Monitoring agent operation

How to open agent monitoring in Codenica?

You can open the view from the application menu: Menu -> Monitoring -> Agents. This place is intended for administrators who want to quickly check whether Codenica Insight Agent is correctly installed on computers, whether it communicates with the backend, and whether work monitoring data is regularly sent to the system.

This view is not primarily used to assess employee activity. Its main purpose is technical control of agents: program version, last synchronization, errors, warnings, queue state, backend status and data quality. This makes it easier to distinguish a situation in which a computer is truly not sending data from one where the issue is only delayed aggregation or agent configuration.

At the top of the view there is an action panel related to the agent. You can download the Codenica Insight Agent installer, open the installation instructions and go to monitoring settings. Below it is the Analysis Panel, which collects the most important indicators for the selected period, followed by the agent list in table form.

There is an important exception in this view: one table record means one agent or computer, not one monitoring day. After clicking a record, the application shows details of the selected agent, including daily summaries from the period set in filters.

Agent list in computer monitoring

The table in the Agents view helps you quickly find workstations that require technical attention. By default, the list is focused on day-to-day control of agent operation, so it shows, among other things, computer description, agent version, last synchronization, last IP address and overall agent health. These columns are enough to notice computers that have not communicated with the system for a long time or have started reporting problems.

You can enable additional diagnostic columns in the table configuration. They are useful when you need to check more precisely why monitoring is not delivering data or why some information arrives late.

Agent health shows the overall assessment of the agent, for example healthy, warning, error, offline or blocked.
Agent version helps find computers with an outdated Codenica Insight Agent version.
Last sync and Last communication show when the agent last sent data or contacted the backend.
Backend Status tells you whether the last communication was accepted by the system.
Errors, Warnings and Failed Syncs help separate ordinary technical activity from problems that need review.
Pending Queue, Sending Queue and Failed Queue show whether a queue of data waiting to be sent is growing on the computer.
Blocked and Blocked reason help check whether the agent was intentionally blocked in the system.

In practice, it is best to start with agents that have an error status, a high number of failed synchronizations, a large pending queue or no fresh communication. These are the most common signals that computer monitoring needs intervention.

Analysis panel in monitoring agent operation

The Analysis Panel in the Agents view shows the state of the whole agent group in the selected date range. You can switch the period to a day, week, month or custom range. Two data calculation modes are also available: Total, meaning the sum for the period, and Daily Average, meaning a value calculated per day. This distinction matters because the same number of errors can mean something different in one day than in a long range covering many computers.

The most important indicators in the panel describe:

Agents - the number of agents included in the analysis.
Events - the total number of technical events recorded by agents.
Errors and Warnings - the number of errors and warnings that may require diagnostics.
Failed Syncs and Successful Syncs - how effectively agents communicate with the backend.
Failed Commands - commands the agent did not execute correctly, such as update, restart or stop.
Pending Queue and Failed Queue - the state of data queues waiting to be sent or not processed correctly.
Health Warnings - warnings related to agent health.
Computers - the number of computers linked to analyzed agents.

It is worth reading the panel from left to right: first check the monitoring scale, then the number of events, and only then errors, synchronizations and queues. This makes it easier to decide whether the problem affects a single computer, a larger group of workstations or the whole environment.

Rankings and categories in agent monitoring

The ranking and category tab helps you see where most agent monitoring events are concentrated. A high result does not always mean a failure. An agent that communicates frequently with the system and does a lot of work may naturally generate more entries. Only combining rankings with errors, synchronization and queues shows whether the activity is normal or problematic.

In this part of the panel you can analyze several data groups:

Event Types - event types reported by agents, for example synchronization, health warnings or command handling.
Severities - event severity levels, making it easy to see the share of information, warnings and errors.
Backend Statuses - backend responses to agent communication, especially important when diagnosing failed synchronizations.
Top Agents - agents generating the most events in the selected period.
Top Computers - computers where agent activity is most visible in the data.
Top Employees - employees linked to computers, if the system can assign data to a user.

Rankings are especially useful after agent rollout, after a version update or after changing monitoring settings. They help check whether new events appear evenly or only on selected computers.

