Troubleshooting client heartbeats

Usage and Config
1

I’m trying to understand why some clients end up appearing “offline” in the console, even though I know they are not.

  1. For testing, these are lab machines, all configured the same way (same power settings, etc.)
  2. They are all constantly powered on throughout the day, and connected to the internet via wired connection

The issue is not limited to these lab machines, but I at least know they are not laptops that might plausibly be going on/offline regularly throughout the day.

In my console, I have the heartbeat set to 15 minutes, and the time to mark a computer offline is set to 45 minutes.

I know they are online, because I see them available in BeyondTrust Remote Support, our remote desktop solution. If I connect to one and log in, the device checks in and I see it switch to “online” in the console. If I right-click → Send Refresh from the console, the client receives the ForceRefresh command and checks in successfully, also marking itself as “online” in the console.

Here’s an example of the logs I’m seeing on one of these devices that last sent a full report at 14:06, and was appearing as “offline” in the console by 16:06:

At 14:06:52 -0500 - 
   Report posted successfully
At 14:07:14 -0500 - 
   Successful Synchronization with site 'CustomSite_mycompany_Core_-2d_macOS' (version 1584) - 'http://rootserver.company.com:52311/cgi-bin/bfgather.exe/CustomSite_mycompany_Core_-2d_macOS'
At 14:07:21 -0500 - 
   Successful Synchronization with site 'CustomSite_mycompany_Print_Service' (version 1142) - 'http://rootserver.company.com:52311/cgi-bin/bfgather.exe/CustomSite_mycompany_Print_Service'
At 14:07:25 -0500 - 
   Successful Synchronization with site 'opsite106' (version 716) - 'http://rootserver.company.com:52311/cgi-bin/bfgather.exe/opsite106'
At 14:16:38 -0500 - 
   GatherHashMV command received.
At 14:16:48 -0500 - CustomSite_mycompany_Core_-2d_macOS (http://rootserver.company.com:52311/cgi-bin/bfgather.exe/CustomSite_mycompany_Core_-2d_macOS)
   Downloaded 'http://relay1.ad.company.com:52311/bfmirror/bfsites/manydirlists_20/__diffsite_2895698422986359b90f54778c7c4dc271e8fb58_to_5c1db421da9732ec803cb70434c6f7689b755cb7' as '__TempUpdateFilename'
At 14:16:55 -0500 - CustomSite_mycompany_Core_-2d_macOS (http://rootserver.company.com:52311/cgi-bin/bfgather.exe/CustomSite_mycompany_Core_-2d_macOS)
   Gather::SyncSiteByFile deleting files - count: 1
   Gather::SyncSiteByFile merging files - count: 1
   Gather::SyncSiteByFile adding files - count: 2
At 14:17:00 -0500 - 
   Successful Synchronization with site 'CustomSite_mycompany_Core_-2d_macOS' (version 2890) - 'http://rootserver.company.com:52311/cgi-bin/bfgather.exe/CustomSite_mycompany_Core_-2d_macOS'
At 14:17:01 -0500 - 
   Processing fixlet site.
At 14:22:20 -0500 - 
   Successful Synchronization with site 'CustomSite_mycompany_IT_Department' (version 2793) - 'http://rootserver.company.com:52311/cgi-bin/bfgather.exe/CustomSite_mycompany_IT_Department'
