Technical Tip: Collector agents show different numbers of users

Description

This article describes the reason why redundant collector agents may display different user counts.

Scope

FortiGate, Windows Collector Agent.

Solution

For redundancy, there can be more than one Windows Collector Agent in an environment. FortiGate is connected to only one Collector Agent at a time. The primary Collector Agent performs stricter checks for filtered users than for unfiltered users.

Checks for unfiltered users are less strict to optimize resources, which means some logons may become outdated. Since the secondary Collector Agent is not connected to FortiGate, it cannot determine which users may or may not match a group filter. Therefore, it performs strict checks for all users, ensuring that all logins remain updated.

As a result, the total number of users on the non-connected Collector Agent may be lower than on the connected Collector Agent (stale logins are removed more quickly).