Machines

A machine is one computer with the agent installed. Inventory › Machines lists every machine in the workspace. Open a row to see what the agent has reported, to change its settings, and to suspend or delete it.

Who can do what

Without fleet:manage the page still opens. Changes are refused with "You can view this fleet but not change it. Managing machines needs the fleet:manage grant."

The machine list

The list opens on Active machines. Above it, cards summarise the fleet. A line appears when some machines see no content: it says how many are observing without content capture, and that they report destination, timing and volume only.

Use the Lifecycle picker beside Add filter to change which machines you see. The search box reads "Search hostname, OS, group, or ID".

You can narrow the list with these filters: Status, OS, Tactic, Strategy, a build of the OS, an agent version, a machine group and the enrollment profile.

When the workspace has no machines, the list says No machines yet and "A machine shows up here within a minute of its agent being installed." If you cannot enroll, it says "Ask an admin with fleet:manage to enroll machines."

Lifecycle states

Every machine is in one of these states. The console gives the same word in the list, the machine's header and its profile.

A Stuck or Uninstalled machine is archived 30 days after it reached that state. A Stuck machine is one that never reported: a machine that reported once and then went quiet stays Active and reads Unreachable. A heartbeat from an archived Stuck machine brings it back.

Health is only shown for an Active machine. A suspended machine's last health is not a claim about anything running.

Suspend, resume and delete

Open the machine, then Lifecycle under the More menu on the tab strip. Only the actions that apply to the machine's state are listed.

To suspend a machine:

1. Open the machine and choose Lifecycle.
2. Choose Suspend on the Suspend row.
3. Confirm in the dialog, "Suspend hostname?".

The page then says "Suspended. The agent puts back what it changed on its next heartbeat."

To delete a machine, choose Delete and then Delete machine in the dialog. The dialog lists what follows:

• Removes this machine from the console. If its agent comes back online, it removes itself.
• Its key stops working for anything but that last report.
• It cannot be undone. A reinstall on that computer enrols as a new machine, which can name this one as the machine it replaces.
• The audit trail keeps who deleted it, and when.

A machine that replaces another shows Replaces hostname in its header. The older machine shows Replaced by hostname.

Removal command

The console never tells an agent to uninstall itself. Removal happens on the machine, with a removal key.

1. On the Lifecycle tab, choose Issue key on the Removal command row.
2. Confirm with Issue the key.
3. Copy the command shown and run it on the machine. On Windows, run it as Administrator. Each system gets a hosted-script form and a form that uses the installed agent.

The dialog warns that anyone holding the key can remove the agent, including its certificates and stored credential. Issuing a key invalidates any key issued before it. The key is shown once and cannot be retrieved. Nothing happens to the machine until someone runs the command.

Commands

You can ask a machine to do four things. A command is queued, and the agent picks it up on its next heartbeat. The command log keeps its outcome.

A smart scan checks the locations it already knows. A full scan walks everything the settings allow, and takes as long as the disk does.

A command is not accepted for a deleted or uninstalled machine. The old uninstall and decommission commands no longer exist: use Suspend and Delete, and uninstall on the machine with its removal key.

Diagnostics

The Diagnostics tab has four sections.

A machine keeps at most ten bundles, and the oldest is dropped when an eleventh arrives. Opening a bundle is recorded in the audit log with your name, because it carries a log tail.

Reading bundles needs fleet:manage, a stronger grant than machines:read.

With no bundles, the tab says "No diagnostic bundles from this machine yet". It adds: "A bundle arrives only when somebody asks for one with Collect diagnostics, on the agent's next heartbeat." With no crash, it says "This machine has not reported a crash."

Updates

The agent moves to each platform's default build. Two places show where a machine stands.

• The Overview tab's Software card shows Agent, Companion and Last update. Update appears when the agent is behind.
• The Lifecycle tab ends with Agent updates: a table of When, Change and Result.

To update one machine:

1. Open the machine. On Overview, find Agent in the Software card.
2. Choose Update.
3. Set Automatic retries, from 0 to 5.
4. Choose the commit button.

The dialog says who updates now (Will update), who waits (Waiting: offline machines start when they next check in) and who is Skipped. It carries "Everything in the release for each machine's platform."

A failed update retries after 15 min, 1 h, then 4 h. With no retries it says "No automatic retries. A failure waits for you."

An update moves through these states: Waiting, Downloading, Verifying, Installing, Restarting, Updated, Failed, Cancelled and Skipped. A machine below the lowest version its platform can update in place from reads Skipped · needs a reinstall.

If an update does not start, the dialog begins "The update did not start." With no updates yet the tab says "This machine has not been updated from the console." Profiles can start an update for all their machines; that is on the Enrollment profiles tab.

Address history

A machine has two addresses. The reported address is the one the agent says its main network interface uses: which subnet or VPN it is on. The observed address is the one the server sees it connect from.

Their change history is on the machine's Protection tab, under Network changes. It shows the newest three changes of each kind, and a button opens the rest. Each row gives the address, what it changed from, the date and how long ago. The list holds the last 50 changes: "The last 50 changes. Older ones are not kept."

If a machine has never moved, nothing is shown. An IP address is personal data, and a history of them is a record of where a machine has been. The heading's hint says so.

The machine's page

Configuration does not apply to an Uninstalled or Archived machine. The tab says "Configuration no longer applies: the agent was uninstalled from this machine. Its history stays here." or "Configuration no longer applies: this machine is archived. Its history stays here." Access says "Access cannot be granted while this machine is suspended."

When it goes wrong

With the API

Machines, their commands, lifecycle changes, diagnostics and update history are in Machines. Issuing a removal key is not available with an API key. Neither are elevation grants.