Health alerts

By default, the System tab of the Status > Dashboard page includes a Health Alert Summary that lists potential concerns encountered by monitored components of your web protection software. These include:

  • The initial database is in use
  • The Forcepoint URL Database is being updated
  • The Forcepoint URL Database is downloading for the first time
  • The Forcepoint URL Database is more than 1 week old
  • The Forcepoint URL Database did not download successfully
  • Low disk space on the management server machine
  • WebCatcher is not available
  • The primary Policy Broker is now available
  • Log Server is not running
  • The Log Database is not available
  • Presentation reports scheduler is not connected to the Log Database
  • The Log Database ETL job has not completed successfully after 4 hours
  • One or more presentation report jobs failed
  • There is no Log Server configured for a Policy Server
  • Low disk space on the Log Server machine
  • Log Server has not received data from Filtering Service for over an hour
  • No monitoring NIC has been configured for a Network Agent
  • Low memory on the Network Agent machine
  • A Log Server cache directory contains more than 100 cache files
  • No Filtering Service has been configured for a Network Agent
  • High CPU usage on the Network Agent machine
  • There is no Network Agent configured for a Policy Server
  • Filtering Service is not running
  • Network Agent is not running
  • Low disk space on the Filtering Service machine
  • High CPU usage on the Filtering Service machine
  • Low memory on the Filtering Service machine
  • A DC Agent instance is unable to access a required file
  • DC Agent has insufficient permissions
  • Filtering Service is unable to communicate with DC Agent
  • Filtering Service is unable to communicate with Logon Agent
  • Filtering Service is unable to communicate with eDirectory Agent
  • Filtering Service is unable to communicate with RADIUS Agent
  • A Policy Broker replica has not synchronized with the primary in more than 24 hours
  • Usage Monitor is not running
  • Usage Monitor is not available
  • The forensics repository location could not be reached
  • A configuration problem is interfering with Threats forensics data collection
  • The forensics repository has reached 90% of its maximum size
  • Some records in the forensics repository are scheduled to be deleted within 1 week
  • A Policy API Server is not running
  • Filtering Service can’t connect to the Management API
  • Message Broker Handler is not running
  • An Event Message Broker is not running
  • Multiplexer or Bridge Service is not running or not responding
  • Multiple Event Message Brokers are not running
  • A SIEM Connector is not running
  • A Cloud App Service is not running

Forcepoint Web Security, alerts are also provided for the following Content Gateway issues:

  • Content Gateway is not running
  • Content Gateway is not available

If you have the Hybrid Module, health alerts may also appear for the following conditions:

  • A Sync Service is not running.
  • There is no Sync Service associated with a Policy Server instance.
  • On-premises components are unable to connect to the hybrid service.
  • Disk space is low on the partition hosting Sync Service.
  • Sync Service has been unable to download log files.
  • Missing information required to activate the hybrid service.
  • A Directory Agent is not running.
  • There is no Directory Agent associated with a Policy Server instance.
  • Alerts were received from the hybrid service.
  • Sync Service has been unable to send data to Log Server.

Deployments that include Forcepoint CASB may display the following:

  • Connection to Forcepoint CASB has been lost
  • Protected Cloud Apps is enabled but not fully configured.

The icon next to the alert message indicates the potential impact of the related condition.

The message is informational, and does not reflect a problem with your installation (for example, WebCatcher is not enabled, or Filtering Service is downloading a Forcepoint URL Database update).

The alert condition has the potential to cause a problem, but will not immediately prevent policy enforcement or reporting (for example, the Forcepoint URL Database is more than 1 week old, or the subscription key is about to expire).

A component is not functioning (has not been configured or is not running), which may impair policy enforcement or reporting, or your subscription has expired.

Click an alert message in the Health Alert Summary to go to the Status > Alerts page, which provides additional information about current alert conditions. Click Learn More (for informational alerts) or Solutions (for errors or warnings) for details and troubleshooting tips.

If a health alert indicates that messages were received from the hybrid service, check the Hybrid Service Alerts table for details.

In some cases, if you are receiving error or status messages about a component that you are not using, or that you have disabled, you can choose to hide the alert messages. See Reviewing current system status for more information.