Problem
This happens when you do not understand why some events are red / blue / yellow / green, etc.
Solution
EVENT NOTIFICATION located under MONITOR > EVENT
After deploying a modified prevention policy with the “Disable prevention” option Enabled, events will begin to show in the Monitor > Events tab. As the system receives the policy and system activity occurs, new Red DENY 
or Blue ALLOW 
warning, Green Successful/Information 
, and Maroon Critical 
events will begin to appear in the Management console. You can then handle those exceptions and configure the policy as required.
EXAMPLE:
Source Machine | Date | Event type | Severity | Description |
| 10-Jul-2015 09:47:28 PDT | File Access | Warning | File Read Allowed for REPORTINGSERVICESSERVICE.EXE on \Device\Mup\win-q11o1qgmg36\PIPE\sql\query |
| 10-Jul-2015 09:38:56 PDT | Agent Status | Information | Successfully updated the policy to WIN 7 BASIC OS sym_win_hardened_sbp 109 |
| 10-Jul-2015 09:26:55 PDT | Agent Status | Critical | Component LiveUpdate failed. |
| 10-Jul-2015 09:26:55 PDT | File Access | Warning | File Write Denied for SISIPSSERVICE.EXE on C:\Windows\system32\drivers\symefasi\data\VT20150710.033 |
AGENT PANE located under ASSETS > NETWORK
EXAMPLE:
Name | IP Address | Version | OS | Last Contact | ||
|
|
| 192.168.1.131 | 6.5.0.355 | Windows | 10-Jul-2015 |
Admin-PCThe Agent health is displayed in first column of the agent Pane information
It indicates whether an agent is in contact with the management server. You can view agent properties to track the health of an agent. Agent health is denoted by a green, yellow, or red circle icon. A green icon indicates that an agent is online. A yellow icon indicates that an agent is possibly offline. A red icon indicates that an agent is offline. Separate yellow or red default values are provided for native and virtual agents
EXAMPLE:
Agent Health | ||
| Green | This Symbol means healthy |
| Yellow | This Symbol means Minor issue |
| Red | This symbol means major issues |
The color of the agent health icon is determined using the following rules:
• Agent health is set to green when the last contact time or the last event time plus the yellow interval seconds is greater than the current time.
• Agent health is set to yellow when the last contact time or the last event time plus the yellow interval seconds is less than the current time and the last contact time or the last event time plus the red interval seconds is greater than the current time.
• Agent health is set to red when the last contact time or the last event time plus the red interval seconds is less than the current time.
The icon in the second column of the agent pane displays the agent feature state.
EXAMPLE:
Agent Feature Set | ||
| Shield | Prevention active |
| Shield with red X | Limited or No Prevention |
| Up Arrow | Prevention will be Re-enabled after reboot |
| Down Arrow | Prevention will be Disabled after reboot |
| Circle with Diagonal Line | Prevention completely disabled |
- A shield icon indicates the agent is protected, but a red X through the shield indicates limited or no protection.
- If a driver is enabled but no policy is applied, the red X is displayed.
- An up arrow means the prevention feature is disabled, but will be enabled after a reboot, and a down arrow indicates the prevention feature is enabled, but will be disabled after a reboot. The agent continues to enforce the most recent prevention policy until the reboot. To stop enforcement before the reboot, apply the Null policy before disabling the prevention feature.
- A circle with diagonal line means the prevention feature is completely disabled.
The third column in the agent pane displays the agent name and status, such as:
EXAMPLE:
Agent Name Column | |
Default Font | No Pending Changes |
BOLD | Pending changes received by server but not the agent |
BOLD & ITALIC | Pending changes not yet received by SERVER |
| Changes are pending and being processed |
| ERROR |
EXCLAMATION- Normal lettering means there are no pending changes or outstanding errors.
- Bold lettering means pending changes to the agent that were received by the management server, but not applied to the agent. Check the agent’s property Status tab for information about the failed action, then decide how to manually solve the problem.
- Bold and italic lettering indicates pending changes to the agent’s configuration or policy assignment that have yet to be received by the management server. When the changes are applied to the agent, the lettering reverts to normal.
- Flag icon indicates changes to the agent’s configuration or policy assignment are pending.
- Exclamation icon means an error has occurred.