I'm trying to monitor the Windows event log. I'm using the eventlog key [Security,,, .4729,,]. I don't know why, but when I use the Event ID 4729 (that is generated when you remove a user from a security group), the zabbix does not collect the information. If I change the event id to someone else, the zabbix collects data normally. If I leave only eventlog [Security], zabbix collects everything except the event id 4729. I'm logged on the domain controller and I can see the events normally 4729.
Regards,
Fabio Corsino
Regards,
Fabio Corsino