Audit Agents Reference
Reference for the per-Site Audit Agents catalog, including its purpose, status display, deletion behavior, and operational signals.
Menu path
Admin Center > Tasks and services > Audit agents.
Purpose
This list shows every Audit Agent currently registered for the Site. It is the admin-side confirmation point after agent deployment and the first place to check when a remote endpoint stops reporting.
The top section provides Audit Agent downloads for:
- Windows
- macOS
- Linux
List view
The grid lists the Audit Agents registered for the current Site. It includes agent identification, connection status, network information, recent activity, audit status, schedule details, and the current Log level.
Hover over the connection-status icon to check whether the agent is Online or Offline. The grid shows retirement separately as a Yes/No value. Open the agent's General tab to review any removal-request or scheduled-deletion warning.
Use the view controls to choose which columns appear in the grid.
Agent details
Open an agent to review these tabs:
| Tab | Contents |
|---|---|
| General | Host and registration information, recent agent activity, Updater information, and any removal warning. |
| Audit sessions | Audit history for the agent. |
| Remote tasks | Restart host and Remove agent actions, plus remote-task history. |
Remote restart
Use Restart host > Queue restart on Remote tasks to request a computer restart. See How to restart a computer through an Audit Agent for requirements and steps.
Only one remote management task can be active for an agent at a time. Restart cancellation is available only in Pending or Preparing, before Restarting.
Remote restart statuses
| Status | Meaning |
|---|---|
| Pending | The request is waiting to be processed. |
| Preparing | The agent is preparing for the restart and draining current work. |
| Restarting | The restart has been authorized; AlloyScan is waiting for confirmation. |
| Succeeded | AlloyScan has confirmed a new operating system boot. |
| Failed | The task reported a failure. Review its details. |
| Canceled | The task was canceled before restart authorization. |
| Expired | The task expired before completion. |
| OutcomeUnknown | AlloyScan has not confirmed the outcome. This does not prove that the computer failed to restart. |
Agent configuration
Open an Audit Agent record and click Configuration to configure:
- Check interval for configuration changes (in minutes) — how often the agent checks for configuration updates.
- Log level — the amount and severity of diagnostic information written to the agent log.
The selected logging level appears in the Log level column in the Audit Agents grid.
Log levels
| Log level | Description |
|---|---|
| Debug | Full diagnostic output. |
| Info | General operational messages. This is the default level. |
| Warning | Non-critical issues. |
| Error | Errors affecting agent functionality. |
| Error Critical | Critical failures only. |
Debug log collection
When Debug is selected, the Audit Agent automatically uploads its debug logs and logs from its Updater component to AlloyScan. A Download logs button appears next to Configuration, allowing an administrator to download the most recent archive.
AlloyScan keeps only the latest uploaded archive, which contains up to the last 24 hours of logs by default. If the log level is changed from Debug, the download becomes unavailable until Debug is enabled again and a new archive is generated.
At other log levels, logs remain on the agent host and are not uploaded to AlloyScan. To view them locally, use the Audit Agent system tray menu to open the logs.
Remove an agent
- Open Admin Center > Tasks and services > Audit agents.
- Open the target agent and select Remote tasks.
- Under Remove agent, click Queue removal.
- Check the task in the agent's history or Admin Center > Logs > Remote tasks.
The removal request cancels active audit work and sets a removal deadline according to the Site's policy. The task is Pending until delivery, then Removing. If the outcome cannot be confirmed, it can become OutcomeUnknown. Removing a registration record does not confirm that the software was uninstalled from the computer.
The General tab shows who requested removal and when, or a scheduled-deletion warning. Where cancellation is available, the warning directs you to Remote tasks. Withdrawing the request stops future removal instructions; an instruction already delivered cannot be recalled. An independent automatic-removal deadline can still apply.
Automatic cleanup
If an agent comes back online while scheduled for deletion, it self-uninstalls. If it remains offline until expiry, AlloyScan removes the registration record from the server side.
By default, after three days without successful communication with AlloyScan, the Audit Agent and its Updater check in less often. If communication resumes, they return to their normal check-in frequency and the 90-day period resets. After 90 days without successful communication, both components uninstall themselves from the computer.
Operational signals
| Signal | What to check |
|---|---|
| Newly deployed endpoint does not appear | Confirm outbound HTTPS/443 reachability from the endpoint and wait for first registration and audit. |
| Agent shown as Offline | Check endpoint availability and confirm the agent is still installed and running locally. |
| Endpoint present in Inventory but stale | Compare the agent's last observed activity with device audit history. |
| Computer was renamed, but the old name remains | Check whether AlloyScan has received an audit since the rename. The next audit updates the name in Inventory and the linked Audit Agent record. A routine Audit Agent or Updater check-in does not report the new name. |
Relationship to Audit Agent settings
The inactivity window and related retention behavior are controlled from Admin Center > Settings > Audit settings > Audit Agent. The agents list is the observable result surface; the settings page controls the policy.