EventLog Monitoring not working after Mogration from 4.2 to 5.0

[rolfrolf]

Hello,

i have upgraded my zabbix Server and proxies to the version 5.0.
on the old agent with the 4.2 version the eventlog monitoring works fine.
Now when i install new agents with the version 5.0 and assign the eventlog template to them it doesnt work. i dont get any data out of the agent even if i set the item to send me all data out of the eventlog.
Also there is no error in the log files or in the zabbix frontend.

i would be happy if someone could help

[gofree]

Yeah dont forget to add the time of zabbix cache config update. Basically first you wait till the agent/proxy knows about new item they have ( default ConfigFrequency 1h )

https://www.zabbix.com/documentation/5.0/manual/appendix/config/zabbix_proxy

In some crazy scenario you might need another hour to agent start sending data - your interval. Just imagine how much data the agent needs to read through once in an hour. Maybe some shorter interval could be better, just in case.

Also try to increase debug level on agent, proxy - this might show you some more insight. Assuming other item ( active ) from that particular agent are being sent.

[rolfrolf]

Yes for test purposes i did it with 1second.
and with the config update, I restarted the Proxy and Agent service

[gofree]

Try to increase log level of the agent and test the item(s) manually

https://www.zabbix.com/documentation/5.0/manpages/zabbix_agentd

zabbix_agentd -t item

[rolfrolf]

this is what i get from the logs:


