Managing audited computers and agents

You can monitor agent status from the Audit Manager console. With audited computers selected in the left pane, Audit Manager displays the name and IP address for audited computers, whether the agent is currently connected or disconnected, and how long the agent has been running since last restarted. You can also see the collector to which the agent is sending data, the audit store and audit store database where the audit data is stored, and the version of the agent software installed on the computer.

Audited systems can be either a computer or a network device. Audit Manager displays two kinds of audited systems:

  • System-based: A Windows or UNIX computer that is running an agent. You can access these systems either directly or from the Privileged Access Service Admin Portal.
  • Vault-based: A Windows or UNIX computer or a network device that is not running an agent (agentless). You can access these systems from the Privileged Access Service Admin Portal.

Because agentless systems do not have an agent installed, the Audit Manager displays slightly different information for these kinds of systems. For these systems, you can see the name, IP address, the collector, audit store, and audit store database.