At 14:43:17 -0500 - 
   Successful Synchronization with site 'CustomSite_mycompany_Core_-2d_Universal' (version 2522) - 'http://rootserver.company.com:52311/cgi-bin/bfgather.exe/CustomSite_mycompany_Core_-2d_Universal'
At 14:49:46 -0500 - 
   GatherHash command received.
At 14:49:50 -0500 - Updates for Mac Applications Extended (http://sync.bigfix.com/cgi-bin/bfgather/updatesmacappsextend)
   Downloaded 'http://relay1.ad.company.com:52311/bfmirror/bfsites/enterprisemirror_21_54/__diffsite53' as '__TempUpdateFilename'
At 14:49:56 -0500 - Updates for Mac Applications Extended (http://sync.bigfix.com/cgi-bin/bfgather/updatesmacappsextend)
   Gather::SyncSiteByFile merging files - count: 1
At 14:49:59 -0500 - 
   Successful Synchronization with site 'Updates for Mac Applications Extended' (version 54) - 'http://sync.bigfix.com/cgi-bin/bfgather/updatesmacappsextend'
   Processing fixlet site.
At 14:51:51 -0500 - 
   Successful Synchronization with site 'CustomSite_BigFix_Administration' (version 2524) - 'http://rootserver.company.com:52311/cgi-bin/bfgather.exe/CustomSite_BigFix_Administration'
At 15:03:28 -0500 - 
   Site 'mailboxsite' is not yet available on selected relay.  Awaiting notification of availability.
   Successful Synchronization with site 'mailboxsite' (version 0) - 'http://rootserver.company.com:52311/cgi-bin/bfgather.exe/mailboxsite16420099'
At 15:04:57 -0500 - 
   User interface process started for user 'mycompany'
   PollForCommands: Requesting commands
At 15:04:58 -0500 - 
   PollForCommands: commands to process: 0
At 15:05:21 -0500 - 
   Successful Synchronization with site 'actionsite' (version 2888) - 'http://rootserver.company.com:52311/cgi-bin/bfgather.exe/actionsite'
At 15:05:53 -0500 - 
   Beginning Relay Select
   Unrestricted mode
   Configuring listener without wake-on-lan
At 15:06:31 -0500 - 
   [ThreadTime:15:05:53] ShutdownListener
   [ThreadTime:15:05:53] SetupListener success: IPV4/6
At 15:07:17 -0500 - 
   RegisterOnce: Attempting secure registration with 'https://relay1.ad.company.com:52311/cgi-bin/bfenterprise/clientregister.exe?RequestType=RegisterMe60&ClientVersion=11.0.5.203&Body=16420099&SequenceNumber=31&MinRelayVersion=7.1.1.0&CanHandleMVPings=1&MaxHops=9&Root=http://rootserver.company.com%3a52311&AdapterInfo=aa-bb-cc-dd-ee-ff_111.22.33.0%2f24_111.22.33.7_0&AdapterIpv6=aa-bb-cc-dd-ee-ff%5efe80%3a%3ac57%3a746d%3a77f7%3a347%2f64_0&AdapterIpv6=00-11-22-33-44-55%5efe80%3a%3a9c15%3a96ff%3afef9%3ac971%2f64_0'
   Unrestricted mode
   Configuring listener without wake-on-lan
   Registered with url 'https://relay1.ad.company.com:52311/cgi-bin/bfenterprise/clientregister.exe?RequestType=RegisterMe60&ClientVersion=11.0.5.203&Body=16420099&SequenceNumber=31&MinRelayVersion=7.1.1.0&CanHandleMVPings=1&MaxHops=9&Root=http://rootserver.company.com%3a52311&AdapterInfo=aa-bb-cc-dd-ee-ff_111.22.33.0%2f24_111.22.33.7_0&AdapterIpv6=aa-bb-cc-dd-ee-ff%5efe80%3a%3ac57%3a746d%3a77f7%3a347%2f64_0&AdapterIpv6=00-11-22-33-44-55%5efe80%3a%3a9c15%3a96ff%3afef9%3ac971%2f64_0'