6140:20210429:161342.209 JSON back [{"response":"success","info":"processed: 0; failed: 50; total: 50; seconds spent: 0.002615"}]
6140:20210429:161342.212 In check_response() response:'{"response":"success","info":"processed: 0; failed: 50; total: 50; seconds spent: 0.002615"}'
6140:20210429:161342.214 info from server: 'processed: 0; failed: 50; total: 50; seconds spent: 0.002615'
6140:20210429:161342.216 End of check_response():SUCCEED
6140:20210429:161342.218 OK
6140:20210429:161342.220 End of send_buffer():SUCCEED
6140:20210429:161342.223 End of process_active_checks()
6140:20210429:161342.225 In get_min_nextcheck()
6140:20210429:161342.228 End of get_min_nextcheck():1619705623
6140:20210429:161342.230 In send_buffer() host:'192.168.50.111' port:10051 entries:0/100
6140:20210429:161342.232 End of send_buffer():SUCCEED
4164:20210429:161342.973 In collect_perfstat()
4164:20210429:161342.982 End of collect_perfstat()
6140:20210429:161343.235 In send_buffer() host:'192.168.50.111' port:10051 entries:0/100
6140:20210429:161343.237 End of send_buffer():SUCCEED
6140:20210429:161343.240 In process_active_checks() server:'192.168.50.111' port:10051
6140:20210429:161343.242 In initialize_eventlog6() source:'System' previous lastlogsize:400
6140:20210429:161343.245 In zbx_open_eventlog6()
6140:20210429:161343.249 End of zbx_open_eventlog6():SUCCEED FirstID:1 LastID:14718 numIDs:14717
6140:20210429:161343.251 In zbx_get_handle_eventlog6(), previous lastlogsize:400
6140:20210429:161343.254 End of zbx_get_handle_eventlog6():SUCCEED
6140:20210429:161343.257 End of initialize_eventlog6():SUCCEED
6140:20210429:161343.259 In process_eventslog6() source: 'System' previous lastlogsize: 400, FirstID: 1, LastID: 14718
6140:20210429:161343.269 In zbx_parse_eventlog_message6() EventRecordID:401
6140:20210429:161343.271 In expand_message6()
6140:20210429:161343.275 End of expand_message6():The Touch Keyboard and Handwriting Panel Service service entered the running state.
6140:20210429:161343.277 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.280 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:401 value:'The Touch Keyboard and Handwriting Panel Service service entered the running state.'
6140:20210429:161343.282 buffer: new element 0
6140:20210429:161343.284 End of process_value():SUCCEED
6140:20210429:161343.286 In zbx_parse_eventlog_message6() EventRecordID:402
6140:20210429:161343.289 In expand_message6()
6140:20210429:161343.293 End of expand_message6():The AppX Deployment Service (AppXSVC) service entered the running state.
6140:20210429:161343.295 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.298 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:402 value:'The AppX Deployment Service (AppXSVC) service entered the running state.'
6140:20210429:161343.301 buffer: new element 1
6140:20210429:161343.303 End of process_value():SUCCEED
6140:20210429:161343.305 In zbx_parse_eventlog_message6() EventRecordID:403
6140:20210429:161343.308 In expand_message6()
6140:20210429:161343.312 End of expand_message6():The Device Management Enrollment Service service entered the stopped state.
6140:20210429:161343.314 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.317 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:403 value:'The Device Management Enrollment Service service entered the stopped state.'
6140:20210429:161343.320 buffer: new element 2
6140:20210429:161343.322 End of process_value():SUCCEED
6140:20210429:161343.324 In zbx_parse_eventlog_message6() EventRecordID:404
6140:20210429:161343.327 In expand_message6()
6140:20210429:161343.333 End of expand_message6():This event triggers the TBS device identifier generation.
6140:20210429:161343.335 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.337 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:404 value:'This event triggers the TBS device identifier generation.'
6140:20210429:161343.340 buffer: new element 3
6140:20210429:161343.342 End of process_value():SUCCEED
6140:20210429:161343.344 In zbx_parse_eventlog_message6() EventRecordID:405
6140:20210429:161343.347 In expand_message6()
6140:20210429:161343.350 End of expand_message6():The TBS device identifier has been generated.
6140:20210429:161343.353 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.355 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:405 value:'The TBS device identifier has been generated.'
6140:20210429:161343.358 buffer: new element 4
6140:20210429:161343.361 End of process_value():SUCCEED
6140:20210429:161343.363 In zbx_parse_eventlog_message6() EventRecordID:406
6140:20210429:161343.365 In expand_message6()
6140:20210429:161343.370 End of expand_message6():The access history in hive \??\C:\Users\Administrator\AppData\Local\Packages\ Microsoft.Windows.ShellExperienceHost_cw5n1h2txyew y\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
6140:20210429:161343.372 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.374 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:406 value:'The access history in hive \??\C:\Users\Administrator\AppData\Local\Packages\ Microsoft.Windows.ShellExperienceHost_cw5n1h2txyew y\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.'
6140:20210429:161343.377 buffer: new element 5
6140:20210429:161343.379 End of process_value():SUCCEED
6140:20210429:161343.382 In zbx_parse_eventlog_message6() EventRecordID:407
6140:20210429:161343.384 In expand_message6()
6140:20210429:161343.388 End of expand_message6():The access history in hive \??\C:\Users\Administrator\AppData\Local\Packages\ Microsoft.Windows.Cortana_cw5n1h2txyewy\Settings\s ettings.dat was cleared updating 3 keys and creating 1 modified pages.
6140:20210429:161343.391 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.393 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:407 value:'The access history in hive \??\C:\Users\Administrator\AppData\Local\Packages\ Microsoft.Windows.Cortana_cw5n1h2txyewy\Settings\s ettings.dat was cleared updating 3 keys and creating 1 modified pages.'
6140:20210429:161343.396 buffer: new element 6
6140:20210429:161343.398 End of process_value():SUCCEED
6140:20210429:161343.400 In zbx_parse_eventlog_message6() EventRecordID:408
6140:20210429:161343.403 In expand_message6()
6140:20210429:161343.407 End of expand_message6():The access history in hive \??\C:\Users\Administrator\AppData\Local\Packages\ Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\ settings.dat was cleared updating 3 keys and creating 1 modified pages.
6140:20210429:161343.409 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.412 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:408 value:'The access history in hive \??\C:\Users\Administrator\AppData\Local\Packages\ Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\ settings.dat was cleared updating 3 keys and creating 1 modified pages.'
6140:20210429:161343.414 buffer: new element 7
6140:20210429:161343.416 End of process_value():SUCCEED
6140:20210429:161343.418 In zbx_parse_eventlog_message6() EventRecordID:409
6140:20210429:161343.421 In expand_message6()
6140:20210429:161343.425 End of expand_message6():The access history in hive \??\C:\Users\Administrator\AppData\Local\Packages\ Microsoft.Windows.CloudExperienceHost_cw5n1h2txyew y\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
6140:20210429:161343.428 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.430 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:409 value:'The access history in hive \??\C:\Users\Administrator\AppData\Local\Packages\ Microsoft.Windows.CloudExperienceHost_cw5n1h2txyew y\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.'
