Clients
The Clients page displays all registered EventLogAgent instances across your environment. It is the primary place to confirm that agents are online and communicating with the EventLogCentral server, review agent configuration, and manage group assignments.
Accessing the Clients page:
In the left navigation menu, click Clients.
Client list overview:
The client list displays the following information for each registered agent:
| Column | Description |
| Machine Name | The hostname of the machine running the EventLogAgent service |
| IP Address | The network address of the client |
| Group Assignment | The group the client currently belongs to |
| Last Heartbeat | The last time the agent checked in with the EventLogCentral server |
| Status | Online or Offline indicator |
| Effective Configuration | The current audit policies and settings applied to the client |
Client status indicators:
| Status | Description |
| Online | The agent has checked in within the expected heartbeat interval |
| Offline | The agent has not checked in recently — may indicate a service or connectivity issue |
If a client shows as Offline, check the following:
- Confirm the EventLogAgent service is running on that machine
- Confirm the agent appsettings.json points to the correct EventLogCentral server address
- Check for network connectivity issues between the agent and the server
Review the agent logs for errors:
C:Program FilesBlue Lance 2-0LTA_EventLogAgentlogs
Searching and sorting clients:
Use the search bar to filter clients by machine name, IP address, or group name:
Example: Type “SQL” to find all SQL servers
Click any column header to sort the client list by that field. Click again to reverse the sort order — ascending and descending indicators show the current sort direction.
Pagination:
Control how many clients are displayed per page by selecting 10, 25, 50, or 100 items per page. Use the page navigation at the bottom of the list to browse multiple pages.
Viewing client details:
Click on any client name to view its full details:
- Registration information — when the agent registered with EventLogCentral
- Current configuration version — the version of the configuration the agent is running
- Applied audit policies — the audit policies currently active on this client
- Event log collection settings — which Windows Event Logs are being collected
- File audit rules — any file system monitoring rules applied to this client
Client actions:
From the client list, the following actions are available via the actions menu next to each client:
| Action | Description |
| View Effective Configuration | See the full set of policies and settings currently applied to this client |
| Reassign Group | Move the client to a different group — the client will receive the new group’s configuration on its next heartbeat |
| View Audit Log | Review a history of configuration changes made to this client |
| Force Configuration Sync | Trigger an immediate configuration update rather than waiting for the next scheduled heartbeat |
Configuration sync timing:
After making configuration changes in EventLogCentral, agents receive updates on their next heartbeat cycle. The default heartbeat interval is 5 minutes. If changes need to be applied immediately, use the Force Configuration Sync action on the relevant client.
Best practices:
- Monitor the Last Heartbeat column regularly to identify agents that have stopped checking in
- Use the search function to quickly locate specific machines or groups of machines by name or role
- Investigate any client showing as Offline promptly — an offline agent represents a monitoring gap on that machine
- Use Force Configuration Sync when deploying urgent policy changes rather than waiting for the next heartbeat cycle
- Use descriptive machine naming conventions so the client list is easy to navigate in large environments
[Your administrator should establish a routine check of the Clients page — at minimum weekly — to confirm all expected agents are online and reporting correctly.]