Log Types: AgentHeartBeat

Owned by Andrew Madge
Last updated: Sept 15, 2020 by Leigh Purdie (Unlicensed)
1 min read

Overview

Agent Heart Beat logs are generated by Snare agents, and can be used to identify systems that are offline, or where the agent has been deactivated.

Agent heart beats are received by the Snare collection subsystem on port 6161 TCP or UDP.

Sample Events

VM11WIN7TEST AgentHeartBeat 14/09/2017 16:07:43 Windows 5.0.0-RC2 HeartBeat Mark - License expired on 2017-Jun-09. Support expired on 2017-Jun-09. Extra

Fields

Field

Description

Field

Description

DATE

Event date, in the format YYYY-MM-DD

TIME

Event time, in the format HH:MM:SS

SYSTEM

The source system

TABLE

AgentHeartBeat

AGENTTYPE

The type of agent reporting, for example: Windows, or Epilog

VERSION

The version of the agent

ACTION

INFO
WARNING
ERROR
HeartBeat
ServiceLog

STRINGS

Any extra content sent by the agent, such as license information, and destination availability information.