There is an extreme difference in the number of CP connections displayed in AWI versus what is shown in the Service Manager Dialog
Release : 12.3.6
Component : AUTOMATION ENGINE
By default, there will always be a difference between what is shown in AWI versus what is shown in the Service Manager Dialog. This is because AWI shows real connections such as an agent, but Service Manager Dialog shows socket connections as well.
Applications such as virus or port scanners can create these socket connections accounting for the large number of connections seen in the Service Manager Dialog.
In this case, the customer identified an application on their end which was not closing out the connections properly.
The CP logs will show all of these connections such as:
U00003406 Client connection '5299(447)' from '<IP Address:PORT' has logged on to the Server.
The IP address can be traced to applications that may be creating these connections, and there may be socket errors shown in the CP logs as well like:
U00003413 Socket call 'send(0)' returned error code '32'.
The differences between the AWI display and the Service Manager Dialog are as designed, but such extreme differences need to be reviewed with the Network team to determine there is an application that is not properly closing the connection or even if there is virus or port scanning being done.
If there are virus scans, it is always recommended to create an exception for the Automic folder structure so that the needed binaries and folders/files are not locked.