# Agent Footprint

The document provides an in-depth overview of the Endpoint Central agent, covering its communication with the server, tasks managed, and data consumption across Windows, Mac, and Linux systems. It details the agent's role in tasks like inventory scans, patch scans, and deployment, along with the communication process using HTTPS and specific ports. The document also covers the agent's footprint in terms of bandwidth, CPU, and memory consumption.

- [Agent](#agent)
- [Agent Server Communication](#agent-server-communication)
- [Data collected by Agent](#data-collected-by-the-agent)
- [Agent Functionalities](#agent-functionalities)
- [Windows Agent Footprint](#windows-agent-footprint)
- [Mac Agent Footprint](#mac-agent-footprint)
- [Linux Agent Footprint](#linux-agent-footprint)

## Agent

The Endpoint Central agent is a lightweight software that is installed in computers which are managed using Endpoint Central. It is an essential component responsible for the product functioning. The agent helps complete various tasks initiated by the Endpoint Central server. For example, if you want to uninstall a software application from a computer on your network, you can configure the necessary settings on the Endpoint Central server. The agent applies these settings and ensures that the task is completed effectively.

## Agent-Server Communication

The agent also updates the Endpoint Central server with the status of deployed configurations. It periodically checks the server for instructions related to tasks and performs them accordingly. The agent contacts the server when the following actions occur:

- User Logon
- Computer Startup
- 90 minutes refresh cycle

### User Logon

During user logon, the agent contacts the server to collect user-specific configuration details. This information is also retrieved during the 90-minute refresh cycle.

### Computer Startup

At computer startup, the agent contacts the server to collect computer-specific configuration details. These details are also retrieved during the 90-minute refresh cycle.

### 90-Minute Refresh Cycle

- After installation, the agent downloads a file named **"Metadata.xml"** from the server. This file includes necessary information such as deployed tasks.
- The agent processes this file, downloads dependency files and patches, and executes tasks accordingly.
- The time when the agent downloads the **Metadata.xml** is saved in a registry key. This triggers a refresh cycle every 90 minutes based on the last download timestamp.

## Data Collected by the Agent?

- **Missing Patches:** Identifies any missing updates on the client machine.
- **Installed Software:** Lists software names, versions, and indicates whether they are Microsoft or general applications.
- **Hardware Details:** Includes processor, RAM, GPU, BIOS, manufacturer, model, service tag, and more.
- **Operating System Info:** Provides the OS name, version, language, and Windows Product Key.
- **System Info:** Covers machine name, domain, memory, IP and MAC addresses, logged-in user details, and system startup time.

## Agent Functionalities

Some of the key functionalities of the Endpoint Central Agent are:

- **Inventory Scan:** Once the agent is installed on network endpoints, it automatically scans and collects all hardware and software asset details. This data is sent to the server during the next agent-server contact.
- **Patch Scan:** After installation, the agent periodically scans the systems to assess patch requirements. An initial scan occurs during installation, followed by scheduled scans based on DB-sync intervals. Scan results are stored in the server database and can be viewed from the web console.
- **Troubleshooting:** End users can run the troubleshooting tool to verify communication between the agent and the server.
- **Remote Control:** During troubleshooting, technicians can initiate chat, voice calls, video calls, or transfer files to the end-user's remote machine for support.
- **Deployment:** The agent communicates with the server to retrieve configuration tasks, security policies, patch deployments, and other updates and executes them on the endpoint.

## Windows Agent Footprint

### Ports and Protocols

- Since Endpoint Central is a Client-Server model, the agent communicates with the Central Server using the HTTPS protocol through the port 8383.
- Any on-demand task is initiated by the Notification Server. It uses the TCP port 8027 to communicate with the Endpoint Central agent.

All the below-mentioned data are predicted from a single agent machine. Up to **1 GB (approximately)** of disk space will be consumed by the agent installed drive.

Uploaded files in the configuration/software packages, will be downloaded in the agent installed directory only. Hence, space consumption will be varied based on the uploaded files. Those downloaded files will be removed when the deployed configuration is executed successfully.

