How to detect "bad" agents?

I have 100+ consul agents and someone of them send /v1/catalog/deregister API
requests and deregister service running on another agent. How i can to find them? I know just one way - parse all agent log to graylog or another log system, maybe i can detect them some easyer?