Which monitoring screens does AGS have; what does each one show?

Short answer

AGS monitoring is per vService: it is done with the tabs of the screen that opens when a vService is selected from the AGS-Enabled vServices category in the Left Monitor Panel. Dashboard (the first tab, which carries the name of the vService) shows the session, authentication, lockout, MFA, system and bot metrics in the selected time range in panels; Live Stats refreshes the current counters of the same vService once a second. Sessions shows the open sessions, Lockout the lockouts and the failed attempt counters, TOTP the authenticator records of the users, Audit Logs the historical audit events, and Engine the state of the AGS engine per device. The Bot Protection tab appears only if a bot protection policy that keeps a table has been assigned to the vService. The AGS Management and Flowchart tabs are for configuration, not for monitoring.

How Does It Work?

The tabs are divided according to four questions (division of labor between tabs):

Question	Tab	What it shows	Intervention
What is happening?	Dashboard	Dashboards for a selected time range: AGS - Summary, AGS - Sessions, AGS - Lockouts, AGS - MFA, AGS - System, AGS - Bot Protection	-
	Live Stats	Instantaneous access, session, authentication, CAPTCHA, MFA, lockout and storage counters; no data is stored	-
Who is inside right now?	Sessions	The open sessions, the authentication state and the user information	Revoke Session(s)
	Lockout	The active lockouts and the failed attempt counters	Clear Lockouts, Reset Failures
	TOTP	The authenticator records of the users	Reset TOTP
What happened, and why?	Audit Logs	Authentication, MFA, lockout and access decision events, according to the time range	-
Protection and the engine	Bot Protection	The counter and block tables of the bot protection policies	Reset Counters, Remove Blocks
	Engine	The state, uptime, memory usage and storage usage of the AGS engine	Restart Engine, Clean Storage

Sessions, Lockout and TOTP show the state of the session store at the moment it is displayed; for the history, Audit Logs and Dashboard are used.

AGS Monitoring in TR7

• Device-wide view: All AGS-enabled vServices are listed on the AGS-Enabled vService List screen.
• Forwarding the records externally: Audit Logs events are sent to a SIEM with Log Forwarding profiles; threshold alarms are defined with Notification Profiles (What are log forwarding and notification profiles for in AGS?).
• Administrator operations: Operations such as Revoke, Clear Lockouts, Reset TOTP and Restart Engine are written not to Audit Logs but to the User Logs screen.
• Cluster: Live Stats and Engine show each device in a separate column or card; Audit Logs combines the events of the two devices in a single list with the Source column.

Common Misconceptions

• "The Sessions screen also shows past sessions." Only the sessions alive at that moment are listed; a session whose time expires drops off the list. Past logins are in Audit Logs.
• "Live Stats and Dashboard show the same data." Live Stats shows only the current moment and does not store data; Dashboard is used for trends and comparison.
• "The Bot Protection tab exists on every vService." The tab appears only if a bot protection policy that keeps a table has been assigned to the vService.

How it is done in the documentation

• AGS-Enabled vServices · Tabs
• AGS-Enabled vServices · Division of Labor Between Tabs
• AGS - AAM · Monitoring and Visibility
• Dashboard · View Tabs

Related questions

• What are AGS Audit Logs; which events are recorded?
• What is the AGS engine; what does the Engine screen show?
• How is an AGS session kept; what does the Sessions screen show?
• What is an Account Lockout Policy; how does account lockout work?