### Agent Processes

| Agent Process | Running Application Name | Bandwidth Consumption (Approximately) | CPU Consumption (Approximately) | Memory (RAM) Consumption (Approximately) |
|---|---|---|---|---|
| At Agent Ideal state | dcagentservice.exe<br>dcondemand.exe<br>dcagenttrayicon.exe<br>(Running separate application for each logged on user)<br>(For windows and Mac) [Above 3 are ever running processes] | dcagenttrayicon : Recommended Atleast 100 KBPS | dcagenttrayicon : maximum 0.1% | dcagenttrayicon : Upto 8MB |
| Refresh policy (90 mins once - without any deployment) | dcconfig.exe | Recommended Atleast 100 KBPS | < 1% | Approx - 10MB |
| Applying configuration (90 mins once) | dcconfig.exe | Recommended Atleast 1024KBPS | 10 to 20 % (based on configuration deployed) | Approx - 50MB (changes based on configuration) |
| Inventory scan (At Scheduled time in server) | dcinventory.exe | Recommended Atleast 1024KBPS | 5 to 10% | Approx - 30MB |
| Patch scan (When applying patch task) | dcpatchscan.exe | Recommended Atleast 1024KBPS | CPU usage - Single Core - 28%, Dual Core - 22%, 4 core and above - Max 18% | Approx - 80MB |
| Updating Power refresh (3 hours once) | dcconfig.exe | Recommended Atleast 100 KBPS | < 10% | Approx - 5MB |
| Logon policy (whenever a user logon) | dcconfig.exe | Recommended Atleast 1024KBPS | 10 to 20 % (based on configuration deployed) | Approx - 50MB (changes based on configuration) |
| Agent Upgrade (Applying PPM and if the agent version changes) | dcconfig.exe<br>AgentUpgrader.exe | Recommended Atleast 1024KBPS | 0 - 2% | 6 MB |

### Security Features

| Module Name | Agent Process | Running Application Name | Bandwidth Consumption (Approximately) | CPU Consumption (Approximately) | Memory Consumption (Approximately) |
|---|---|---|---|---|---|
| Application Control | Application Processing server | Verifytrustedfiles.exe | Will download the configuration in the dcconfig exe | 0.25 - 0.3% | 30 MB |
| Application Control | Application Scanner | Dcprocmon.exe | 100 KB - 200 KB | 0.3% | 6 MB - 24 MB |
| Application Control | Process Notifier | AppCtrlToast.exe | NA | 0 - 1% | 20 MB |
| Application Control | ACP Driver control | DriverCtrl.exe | NA | 0 - 0.18% | 1 - 2 MB |
| Application Control | ACP Privilager | Privilager.exe | NA | 0 - 1.4% | 1 - 1.5 MB |
| Application Control | Component Upgrade | dcconfig.exe | 3.5 MB | 0 - 1% | 1 MB |
| Browser Security | Browser Agent Module | bmagent.exe | 20kb | 9-15% | 20 MB |
| Browser Security | Browser native Host Application | brnativehost.exe | NA | 0-0.5% | 8 MB |
| Browser Security | Component Upgrade | dcconfig.exe | 2.1MB | 0 - 0.5% | 1 MB |
| BitLocker Management | BitLocker Policy Deployment | dcconfig.exe | 3 KB | 0 - 1% | 5 MB |
| BitLocker Management | BitLocker Policy Process | BitlockerMgmt.exe | NA | 0 - 1% | 10 MB |
| BitLocker Management | Component Upgrade | dcconfig.exe | 1.65 MB | 0 - 1% | 1 MB |
| Device Control Management | Device Control Service | uesAgentService.exe | NA | 0 - 0.5% | 1 MB |
| Device Control Management | Device Control Policy Processing | dcconfig.exe | 5 KB | 0 - 1% | 6 MB |
| Device Control Management | Device Audit | uesDevCtrlSummary.exe | NA | 0 - 3% | 6 MB |
| Device Control Management | File Audit Data Populator | uesFaDataPopulator.exe | NA | 0 - 10% | 9 MB |
| Device Control Management | File Shadow | uesFileShadow.exe | NA | 5 - 10% | 12 MB |
| Device Control Management | Component Upgrade | dcconfig.exe | 7.5 MB | 0 - 1% | 1 MB |
| Device Control Management | File Audit | uesFauser.exe | NA | 0 - 1% | 2 MB |
| Vulnerability Management | Vulnerability (Patch)/Misconfiguration Deployment | dcconfig.exe | 12 KB | 5 - 7% | 26 MB |
| Vulnerability Management | Patch/Vulnerability Scan | dcpatchscan.exe | 6 MB (will be downloaded from the server only if the file is changed and new version is downloaded in the DBSync) | 12 - 15% | 70 - 75 MB |
| Data Loss Prevention | Processing DLP Policy | Medlp.exe | NA | <0.5% | 20-22 MB |
| Data Loss Prevention | Classifying Process | UemsProcessMonitor.exe | NA | 0.11 - 0.13% | 23-25 MB |
| Data Loss Prevention | Network Packet Monitor | Netfilter.exe | NA | <0.1% | 6-8 MB |
| Data Loss Prevention | Clipboard Monitor | HostExe | NA | <0.1% | 3-4 MB |
| Data Loss Prevention | Monitoring Browser File upload | DLPNativeHost.exe | NA | <0.1% | 10-11 MB |
| Data Loss Prevention | Component Upgrade | meaaphelper.exe | 14-17 MB | 0 - 1% | 1 MB |
| Malware Protection | EDR Core Ever running service | MEARWService.exe | NA | 0 - 1% | 20 - 150 MB |
| Malware Protection | Behaviour Engine ever running process | MEEDRInferenceEngine.exe | NA | 0 - 1% | 5 - 12 MB |
| Malware Protection | DeepAv Engine ever running process | MEEDRMCEngine.exe | NA | 0 - 1% | 0 - 60 MB |
| Malware Protection | Service Installer | MEARWSetup.exe | NA | 0 - 1% | 0 - 10 MB |
| Malware Protection | Endpoint central server Communicator | EDRDCManager.exe | 0 - 1 MB | 0 - 2% | 0 - 12 MB |
| Malware Protection | Volume shadow copy creator | VssHelper.exe | NA | 0 - 1% | 0 - 10 MB |
| Malware Protection | Component Install/Upgrade | MEAAP.exe, EDRDCManager.exe | 20 MB | 0 - 1% | 0 - 10 MB |
| Malware Protection | User Agent Notifier | EDRUI.exe | NA | 0 - 1% | 0 - 1 MB |

