Reconnect time does not work when system time changed

[Rebits]

Wazuh version	Component	Install type	Install method	Platform
4.3.0	Logcollector	Manager/Agent	Packages	Windows

Reconnect time option does not work correctly when system time changed. If Windows event log service is down and Wazuh is monitoring a channel with a specified reconnect_time, this will not be reconnected if system time changed making Wazuh always ignore that channel

How to replicate:

• Set the following configuration:

  <localfile>
    <location>System</location>
    <log_format>eventchannel</log_format>
    <reconnect_time>1d</reconnect_time>
  </localfile>

• Restart wazuh agent
• Disable Windows event log service:

sc config eventlog start= disabled
net stop eventlog /y

• Enable again Windows event log service:

sc config eventlog start= auto
net start eventlog /y

• Check that Wazuh does not reconnect to the event log specified with reconnect_time

Video

logcollector_reconnect_age_bug.mp4