Every device has a connection state that lists, boards, rules and alarms read: is it online, when was it last heard from, has it gone quiet. Hermetry derives this from what the device does (connects, disconnects, messages) under the online rule of the device’s profile. This page explains the rules, the timestamps, the device’s Log tab and the webhooks.
The online rule
The rule is set on the profile’s Online status tab and never derived from the transport. See Device profiles.
| Rule | Online | Offline | Fits |
|---|---|---|---|
| Live connection | When the device connects over MQTT. | When its MQTT session ends (disconnect, keepalive timeout, takeover without a new session, refusal). | Devices that keep MQTT open. |
| Recent message | When the device connects or sends anything. | When nothing arrived for Expected interval × Factor (for example 3,600 s × 3 = 3 hours). A disconnect alone does not make it offline while its last message is still recent. | Devices that report and disconnect, HTTP devices, LoRaWAN sensors. |
| Last seen only | Never shown as online or offline. | — | Polled devices, devices whose rhythm you do not know. |
Details:
- An HTTP request is activity, not a connection. On a Live connection profile an HTTP device is never online.
- Events that arrive out of order never move the state backwards: an old connect never makes a device online after a newer disconnect.
- A minute-by-minute check turns devices offline when their window ended or their session lease expired, and applies a changed online rule.
- Gateway children follow their gateway’s
v1/gw/connectandv1/gw/disconnectmessages, and go offline when the gateway does.
What the lists show
| Shown | Meaning |
|---|---|
| Online | Under the profile’s rule, the device is online now. |
| Offline | It was online and is not now. The quick view adds Last disconnect: reason. |
| Last seen time | The profile uses Last seen only. |
| Never connected | Nothing has been heard from the device yet. |
| Stale: no data for time | On a device table card with Stale after (seconds) set: online, but no data for longer than that. |
The device’s Overview shows Last activity, Last connected and Last disconnected. IP address is the address of the newest connect; for a device that never connects (HTTP, polled) it is the address of its newest activity.
Inactivity: online but quiet
A device can hold its connection and still send nothing. The profile’s Inactivity timeout (seconds) (600 by default, 10 to 604,800) marks a device as inactive when it sent nothing that long. Inactive is not offline.
Use it in the Rules card trigger A device connects or disconnects > goes quiet. Alarms for a device that stops reporting are set with a Device offline rule in the profile’s alarm rules, which has its own time (Open after (seconds offline)). See Offline alarms.
The Log tab
The device’s Log tab shows its connection history and the changes made to it in one timeline, newest first. Show filters All, Connections or Changes; Load more goes further back.
Connection events
| Event | Detail |
|---|---|
| Connected | via the transport (for example mqtts), from the client’s address |
| Disconnected | Reason: reason |
| Taken over by a new session | A second connection of the same device took over. |
| Switched to last seen only | The profile’s rule changed to Last seen only. |
Disconnect reasons: client_disconnect, keepalive_timeout, takeover, auth_revoked, rate_limit, server_shutdown, uplink_window_expired (the Recent message window ended) and online_rule_changed. A refused login (CONNACK 5) is also logged with its reason, which is never sent to the device.
Changes are the audited changes: Device created, Device edited (with the changed fields), Device activated, Device quarantined, Device disabled, Credential replaced, Credential rotated, Credential revoked, Attributes saved, Attributes deleted, commands sent, cancelled, refused and finished, and alarms acknowledged and cleared, each by a person or by the system.
Connection history is kept for 30 days. Devices on Last seen only write no connect and disconnect rows.
Webhooks
Two webhook events tell other systems about connection changes:
| Event | Sent when |
|---|---|
device.connected | The device came online and stayed online for the hold time. |
device.disconnected | The device went offline and stayed offline for the hold time. |
{ "deviceId": "…", "name": "router-17", "profileId": "…", "transport": "mqtts", "connectedAt": "2026-11-03T10:00:00.000Z", "remoteIpPrefix": "203.0.113.0/24" }{ "deviceId": "…", "name": "router-17", "profileId": "…", "reason": "timeout", "disconnectedAt": "2026-11-03T12:00:00.000Z", "lastSeenAt": "2026-11-03T11:59:40.000Z", "onlineSeconds": 7200 }Two settings in Devices > ⋯ > Settings (group Webhooks) control them:
| Setting | Default | Range |
|---|---|---|
| Connection webhooks: hold time (seconds) | 30 | 5 to 3,600. A flapping device sends nothing. |
| Device webhooks per workspace and minute | 600 | 1 to 100,000. The rest of the minute is dropped and your administrators are told once. The device lifecycle webhooks have their own counter with the same limit. |
The address in device.connected is only a network prefix. Each event carries an idempotency key, so your receiver can ignore repeats. See Webhooks.
Counting devices
Dashboards can show Devices, Devices online, Devices offline and Devices never connected as counters, and the device table card shows the live connection state per row. See Tables and lists.
API
| Call | Returns |
|---|---|
GET /tenant/{tenantId}/api/iot/devices/{deviceId}/connections?page=1&pageSize=50 | The connection log, newest first (up to 100 per page). |
GET …/devices/{deviceId}/log?source=connection | The log of the Log tab; source is connection or audit, at most 1,000 entries deep. |
GET …/devices/{deviceId}/connection | Where the device connects: broker, HTTPS base, topics and keys. Nothing secret. |
Troubleshooting
| Symptom | Cause |
|---|---|
| An HTTP device is never online | Its profile uses Live connection. Use Recent message. |
| A device flips between online and offline | Two devices share one credential (look for Taken over by a new session), or the keepalive is too short for the network. |
| Offline long after it stopped | Expected interval × Factor is long. Shorten it, or add an offline alarm with its own time. |
| Online but no values | The device sends nothing, or its data is dropped (quarantined device, rate limit, bad payload). See Data does not arrive. |