Heartbeat troubleshooting

Question

Hi all, 
 I'm using a XG 310 and trying the sophos heartbeat with the Sophos Enpoint Security Advanced Protection. 
 All my client works fine and HB is correctly shown on the XG310 dashboard, but one single client continuosly switch from RED to GREEN state. 
 My Heartbeat logs show that this state changes every few seconds, but I don't have any log about WHY it is changing. 
 From cloud console, in the client event log, there isn't any trace of this problem. The client displayed correctly without error. 
 Now I'm going to remove and reinstall the endpoint security, but what I like to know is where I could get a more detailed log about this problem, as the standard firewall logs are completely useless. 
 
 Thanks

sachingurung · Answer

Hi All, 
 Sophos Heartbeat identifies user health based on User traffic activity through Sophos Endpoint Protection. When an endpoint is installed on the system it connects with Sophos firewall to give synchronized security. Heartbeat notifies firewall when a user becomes infected with a malware that a firewall detects. Firewall blocks the endpoint from communicating inside or outside the network to help prevent harm until a healthy heartbeat is restored. During such instances, the heartbeat status for the system becomes red as the system is denied any communication through firewall until the threat is prevented and cured. 
 If the heartbeat logs are changing every second, try to reinstall endpoint protection on the concerned system. When Sophos Endpoint Protection is removed from Endpoint there will be an Endpoint with Missing Heartbeat shown on the Firewall. Endpoint gets a new name and when Sophos Endpoint Protection will be reinstalled on the endpoint there are two Endpoints shown on the Firewall. A green one from the new installation and the old Endpoint shown as Missing Heartbeat. This is technically correct, as the new Installation of Sophos Endpoint Protection is identical to a new Endpoint. Monitor the behavior and the status after this exercise. 
 To get rid of the old Endpoint, the Sophos Central admin has to remove it manually. 
 Can you raise a case in support and provide me the ticket# to deep inspect the behavior. 
 Thanks