Configure inactive sources
Devices that have not sent or received data over the last 30 minutes are considered inactive and stop generating metrics. However, inactive devices can still appear in feature areas such as search results, activity maps, dashboards, and detections.
The following settings enable you to immediately remove inactive sources from search results and to specify when the system can automatically delete inactive devices from the ExtraHop system.
Here are some considerations about configuring inactive source settings:
- You must have System and Access Administration user privileges.
- Settings must be configured on a sensor. Devices deleted from the sensor are also deleted from the connected console.
- The ExtraHop system checks for inactive devices daily and deletes up to 5,000 devices at each check; devices that are inactive for the longest period are deleted first.
- Deleting devices affects your device capacity count.
- Deleted devices associated with features such as activity maps, dashboards, and detections are displayed as an unknown device.
- Deletion events are displayed in the audit log.
- Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
- In the System Configuration section, click Inactive Sources
-
From the Search Results section, remove inactive sources from search results by
completing the following steps:
- Specify the number of days, from 1 to 90, that devices have been inactive.
- Click Remove Now.
-
From the ExtraHop System section, configure when to delete inactive devices
from the ExtraHop system:
- To delete devices that have been inactive for a specified number of days, select the associated checkbox and then specify a value between 10 and 1,000.
- To delete inactive devices after a specified number of devices are discovered, select the associated checkbox, and then specify a value between 50,000 and 10,000,000.
- Click Save.
Thank you for your feedback. Can we contact you to ask follow up questions?