Description"Persistent Agent Scan not performed" alarm not triggering right away when the Persistent Agent is no longer detected.
Before
the "Persistent Agent Scan not performed" event is generated, the host record's MAC to IP must be resolved to check the host's status. If the
information is not in cache, the event will not trigger
until the next L3 Poll completes. This in turn delays the alarm
trigger.
SolutionEnsure L3 Polling is completing. This can be verified by navigating to Network Devices > L3 Polling (IP -> MAC). The L3 Last Polled and L3 Last Poll Success should be the same timestamp.
For more details and instructions on triggering alarms when the Persistent Agent stops scanning, refer to the Coobook recipe in the Fortinet Document Library.