How does Windows eventlog monitoring work?

[gospodin.horoshiy]

all logs seem to be fine now, but i'm having this issue: My zabbix[queue] is always 75-80! And if I go to Administration - Queue - its EMPTY. Where should I look to solve this?

[NOB]

Norbert, and how agent does decide whether it could update lastlog or not, I didn't get it sorry)

OK, the zabbix_agent tries to write the current (last) position in the DB of the ZABBIX-Server. If it can't do it, I don't know
what the agent does, but the entry won't be updated. That's for sure.

Because the agent - once stopped and restarted - has no knowledge where the lastlog
position was and there was trouble updating it, it reads the lastlog position from the
servers DB. This can, e.g. still point to the very beginning and the, of course, it
starts reading from the beginning - or whatever was last updated in the DB, again.

If the problem updating the DB persists, this will happen again and again.

That's why the eventlog might be read again and again.

Regards

Norbert.

[gospodin.horoshiy]

Got it, Thanks!