Asset (device) lifecycle states
Asset states
An asset can be in one of the following states:
- Active: The device is actively reporting in. For devices running the agent directly, the last heartbeat (Last activity) is within 24 hours. For devices managed through a collector (or child devices), the last connection is within 36 hours.
- Inactive: The device has not reported in within the active window (24 hours for agent devices, 36 hours for collector-managed devices) but has not yet reached the auto-archival period (default 7 days).
- Pending Archival: The device belongs to an asset class configured for "Manual Archival Only" and has been inactive past the auto-archival period (default 7 days). It is flagged for archival and waits for manual confirmation before being archived (see the archival policy). Until it is confirmed, the device returns to Active if it checks back in.
- Archived (automatically archived): The device has been archived because of extended inactivity. This happens automatically (default 7 days) for asset classes configured for automatic archival. Classes set to "Manual Archival Only" become Pending Archival instead and are archived only after confirmation. The UI shows an automatically archived device as Archived, the same as a manually archived device. See the archival policy for more details.
- Stale: Not a state shown as its own badge. "Stale" describes an Inactive device that has stopped checking in but is still being seen by other devices on the network. Nanitor shows an Inactive asset discovery warning on such a device, because this can indicate a problem with the agent or collector.
- Archived (manually archived): The device has been manually archived in Nanitor (via the Archive asset action). This means it is no longer in use and is hidden from reports. Internally this is still referred to as "decommissioned" in places (for example API fields and some support tooling), but the UI badge and all user-facing text say Archived. See Archived devices that reappear below for what happens if an archived device checks in, is seen on the network again, or is reinstalled.
-
Rogue: The device has been identified on the network (by MAC address and subnet IP) but is not under monitoring in Nanitor, and is not archived. Rogue devices are only discovered if the Network Discovery feature is enabled. From Rogue, a device can transition to:
- Active: If the device is signed up to Nanitor, it is un-rogued and becomes Active.
- Archived: If the device is manually archived through the UI, it becomes Archived.
- Archived (automatically archived): If the device is not detected again through network discovery for 7 days, it is automatically archived and shown as Archived.
An already Archived device never becomes Rogue, because Archived takes priority over every other state. See Archived devices that reappear below for what happens if an archived device is later seen on the network.
-
Undiscovered: Not a state shown as its own badge. "Undiscovered" describes a device Nanitor has been told about (for example, by uploading a CSV file) that has not yet been seen on the network. For the Asset state badge, such a device is classified under the same state as other unauthorized-but-permitted devices (badge: Authorized). Separately, "Undiscovered" also appears as its own filter option ("Undiscovered assets") on the Asset Inventory page, and as its own column in the Organization compliance report. These are different UI surfaces from the Asset state badge, not the same concept restated.
Archived assets, whether archived automatically or manually, are not shown in the asset list by default. To list them, select Archived in the Asset state filter.
Archived devices that reappear
An Archived device can still send Nanitor a heartbeat, be seen on the network, or have its agent reinstalled after archival. What happens in each case is different, and only one of the three actually keeps the device Archived by default:
| Trigger | Does the device leave the Archived badge? | What you'll see |
|---|---|---|
| Agent on the archived device sends a heartbeat | Yes, on the very first heartbeat. This happens regardless of any setting. | The device's Asset state badge changes away from Archived (typically to Active or Inactive). A "Manually archived asset check-in" warning badge (support/engineering sometimes call this a "ghost check-in") is also shown: "This asset was manually archived but is still actively checking into Nanitor. If the device is still in use, you can restore it. Otherwise, make sure that the Nanitor agent is removed from the machine." |
| Device is discovered on the network (Network Discovery enabled), without an agent heartbeat | Depends on the organization setting "Always flag archived assets discovered on the network" (Organization Management → Asset discovery → Network discovery). This setting is off by default. | With the setting off (default), the device stays Archived and no warning is shown. With the setting on, a device with prior agent/collector history typically also leaves the Archived badge, while a "Manually archived asset on network" warning badge is shown: "This asset has been manually archived, but has been detected by other assets on the network after archival. This may indicate a decommissioned asset is still unexpectedly present and connected." |
| Agent is reinstalled on the device (a fresh signup, not just a check-in) | Yes, unconditionally. | The device becomes Active again, because a fresh signup is treated as a legitimate return to service. No setting affects this. |
Both warning badges can appear on a non-Archived device
Because a heartbeat or network detection can move the device off the Archived badge while still leaving it internally flagged as manually archived, you may see one of the warning badges above on a device whose Asset state is no longer Archived. If you don't want to be alerted to previously-archived devices reappearing, use the Restore action instead of leaving a device in this state.
Asset dates
Assets report into Nanitor in various ways, either by sending a heartbeat, checking in for reporting on changes, or when the asset has been seen by other devices if network discovery is turned on. You can view these dates when hovering over the information icon next to the asset state. This helps to understand and troubleshoot assets that are in a different state than expected.
The dates shown in the asset detail page are:
- Last activity is the date/time when the last heartbeat was received
- Last seen is the date/time when another asset discovered this asset on the network. This is visible only when the network discovery feature is enabled.
- Last check-in is the date/time of the last check-in for the benchmark (shown in the benchmark table below).