Trends and hourly presence in agent monitoring

Trends show how agent operation changed across the days of the selected period. In the Agents view, the most important charts are events, errors, failed synchronizations and pending queues. If the number of errors or failed synchronizations suddenly rises after a calm period, check whether network configuration, security policies, agent version or backend availability changed at that time.

Trend charts help answer practical questions:

Is the agent problem growing gradually, or did it appear suddenly on one day?
Do errors occur constantly or only in short periods?
Does the pending queue decrease after connection is restored, or does it keep growing?
Do failed synchronizations affect individual days or the whole analyzed range?

A separate element is the Hourly Presence chart. It shows the local hours in which agent log summaries appeared. It is not a work time counter, event count or synchronization duration. A marked hour means that an agent log entry was observed during that hour for the monitored day.

Period comparisons in agent monitoring

Comparisons let you compare the current period with a previous range of similar length. In agent monitoring this is very useful, because a single error count without context can be misleading. Only comparison shows whether the situation is stable, improving or getting worse.

Pay attention mainly to changes in technical metrics:

an increase in errors may indicate a problem with the agent version, configuration or local Windows environment,
an increase in failed synchronizations may point to a connection issue, agent registration issue or backend response problem,
an increase in the pending queue suggests that the agent collects data faster than it can send it,
an increase in the failed queue means that some data was not processed correctly and requires review,
an increase in failed commands may mean that the agent does not correctly execute administrative commands.

When interpreting comparisons, keep scale in mind. If many new computers were added to monitoring in the current period, an increase in event count is natural. A rise in the share of errors, failed synchronizations or queued backlog relative to the number of agents is more concerning.

Anomalies in agent monitoring

The anomalies tab points to situations that differ from expected agent operation and may require administrator action. The system does not show ordinary informational events here, but threshold breaches for errors, synchronization, queues and commands.

The Agents view can detect, among other things:

high agent error share - when the agent generated many errors compared with all events,
high failed synchronization share - when many attempts to send data fail,
large pending queue - when records waiting to be sent accumulate on the computer,
failed queue - when some records were not processed correctly,
high failed command share - when the agent does not correctly execute commands such as update, restart or stop.

Each anomaly contains the computer or agent name, date, current value, reference threshold and evidence data. It is best to begin diagnostics with high-severity anomalies, especially when synchronization errors and queued backlog appear at the same time.

Record details in monitoring agent operation

After clicking a record on the list, the application opens details of the selected agent. In this part you no longer see the general installation list, but daily summaries for a specific computer or agent in the selected period. This is a good way to check whether a problem visible in the table is confirmed by daily data.

Details can include both technical agent information and aggregated data from other monitoring areas:

summary dates, first and last activity, and active hours,
active time, foreground time, idle time, keyboard and mouse clicks,
used applications, last application and most used program,
web domains, page open count and last domain,
documents, clipboard operations, file events and data transfers,
USB events, print attempts and security policy statuses,
blocked applications, blocked websites and policy violations,
audit status, counts of hardware items, software, USB devices, printers and security checks,
last backend status, last error, queues and information about agent commands.

This makes record details useful not only when an agent fails, but also when other monitoring views have missing data for a computer. You can then check whether the agent worked at all, whether it sent data and whether the backend accepted it correctly.

Data quality and freshness in agent monitoring

Data quality and freshness sections help assess whether the results visible in the panel are complete. This is especially important in the Agents view, because missing data can have several causes: the computer may have been turned off, the agent may not have sent data, synchronization may have failed, or the current-day record may still be aggregating.

Pay attention to the following information:

Details Coverage - shows what share of records has complete details,
Records Without Details - indicates records without detailed data even though a summary may exist,
Live Partial - means current-day data that may not be closed yet,
Historical Open Records - indicates older records that still look unfinished,
Invalid Details - informs about a problem with the detailed data structure,
Missing Data Days - shows days from the selected range for which the system has no agent logs.

Data freshness tells you when the view was generated, whether it includes the current day, what the newest record is and whether there is a delay. If the panel shows quality or freshness issues, first check the agent's last communication, backend status, pending queue and last error on the specific computer.