Last Connect vs. Last Connected

What

OK, we'll cut right to the chase, the naming of these fields is silly and confusing.  We'll try to untangle that a bit in this document.

When/Why

The two versions of the Last Connected fields can be quite confusing, and they mean two different things.  Generally we will use the fields whenever we are trying to understand the last time a device talked to the FileWave server.

How

The confusion here comes from the fact that the data seems inconsistent.  It is not actually inconsistent, but it is certainly confusing.  We'll use the following image to help explain:

In the above diagram, the "Last Connect" you see highlighted by the red arrows is the last time the device spoke to the server at all.  Devices reach out to the server differently depending on operating system.  The red arrowed fields are NOT included in inventory, and are only meant to show "pings" from a client device.  Basically, this value means that we "heard something" from the device.  On Mac/Windows the client will "tickle" every two minutes and update this value.  No other platforms modify this field, so for iOS, Android and Chrome, the only "Last Connected" time is the field that is in inventory.

For ALL platforms though, the field highlighted by the green arrow is the inventory field that is updated whenever the device sends inventory information to the server.  That is, this date indicates the last time the device sent information about hardware, software, and custom fields.  For macOS and Windows this value will ALWAYS be different from the last tickle time.  And the data in this field is important, because it tells you how old the "data" is about this client.

This field is very useful for troubleshooting (looking for devices that maybe aren't reporting inventory), and also for EXCLUDING data from reports.  For instance, if I want to look for devices that don't have virus definitions updated in the last 3 days, I also want to add a criteria to look for the inventory data to be updated in that same time frame.  This avoids having devices in my report that couldn't possibly have updated definitions, and would just clutter the report unnecessarily.