### DEX (Digital Employee Experience) Manager

| Agent Process | Running Application Name | Bandwidth Consumption (Approximately) | CPU Consumption (Approximately) | Memory Consumption (Approximately) |
|---|---|---|---|---|
| DEX core ever running service | ECEAService.exe | NA | 0.2 - 0.7% | 0 - 20 MB |
| Captures events like app crash and app hang (ever running). | ECEAEventTracer.exe | NA | 0.1 - 0.7% | 0 - 10 MB |
| Monitors system CPU and memory consumption (ever running). | ECEAPerfMon.exe | NA | 0.1 - 0.7% | 0 - 20 MB |
| Processes data of all exes (ever running). | ECEADataManager.exe | NA | 0.2 - 0.7% | 0 - 12 MB |
| Scans hardware and event viewer details. | ECEAScanner.exe | NA | <0.2% | 0 - 1 MB |
| Data communication handler | ECEAWebRequestHandler.exe | 0 - 3 MB | <0.2% | 0 - 1 MB |
| Fetch device metrics | ECEATelemetry.exe | NA | <0.5% | 0-25 MB |
| User experience score calculator | ECEAScore.exe | NA | <0.5% | 0-5 MB |
| Replicates DEX meta files on Agent | ECEAReplication.exe | 0-3 MB | <0.2% | 0-1 MB |
| Replicates DEX meta files on Distributed Server | ECDSEAWorker.exe | 0-3 MB | <0.2% | 0-1 MB |
| Workflow Execution | ECWorkflow.exe | NA | <0.5% | 0-5 MB |
| Sensor Execution (Standalone and Workflow ) | ECEASensor.exe | NA | <0.5% | 0-4 MB |
| Engage UI Window | ECEAEngage.exe | NA | <0.2% | 9 MB |

### Remote Control

| # | Compression | Color Quality | Change Frequency | ActiveX Viewer | HTML5 Viewer (Gateway Communication) | HTML5 Viewer (Direct Communication) |
|---|---|---|---|---|---|---|
| 1 | Fast Compression | High | High | 3.4 Mbps | 700 Kbps | 310 Kbps |
| 2 | Fast Compression | High | Low | 6 Kbps | 6 Kbps | 3.3 Kbps |
| 3 | Fast Compression | Medium | High | 700 Kbps | 540 Kbps | 260 Kbps |
| 4 | Fast Compression | Medium | Low | 5.6 Kbps | 5.8 Kbps | 3 Kbps |
| 5 | Best Compression | High | High | 760 Kbps | 560 Kbps | 275 Kbps |
| 6 | Best Compression | High | Low | 5.4 Kbps | 3.6 Kbps | 1.8 Kbps |
| 7 | Best Compression | Medium | High | 460 Kbps | 440 Kbps | 240 Kbps |
| 8 | Best Compression | Medium | Low | 4.4 Kbps | 3 Kbps | 1.5 Kbps |

