After seeing several users write to describe repeated "agent disconnected" messages from Windows agents, I think I saw Daniel write that this issue was to be resolved in v1.5.
I have upgraded server and agents and continue to receive the following from my one Windows agent (approx. every 30 minutes but there's no hard schedule): OSSEC HIDS Notification. 2008 May 05 08:16:46 Received From: xxxxxx->ossec-monitord Rule: 504 fired (level 3) -> "Ossec agent disconnected." Portion of the log(s): ossec: Agent disconnected: 'siprp1-10.x.xxx.x'. --END OF NOTIFICATION I tried uninstalling and reinstalling the agent and generating a fresh key without success. Suggestions? ~~~~~~~~~~~~~~~~~~~~~~~~~~ Mark Trifiro
