As a quick test, just try temporarily revoking all your app-run-control whitelists and see if the problem is gone.  If so, re-deploy whatever you have, and find what extra app(s) you had forgotten to whitelist that caused the problem.

As far as I know,  MobiControl does not provide detailed breakdown for data traffic consumed for an application.   In older Android version (e.g. 4.x), there is a log file kept by the Android kernel module with timestamps and other details of different voice/data/SMS traffic,  but such information has to be analysed by third-party utility app.  Even worse, such information is probably not easily accessible in more recent Android versions because  Google impose more restrictions to protect the privacy of device end-user.

As network operators may use different rounding-up mechanism for packetized data in your various device connections,  the traffic reported by Android kernel (and reported to MobiControl) can deviate from that reported by your network operator.  I usually allow 5-10% difference when setting alert thresholds in TEM rules.

Did you  get very big numbers for some applications you cannot explain to your customers?  What kind of apps are they?  If  it is Mobicontrol device agent that generate such traffic,  you might need to check and tune various global and policy-specific settings to reduce unjustified traffic.

Every hour we have around 100 or 200Mo data consumption per device. Same thing during the night when the devices are not used.

The concerned applications are com.android.vending and Removed application 

Thank you

So, it's your Google Play Store app.  

Are you using Android+ or Android Enterprise agent?

The Google Play Store app should be trying to deploy/update app onto your device, but fail for some unknown reason(s), and the process repeat indefinitely.   If this is really the case,  check your device-agent log for any error/warning message, and if possible, get hold of a problematic device and check the notification bar or Google Play app to see what app(s)  is/are being deployed/updated repeatedly. 

Then, you might need to check if the problem is caused by conflict(s) in your management profiles/rules deployed on the device.   

I have no warning/error messages into the logs

No message in the notification bar

All the profiles are correctly installed on the device

Hi Bruno,

Are you using Android+ or Android Enterprise agent?

When I mentioned about conflicting profiles/rules, I meant you might have set options in application-run-control, kiosk mode, feature control, etc. that make your silent app installation/update unsuccessful, resulting in repeated retry and high traffic consumed.

My device is Android+ (C-five Coppernic)

How is it possible to identify the conflicting profile or rule please ?

Please list any deployed profile configurations in application-run-control, kiosk mode and feature control payloads on your problematic device.

Hi Bruno, please check data collection rule, check the interval where the agent collects data in a certain period and push such update to Mobicontrol server

Hello

The Telecom Data Usage Data Collection report may give you a good insight regarding what apps are consuming data.

As Benedict explains, you also need a Telecom Expense Management rule so data is collected periodically.

After revoking all my app-run-control whitelists, the data consumptions are normal.

As we have a lockdown, finally we Don't need a whitelist

Thank you

Hi

Finally the issue is still there.

We have about 25 devices concerned by this issue ( total of devices is around 250 with exactly the same configuration)

For exemple please find below the device Streeteo 00375 where we can see at 06/12/2018 13:00 around 45 Gb consummed by ''Removed Application''

Thank you for your help

Hi Bruno,

Your statement  "As we have a lockdown, finally we Don't need a whitelist"  included in a previous post more than a week ago is not totally true and can be extremely misleading to many who read the post on this forum.  The whitelist implicitly set in lockdown menu policy and those explicitly configured in application-run-control serve different purposes and have slightly different behavior.

Also, as hinted from my previous posts on this discussion topic,  the problem was very likely caused by someone wrongly setting conflicting policies on the devices.  In other words, the 45G traffic and associated cost are not due to bug(s) in MobiControl.   If you don't want the same problem to happen again, administrator should be informed the real cause and trained not to do anything similar again. To make that possible,  please provide more details:

- What was the active MDM api's reported on your problematic devices?

- Is the "Removed Application" a bundled app included in the device firmware out of the box?  As it is an app that is available from Google Play store, would you mind revealing the true identity of this mysterious application?

- Had the "Removed Application"  been included on your whitelist before you stopped using application run-control whitelist?