format update to match ossec agent