and I don't really have to worry in the future that connected and all are so different.

Hello StephanieGelder,

connected is the current state, the number is the count of currently connected computers.
When an endpoint's Sophos Message Router service starts it attempts to connect to the management server. If successful the status in the console changes. When the service stops it takes down the connection and the computer shows as Disconnected (if the connection is interrupted it might incorrectly still show as Connected). And BTW: Connected/disconnected refers to only the RMS connection - whether the endpoint has accessed the share for downloads doesn't matter.

Last message time indicates the time an endpoint has sent some information to the management server - about successful or failed updates, detections and cleanup, locally changed settings, and so on. Messages don't determine the connection state though - if a computer shows as disconnected it's usually because it has taken down the connection.

Christian

Hello StephanieGelder,

connected is the current state, the number is the count of currently connected computers.
When an endpoint's Sophos Message Router service starts it attempts to connect to the management server. If successful the status in the console changes. When the service stops it takes down the connection and the computer shows as Disconnected (if the connection is interrupted it might incorrectly still show as Connected). And BTW: Connected/disconnected refers to only the RMS connection - whether the endpoint has accessed the share for downloads doesn't matter.

Last message time indicates the time an endpoint has sent some information to the management server - about successful or failed updates, detections and cleanup, locally changed settings, and so on. Messages don't determine the connection state though - if a computer shows as disconnected it's usually because it has taken down the connection.

Christian

Thanks