   Registration Server version 11.0.5.203 , Relay version 11.0.5.203
   Relay does not require authentication.
   Client has an AuthenticationCertificate
   Relay selected: relay1.ad.company.com. at: 10.46.44.73:52311 on: IPV4 (Using setting IPV4ThenIPV6)
   PollForCommands: Requesting commands
   PollForCommands: commands to process: 0
At 15:07:44 -0500 - 
   Successful Synchronization with site 'actionsite' (version 2888) - 'http://rootserver.company.com:52311/cgi-bin/bfgather.exe/actionsite'
At 15:07:46 -0500 - 
   Site 'mailboxsite' is not yet available on selected relay.  Awaiting notification of availability.
   Successful Synchronization with site 'mailboxsite' (version 0) - 'http://rootserver.company.com:52311/cgi-bin/bfgather.exe/mailboxsite16420099'
At 15:07:48 -0500 - 
   Successful Synchronization with site 'CustomSite_mycompany_Print_Service' (version 1142) - 'http://rootserver.company.com:52311/cgi-bin/bfgather.exe/CustomSite_mycompany_Print_Service'
At 15:07:50 -0500 - 
   Successful Synchronization with site 'opsite106' (version 716) - 'http://rootserver.company.com:52311/cgi-bin/bfgather.exe/opsite106'
At 15:08:29 -0500 - 
   [ThreadTime:15:07:17] ShutdownListener
   [ThreadTime:15:07:17] SetupListener success: IPV4/6
At 15:17:22 -0500 - 
   Successful Synchronization with site 'CustomSite_mycompany_Core_-2d_macOS' (version 2890) - 'http://rootserver.company.com:52311/cgi-bin/bfgather.exe/CustomSite_mycompany_Core_-2d_macOS'
At 15:22:47 -0500 - 
   Successful Synchronization with site 'CustomSite_mycompany_IT_Department' (version 2793) - 'http://rootserver.company.com:52311/cgi-bin/bfgather.exe/CustomSite_mycompany_IT_Department'
At 15:25:04 -0500 - 
   GatherHashMV command received. No matching site
At 15:26:28 -0500 - 
   GatherHashMV command received. No matching site
At 15:39:23 -0500 - 
   User interface process ended (30.0) for user 'mycompany'.  Retry in 5 minutes.
At 15:42:56 -0500 - 
   Successful Synchronization with site 'CustomSite_mycompany_Core_-2d_Universal' (version 2522) - 'http://rootserver.company.com:52311/cgi-bin/bfgather.exe/CustomSite_mycompany_Core_-2d_Universal'
At 15:44:47 -0500 - 
   User interface process started for user 'mycompany'
At 15:52:19 -0500 - 
   Successful Synchronization with site 'CustomSite_BigFix_Administration' (version 2524) - 'http://rootserver.company.com:52311/cgi-bin/bfgather.exe/CustomSite_BigFix_Administration'
At 16:04:58 -0500 - 
   PollForCommands: Requesting commands
At 16:04:59 -0500 - 
   PollForCommands: commands to process: 0
At 16:07:09 -0500 - 
   Successful Synchronization with site 'CustomSite_mycompany_Print_Service' (version 1142) - 'http://rootserver.company.com:52311/cgi-bin/bfgather.exe/CustomSite_mycompany_Print_Service'
At 16:07:11 -0500 - 
   Successful Synchronization with site 'opsite106' (version 716) - 'http://rootserver.company.com:52311/cgi-bin/bfgather.exe/opsite106'

