Unresponsive Agents/Changing Unresponsive Agent Settings

By default, Agents that have not called back in 21 days are marked as unresponsive.

Typically agents are unresponsive because the host is offline, possibly decommissioned or re-imaged, but occasionally is caused by something else. For troubleshooting, see the Troubleshooting section below. 

If you know the host has been decommissioned, you can remove the agent from your account by following these instructions.

1
Changing the Unresponsive Agent Settings

2
Troubleshooting Unresponsive Agents

Changing Unresponsive Agent Settings

Huntress gives you the option to update the thresholds at which agents are considered "unresponsive" and when to take action (if any). 

You can change the:   

  • number of days until an agent is considered unresponsive (Default: 21 days), 
  • the number of days an agent is unresponsive before action is taken (Default: 7 days) 
  • and the action to be taken on unresponsive agents (Default: No Action).

These options can be set on the Account Level and the Organization Level:

  • Account Level will be the Global Default
  • Organization-level settings will override the Account Level settings for granularity in organizations.

To change the thresholds, follow the steps below:

  1. Login to the Huntress Web Interface.
  2. To change the Account Level settings, hover over the Huntress options menu in the upper-right corner of the dashboard.
    To change the settings for a specific organization, overriding the Account Level settings, go to Step 5.
  3. Select the Settings option from the menu.
  4. On the Settings page, you will see a section labeled Unresponsive Agent Settings.
    1. Days Until Unresponsive - The number of days an agent has not been seen by Huntress before the Agent is considered unresponsive (Default: 21 days)
    2. Unresponsive Limit - The number of days an agent is unresponsive before action is taken on the Agent (Default: 7 days). 
    3. Unresponsive Action - Action to be taken after the agent has been unresponsive past the Unresponsive Limit (Default: No Action)
  5. To change the Organizational Level click the organizations tab at the top menu in the portal. 

  6. Find the organization you wish to modify and click the edit "pencil" icon. 

  7. By default all organizations will use the Account Level settings. Any changes you make here will override the account settings. This is helpful if you have a specific organization that may have longer unresponsive times than usual. 
  8. The same options that are available at the global level are also available at the organizational level. Once you've selected the appropriate settings click the save button.

Troubleshooting

To troubleshoot, first check the Windows Services Manager to ensure the Huntress Agent services are running. If they are not running, start the service(s) and verify that they started and are still running. Sometimes restarting the services fixes an issue. You can see logs related to the agent starting and stopping in the Windows Event Viewer. 

Huntress Agent Service (HuntressAgent)
Huntress Updater Service (HuntressUpdater)

For further agent troubleshooting, visit the Basic Troubleshooting & Checking Huntress Status page.

If the services have been restarted and the agent is still not checking in, the Huntress Agent log should provide details as to a possible cause. The Huntress Agent log can be found within the following directory:

%PROGRAMFILES%\Huntress\HuntressAgent.log

Further questions/issues?

If you still need help, please use the "Contact Us" button below, or send an email to our help desk at support@huntress.io. Please attach any logs you may have to help troubleshoot.

Still need help? Contact Us Contact Us