Tracing Events in Offline Mode

This capability is available for Windows, macOS, and Linux Sensors.

The Sensor ensures that events are not lost if the device is offline due to the lack of network connectivity or a system reboot. When the device is offline, the Sensor continues to trace events and store them on the local disk. The Sensor stores offline events, utilizing up to 1 GB of free disk space. When this limit is reached, the Sensor stops recording new events until the queue has been cleared. The Sensor logs will include a warning message to indicate that the event tracing has been paused.

The events are updated in the Cyberhaven UI after the network connection to the device is restored. However, the Sensor does not perform content inspection or capture content, or screenshots when the device is offline.