I tend to think that the Windows Agent is the culprit. Can the agent be temporarily run in debug mode, so it logs locally the events that it forwards to the server?
-- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