Everything appears to be running correctly, but it’s not updating its “Last Report Time” in the console, and it appears offline as a result.

Beyond the general issue, I have a few questions:

  1. Does a console needs to be active somewhere for the heartbeat to be sent? i.e. if no one is signed in to the desktop console, do the clients not send/receive any heartbeats?
  2. What happens when multiple operators are signed in and have different heartbeat values set? Do they overlap, or does it operate on whoever has the lowest value?
  3. Is this working-as-designed, or should we indeed expect to see an online device update its Last Report Time every 15 minutes reliably, assuming that’s the interval set for the heartbeat?

Thank you

2

Jason has a good topic to help diagnose and troubleshoot this type of issue here: Tip: Troubleshooting Client Reponsiveness

In particular, check out the section called: “If the client is posting reports, but much less frequently than expected; is receiving GatherHashMV messages, but is slow to execute or report back Analysis results, there may be long-running evaluations”

This is also something that BigFix Support can help you troubleshoot as well.

That said, to answer your questions:

  1. Does a console needs to be active somewhere for the heartbeat to be sent? i.e. if no one is signed in to the desktop console, do the clients not send/receive any heartbeats?

    • No. The Client manages the configured heartbeat, and does not require any input from other BigFix components (unless the heartbeat value is changed).

  2. What happens when multiple operators are signed in and have different heartbeat values set? Do they overlap, or does it operate on whoever has the lowest value?

    • The Client Heartbeat value is a global configuration, and can only be changed by Master Operators. It is not possible for different operators to have different heartbeat values (though they can have different 'Mark as offline' values).

  3. Is this working-as-designed, or should we indeed expect to see an online device update its Last Report Time every 15 minutes reliably, assuming that’s the interval set for the heartbeat?

    • It is not by design, no. However, depending on the amount of activity as well as the configuration of the Clients, you might consider tuning some parameters. This might include increasing the heartbeat interval, increasing the mark as offline interval (typically 3x the heartbeat), addressing long-running content evaluations, increasing the availability of CPU resources for the Client, and potentially some other approaches as well. I'd suggest starting with Jason's post linked above, and perhaps contacting BigFix Support as well for further assistance.
3

Thanks @Aram . I’ve been looking at Jason’s thread, but I’m not sure this is due to long-running property evaluations. Aside from extreme outliers, there are only one or two analyses taking 60-120 seconds to evaluate, and they’re set to evaluate only once per day. Doubly, on most of the lab machines I was looking at originally, the evaluation analyses don’t report anything taking longer than 60 seconds.

For example, at 11:32 PM, the following devices had not sent heartbeats for 45+ minutes, and were marked offline, despite actually being online and accessible via remote desktop.

Computer Name Last Report Time Client Evaluation - Average Cycle Client Evaluation - Max Cycle Client Evaluation - CPU Throttles Client Evaluation - First Report Time Client Evaluation - Evaluations Slower than 1 Minute Client Evaluation - Evaluations Slower than 15 Minutes Client Evaluation - Evaluations Slower than 1 Hour Client Evaluation - Slow Evaluations with Times Client Evaluation - Slow Evaluations Client Evaluation - Last UDP Ping Client Evaluation - Receiving UDP Pings
iMac01 11/13/2025 10:05:55 PM 59.0 145 490 Tue, 04 Nov 2025 18:18:19 -0500 Thu, 13 Nov 2025 20:11:57 -0500 True
iMac02 11/13/2025 10:01:21 PM 61.0 254 490 Mon, 03 Nov 2025 12:19:45 -0500 Thu, 13 Nov 2025 20:13:32 -0500 True
iMac03 11/13/2025 9:16:14 PM 60.0 157 490 Mon, 03 Nov 2025 22:26:10 -0500 Thu, 13 Nov 2025 20:11:40 -0500 True
iMac04 11/13/2025 10:04:39 PM 15.0 128 490 Wed, 05 Nov 2025 22:46:01 -0500 Thu, 13 Nov 2025 20:11:33 -0500 True
iMac05 11/13/2025 10:18:13 PM 14.0 138 490 Sat, 08 Nov 2025 19:57:27 -0500 Thu, 13 Nov 2025 20:11:25 -0500 True
iMac06 11/13/2025 10:06:28 PM 38.0 103 490 Mon, 10 Nov 2025 10:11:19 -0500 Thu, 13 Nov 2025 20:11:26 -0500 True
iMac07 11/13/2025 9:48:45 PM 44.0 106 490 Sun, 09 Nov 2025 13:42:59 -0500 Thu, 13 Nov 2025 20:11:39 -0500 True

I'll open a ticket for this.