### Agent OS

| Agent OS | CPU details | CPU consumption (Normal usage) | CPU consumption (Heavy usage) | Memory consumption (Normal usage) | Memory consumption (Heavy usage) |
|---|---|---|---|---|---|
| Windows Server 2016 | 4 core/8 thread, 3.40 GHz | 3% | 13% | 33 KB | 40 KB |
| Windows 8 | 4 core/4 thread, 2.90 GHz | 4% | 18% | 35 KB | 36 KB |
| Windows 10 | 2 core/4 thread, 2.60 GHz | 5% | 19% | 38 KB | 43 KB |

## Mac Agent Footprint

### Ports and Protocols

- Since Endpoint Central is a Client-Server model, agent communicates with the Central Server using the HTTPS protocol through the port 8383.
- Any on-demand task is initiated by the Notification Server. It uses the TCP port 8027 to communicate with the Endpoint Central agent.
- Other than these port Mac Self Service portal uses port 3000 whenever the app is used.

All the below-mentioned data are predicted from a single agent machine. Up to **100 MB (approximately)** of disk space will be consumed by the agent installed drive.

Uploaded files in the configuration/software packages will be downloaded in the agent installed directory only. Hence, space consumption will vary based on the uploaded files. Those downloaded files will be removed when the deployed configuration is executed successfully.

| Agent Process | Running Application Name | Bandwidth Consumption (Approximately) | CPU consumption (Approximately) | Memory (RAM) Consumption (Approximately) |
|---|---|---|---|---|
| At Agent Ideal state | dcagentservice, dcnotifyservice, dcondemand, dcagenttrayicon<br>*(Running separate application for each logged on user) (For Windows and Mac)*<br>*[Above 4 are ever running processes]* | 2 KB | 0 - 2% | 5 - 15 MB |
| Refresh policy (90 mins once - without any deployment) | dcconfig | 10 KB | 0 - 4% | 25 MB |
| Applying configuration (90 mins once) | dcconfig | 15 KB (Will be varied based on configuration. i.e., if there is any files uploaded in the deployed configuration, uploaded file size will be added in the bandwidth consumption) | 0 - 12% | 20 - 50 MB (Will be based on the number of configurations applied at the current refresh policy) |
| Inventory scan (At Scheduled time in server) | dcinventory | 10 KB | 0 - 6% | 10 - 35 MB |
| Patch scan (When applying patch task) | dcpatchscan | 2 MB (This is for initial patch scan). From the next scan, scan will be dine with the local files untile the patch DB sync processed in the server | 0 - 12% | 12 - 22 MB |
| Logon policy (whenever a user logon) | dcconfig, dcuserhandler | 10 KB | 0 - 4% | 20 MB |
| Agent Upgrade (Applying PPM and if agent version changes) | dcconfig, dcmaacupgrader | 30 MB | 0 - 2% | 6 MB |
| MDM Enrollment | MDM Enrollment.app, ProfileInstaller, ProfileAuthPlugin | 10 KB | 0 - 2% | 30 MB |
| Protection | com.manageengine.protectord | 0 | 0 - 2% (may spike to 20% for a small duration during any activity in Agent folder) | 10 MB |
| Message handler (Auto reboot/Reboot/Restart prompt) | ManageEngine UEMS.app | 0 | 0 - 2% | 19 - 22 MB |
| Uninstall | Uninstaller.app, com.ManageEngine.Uninstaller.helper, NativeUIHandler | 10 KB | 0 - 2% | 30 MB |
| Remote Control | ManageEngineRemoteAccess.app | 7 - 16 MB for normal usage<br>24 - 36 MB for heavy usage<br>(May spike to 70 - 100 MB when there is a huge display image change) | 36 - 42% for normal usage<br>46 - 48% for heavy usage (May spike 10 140mb when there is a huge display image change) | 97 - 108 MB for normal usage<br>112 - 128 MB for heavy usage |
| Self Service Portal, When Opened from Tray Icon | Self Service Portal | 1-5mb | 0-10% | 100-150mb |
| Deploying Wallpaper Configuration | Wallpaper | 0 (No Network related consumption will occur) | 0-1% | 10mb |

