Common Agent Policies

This article contains a breakdown of typical policies and why admins create them.

Typical Agent Policies — Patterns and Purpose

Policies are named configuration profiles that bundle logging, polling, disk thresholds, proxy, and Watcher monitoring paths. The policies in your screenshot represent the most common categories admins create:

1. Debug Logging

Purpose: Temporary troubleshooting policy assigned to agents experiencing issues.

Setting	Typical Value
Log Level	1 (Debug)
All other settings	Same as default or production

When used: Assigned to a specific agent to capture detailed diagnostic information for a support case or bug reproduction. Generates verbose logs without the extreme volume of Trace.

2. Full Logging

Purpose: Maximum verbosity — captures everything including Trace-level events.

Setting	Typical Value
Log Level	0 (Trace)
All other settings	Same as default or production

When used: Escalated troubleshooting when Debug-level logs aren't sufficient. Produces very large log files. Should only be assigned temporarily — log files can consume significant disk space.

3. Reduced Poll & Logging

Purpose: Minimize agent overhead and network traffic in production/steady-state.

Setting	Typical Value
Log Level	3 (Warning) or 4 (Error)
Polling Interval	Higher than default (e.g., 120–300 seconds)

When used: For large fleets of agents where frequent polling and verbose logging create unnecessary load on the console and network. Only logs warnings/errors while checking in less frequently.

4. Watcher Poilicy [sic — typo in the name]

Purpose: Configures File and Folder Inclusions/Exclusions for Activity Watcher monitoring.

Setting	Typical Value
File and Folder Inclusions	Specific monitored paths (e.g., `C:\Shares\Sensitive`, `D:\Finance`)
File and Folder Exclusions	Paths to ignore (e.g., `C:\Windows\Temp`, log directories)
Log Level	Default or Debug

When used: Assigned to agents that are enrolled in Watcher (file/email activity monitoring). Different groups of endpoints may monitor different paths depending on what data they host.

5. Do Not Override

Purpose: A "locked" baseline policy signaling that agents assigned to it should not have their settings changed — essentially a production/steady-state policy.

Setting	Typical Value
All settings	Intentional defaults or customer-approved values

When used: Marks a group of agents as "configured and approved" — a convention to prevent accidental reassignment during troubleshooting. The name is a human signal to other admins, not a technical enforcement.

6. NL-Agent Poll

Purpose: Custom polling interval for a specific agent group (likely named for a location, network segment, or team — "NL" prefix).

Setting	Typical Value
Polling Interval	Custom value (for example, 60s, 90s, 300s)
Other settings	May match defaults

When used: When a subset of agents needs a different check-in frequency — e.g., agents on a slow WAN link polling less often, or agents under active testing polling more frequently.

Common Policy Strategy

Most organizations end up with a pattern like this:

Policy	Log Level	Polling	Watcher Paths	Use Case
Production / Default	2–3	Default (32s)	Standard	Day-to-day operations
Debug/Troubleshooting	1	Default	Standard	Assigned temporarily for support cases
Full Logging	0	Default	Standard	Escalated troubleshooting
Reduced Overhead	3–4	High (120–300s)	Standard	Large fleets, bandwidth-constrained
Watcher-specific	2	Default	Custom paths	Agents monitoring sensitive file shares

The key insight is that policies are operational profiles — admins create them to address specific combinations of logging verbosity, polling frequency, and monitoring scope, then assign them to agents as needed (permanently for steady-state, temporarily for troubleshooting).