Hi all, I'm running the latest version 2.5.1 and noticed that after a number of hours, a handful of my agents, mostly Windows machines (but there are a few Linux boxes too) show up as "disconnected" when I run agent_control -l
What is odd is when I log in to look at these boxes, they appear to still be connected as much as I can see in the ossec.log. And the syschecks are still running. If I run agent_control -i ID -e, it shows the most recent syscheck scans (start and end) and they appear to be valid. Again, nothing in the ossec.log on the servers I've checked indicates that the machines are disconnected. CHecking the ossec.log on my central server, I see some "Incorrectly formated message" errors but not for machines that are disconnected. Any ideas on what might be going on here? Has anywhere else seen this kind of behavior? TIA!