## For Security Features

| Module Name | Agent Process | Running Application Name | Bandwidth Consumption (Approximately) | CPU Consumption (Approximately) | Memory Consumption (Approximately) |
|---|---|---|---|---|---|
| Application Control | Application Control Driver | com.managee.ninja.apprctl.driver | 0 | 0-2% | 5 - 7 MB |
| Application Control | Application Control Scanner | EC Application Control Helper | 5-7kb | 4-6% | 6-8mb |
| Application Control | Application Control Requests | EC Application Control.app | 0 | 2 - 3% | 15-17MB |
| Application Control | Application Control Notification | EC Application Control Alert.app | 0 | 4-5% | 15-17MB |
| Browser Security Plus | Browser Agent | bsp agent | 26-28 kbps | 0-2% | 5 - 10 MB |
| Browser Security Plus | Browser Native Host Application | bspNativeHost | NA | 0-2% | 5 - 10 MB |
| Browser Security Plus | Browser Component Installer | bspAgentRegister | 3-5kbps | 0-2% | 0-5 MB |
| Device Control | Device Control Service | devicecontrolservice | 20 kbps | 0.5-2% | 15 - 20 MB |
| Device Control | Device Alert Notification | Device Alert Notification.app | 0 | 3-5% | 15 - 20 MB |
| Device Control | Temporary Access Portal | Temporary Access Portal.app | 10 kbps | 0.5-2% | 35-40 MB |
| Device Control | Bluetooth Helper | DCBluetooth Helper | 0 | 0.5-1% | 2 - 5 MB |

## Linux Agent Footprint

### Ports and Protocols

- Since Endpoint Central is a Client-Server model, the agent communicates with the Central Server using the HTTPS protocol through the port 8383.
- Any on-demand task is initiated by the Notification Server. It uses the TCP 8027 port with an additional security layer of TLS to communicate with the Endpoint Central agent.

All the below-mentioned data are predicted from a single agent machine. Up to **1 GB (approximately)** of disk space will be consumed by the agent installed drive.

**Note:** For patching, Redhat and Oracle machines at least 20 GB of space will be required.

Uploaded files in the configuration/software packages will be downloaded in the agent installed directory only. Hence, space consumption will vary based on the uploaded files. Those downloaded files will be removed when the deployed configuration is executed successfully.

Other than **dcservice**, and **dcondemand**, all other processes are short-lived.

| Agent Process | Running Application Name | Bandwidth Consumption (approximately) | CPU Consumption (approximately) | Memory (RAM) Consumption (approximately) |
|---|---|---|---|---|
| At Agent Idle state | dcservice, dcondemand | 1 kbps | 0 - 2 % | 12 MB |
| Refresh policy (90 mins once - without any deployment) | dcconfig | 4 kb | 0 - 2 % | 7 MB |
| Applying configuration (90 mins once) | dcconfig | 5 kb (Will be varied based on configuration. i.e., If there are any files uploaded in the deployed configuration, Uploaded file size will be added in the bandwidth consumption) | 0 - 2 % | 8 - 20 MB (Will be based on the number of configurations applied at the current refresh policy) |
| Inventory scan (At Scheduled time in server) | dcinventory | < 1 mb | 15-30% | 15 MB |
| Patch scan (when applying patch task) | dcpatchscan | 5 mb | 20-30% | 15 MB |
| File scan (When applying file scan task) | dcfilescan | < 1 mb | 20-30% | < 2 MB |
| During Agent Upgrade | dclinuxupgrader | 30 mb | 2-4% | < 2 MB |
| Message boxes | dcmsghandler | < 1 mb | 2-4% | < 2 MB |
| Processing Reboot | dcreboothandler | < 1 mb | 2-4% | < 2 MB |
| Remote Control | dcrdsagent | 65-78 kb/sec - normal<br>422-692 kb/sec - heavy usage (spike to 780 to 990kb/sec if diaply image change is huge) | 14-26% - normal usage<br>55-72% - heavy usage (might spike to 80% if display image changes) | < 2 MB |

**Note:** All the above-mentioned data are stated approximately.