Application Persistence Events report
The Application Persistence Events report shows your Windows devices with an activated Application Persistence (AP) policy. Specifically, the report shows the number of times the Absolute agent on a device attempted to repair or reinstall one or more persisted applicationsA third party application that is actively monitored by the Absolute agent. This feature is available only when the Application Persistence policy is activated on a device. Depending on the configuration of this policy, the agent may be able to repair the application if it's non-compliant, or reinstall it if it's missing. in the last 30 days. An application is repaired or reinstalled if the Absolute agent detects that the application software, such as an agent or client, is not functioning correctly, or it is missing.
Depending on which of the following applications you've activated in your AP policies, you can view information about their repair and reinstall events in this report:
- Cisco AnyConnect® Secure Mobility Client
- Cisco® AMP for Endpoints
- Citrix Workspace™
- CrowdStrike Falcon®
- Dell Advanced Threat Prevention
- Dell Data Guardian
- Dell Encryption
- ESET® Endpoint Antivirus
- FortiClient® VPN
- F5® BIG-IP® Edge Client®
- Ivanti® Endpoint Manager
- Ivanti® Security Controls (formerly Ivanti® Patch for Windows)
- Lenovo® Device Intelligence
- McAfee® ePolicy Orchestrator®
- Microsoft BitLocker® Drive Encryption
- Microsoft® SCCM
- Nessus Agent
- Pulse Connect Secure
- Symantec™ Endpoint Protection
- VMware Carbon Black Cloud™
- VMware Workspace ONE™
- WinMagic SecureDoc™
- Ziften Zenith
By default, the report includes information about Microsoft BitLocker Drive Encryption and Microsoft SCCM only. To view information about any other persisted applicationsA third party application that is actively monitored by the Absolute agent. This feature is available only when the Application Persistence policy is activated on a device. Depending on the configuration of this policy, the agent may be able to repair the application if it's non-compliant, or reinstall it if it's missing., you can add additional columns to the report.
You can access the Application Persistence Events report from the Reports page under Recent Events or from the Repairs and Reinstalls widget on the Dashboard.
The Application Persistence Events report applies only to devices running a supported version of the Windows operating system. In addition, an Application Persistence policy needs to be activated on each Windows device.
To view content in the Application Persistence Events report, one of the following options needs to be selected in the policy configuration for one or more Application Persistence policies:
- Report and repair
- Report, repair and reinstall
By default, the following filters are used to generate this report:
Agent status is Active and
Platform type is Windows and
Application Persistence events greater than or equal to "0"
You can also create a customized version of the report by adding filters based on one or more filter criteria. For example, you can filter the report to show only those devices with WinMagic SecureDoc > Repairs last 30 days greater than or equal to "5".
Information included on the report
The information collected from each device is organized in the following default columns:
- Device name, which includes the device's device nameThe name assigned to the device in the operating system. For Chromebooks, device name is not applicable and therefore shows as "Chrome" in the Absolute console. and serial numberThe identification number assigned to the device by the device manufacturer. For Windows devices, this value may correspond to the serial number of the BIOS, the motherboard, or the chassis, depending on the manufacturer.
- Last connectedThe date and time when a device's Absolute agent last checked in to the Absolute Monitoring Center.
- UsernameUsername of the user who was logged in to the device when an agent connection occurred. If no user was logged in during the most recent agent connection, the last detected username shows. If you are viewing a report and want to see if a user was logged in during the most recent connection, add the Current Username column to the report. If no user was logged in at the time of the connection, "No Data" or two em dashes (— —) show in the column.
- The following information about repair and reinstall events:
Application Persistence > Events last 30 days
The total number of repairs and reinstallations attempted on the device, for all persisted applications, over the last 30 days
For any device, click the value in this column to open a dialog that separates the total event count into total attempted repairs and total attempted reinstallations.
BitLocker > Events last 30 days
The total number of repairs and reinstallations attempted on the device over the last 30 days for the specified application
For any device, click the value in this column to open a dialog that separates the total event count into total repairs and total reinstallations.
SCCM > Events last 30 days
NOTE To view repair and reinstall event information for other applications, add the application's Events last 30 days column to the report.
NOTE If your Application Persistence policies are configured with the Report and repair option only, you may still see counts in the Reinstalls Last 30 Days columns. These counts may occur if the Absolute agent was able to reinstall the application from a cached installer. The Report, repair and reinstall option adds the ability to download the installer if it's not found on the device.
To view additional information about the status of a persisted application, click > Edit Columns and add one or more of the following columns associated with the application:
- Repairs last 30 Days
- Reinstalls last 30 Days
- Failures last 30 Days
- Became healthy
- Became unhealthy
- Last updated
- Repair status
- Status checked
- Status details
For example, to see if any WinMagic SecureDoc clients were repaired during the most recent status check, add the WinMagic SecureDoc > Repair status column to the report. If desired, you can then save your changes by creating a custom report.
Sorting report information
By default, the report data is sorted by the Events last 30 days column, in descending order. You can change the sort order by clicking a column heading.
Working with the report
Depending on the Absolute licenses associated with your account, and your user role, you may be able to perform some or all of the following tasks on the Application Persistence Events report:
- Open and view the report
- Search for and view individual devices in the report
- Adjust the columns on the report
- Add or remove filters
- Export the report
- Email the report on a set schedule
- Favorite the report
- Save changes to report filters and columns to create a custom report
NOTE The Application Persistence Events report is a predefined report. If you make any changes to the report, such as adding report filters, you can't save the changes to the predefined report.