6140:20210429:161343.433 buffer: new element 8
6140:20210429:161343.435 End of process_value():SUCCEED
6140:20210429:161343.437 In zbx_parse_eventlog_message6() EventRecordID:410
6140:20210429:161343.440 In expand_message6()
6140:20210429:161343.444 End of expand_message6():The access history in hive \??\C:\Users\Administrator\AppData\Local\Packages\ windows.immersivecontrolpanel_cw5n1h2txyewy\Settin gs\settings.dat was cleared updating 3 keys and creating 1 modified pages.
6140:20210429:161343.446 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.449 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:410 value:'The access history in hive \??\C:\Users\Administrator\AppData\Local\Packages\ windows.immersivecontrolpanel_cw5n1h2txyewy\Settin gs\settings.dat was cleared updating 3 keys and creating 1 modified pages.'
6140:20210429:161343.451 buffer: new element 9
6140:20210429:161343.454 End of process_value():SUCCEED
6140:20210429:161343.457 In zbx_parse_eventlog_message6() EventRecordID:411
6140:20210429:161343.459 In expand_message6()
6140:20210429:161343.463 End of expand_message6():The Network Setup Service service entered the running state.
6140:20210429:161343.466 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.468 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:411 value:'The Network Setup Service service entered the running state.'
6140:20210429:161343.470 buffer: new element 10
6140:20210429:161343.473 End of process_value():SUCCEED
6140:20210429:161343.475 In zbx_parse_eventlog_message6() EventRecordID:412
6140:20210429:161343.477 In expand_message6()
6140:20210429:161343.481 End of expand_message6():The Network Connections service entered the running state.
6140:20210429:161343.484 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.486 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:412 value:'The Network Connections service entered the running state.'
6140:20210429:161343.489 buffer: new element 11
6140:20210429:161343.491 End of process_value():SUCCEED
6140:20210429:161343.493 In zbx_parse_eventlog_message6() EventRecordID:413
6140:20210429:161343.495 In expand_message6()
6140:20210429:161343.499 End of expand_message6():The Software Protection service entered the running state.
6140:20210429:161343.502 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.504 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:413 value:'The Software Protection service entered the running state.'
6140:20210429:161343.506 buffer: new element 12
6140:20210429:161343.509 End of process_value():SUCCEED
6140:20210429:161343.511 In zbx_parse_eventlog_message6() EventRecordID:414
6140:20210429:161343.513 In expand_message6()
6140:20210429:161343.518 End of expand_message6():The Windows Update Medic Service service entered the stopped state.
6140:20210429:161343.520 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.523 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:414 value:'The Windows Update Medic Service service entered the stopped state.'
6140:20210429:161343.525 buffer: new element 13
6140:20210429:161343.527 End of process_value():SUCCEED
6140:20210429:161343.530 In zbx_parse_eventlog_message6() EventRecordID:415
6140:20210429:161343.532 In expand_message6()
6140:20210429:161343.536 End of expand_message6():The AVCTP service service entered the running state.
6140:20210429:161343.539 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.541 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:415 value:'The AVCTP service service entered the running state.'
6140:20210429:161343.543 buffer: new element 14
6140:20210429:161343.546 End of process_value():SUCCEED
6140:20210429:161343.549 In zbx_parse_eventlog_message6() EventRecordID:416
6140:20210429:161343.551 In expand_message6()
6140:20210429:161343.555 End of expand_message6():The Windows Biometric Service service entered the running state.
6140:20210429:161343.557 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.559 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:416 value:'The Windows Biometric Service service entered the running state.'
6140:20210429:161343.562 buffer: new element 15
6140:20210429:161343.564 End of process_value():SUCCEED
6140:20210429:161343.566 In zbx_parse_eventlog_message6() EventRecordID:417
6140:20210429:161343.568 In expand_message6()
6140:20210429:161343.572 End of expand_message6():The Windows Update Medic Service service entered the running state.
6140:20210429:161343.575 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.577 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:417 value:'The Windows Update Medic Service service entered the running state.'
6140:20210429:161343.580 buffer: new element 16
6140:20210429:161343.582 End of process_value():SUCCEED
6140:20210429:161343.584 In zbx_parse_eventlog_message6() EventRecordID:418
6140:20210429:161343.587 In expand_message6()
6140:20210429:161343.591 End of expand_message6():The Windows Insider Service service entered the running state.
6140:20210429:161343.593 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.595 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:418 value:'The Windows Insider Service service entered the running state.'
6140:20210429:161343.598 buffer: new element 17
6140:20210429:161343.600 End of process_value():SUCCEED
6140:20210429:161343.602 In zbx_parse_eventlog_message6() EventRecordID:419
6140:20210429:161343.605 In expand_message6()
6140:20210429:161343.609 End of expand_message6():The Software Protection service entered the running state.
6140:20210429:161343.611 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.613 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:419 value:'The Software Protection service entered the running state.'
6140:20210429:161343.616 buffer: new element 18
6140:20210429:161343.618 End of process_value():SUCCEED
6140:20210429:161343.620 In zbx_parse_eventlog_message6() EventRecordID:420
6140:20210429:161343.623 In expand_message6()
6140:20210429:161343.631 End of expand_message6()null)
6140:20210429:161343.633 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161343.636 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:420 value:'The description for Event ID:32 in Source:'i40ei65' cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer. If the event originated on another computer, the display information had to be saved with the event. The following information was included with the event: ; Intel(R) Ethernet Connection X722 for 10GBASE-T'
6140:20210429:161343.638 buffer: new element 19
6140:20210429:161343.641 End of process_value():SUCCEED
6140:20210429:161343.644 End of process_eventslog6():SUCCEED
6140:20210429:161343.646 In finalize_eventlog6()
6140:20210429:161343.649 End of finalize_eventlog6():SUCCEED
6140:20210429:161343.652 In need_meta_update() key:eventlog[System,,,,,,]
6140:20210429:161343.654 End of need_meta_update():FAIL
6140:20210429:161343.657 In send_buffer() host:'192.168.50.111' port:10051 entries:20/100
6140:20210429:161343.659 send_buffer() now:1619705623 lastsent:1619705622 now-lastsent:1 BufferSend:5; will not send now
6140:20210429:161343.661 End of send_buffer():SUCCEED
6140:20210429:161343.664 End of process_active_checks()
6140:20210429:161343.666 In get_min_nextcheck()
6140:20210429:161343.668 End of get_min_nextcheck():1619705624
4164:20210429:161343.986 In collect_perfstat()
4164:20210429:161343.995 End of collect_perfstat()
6140:20210429:161344.673 In send_buffer() host:'192.168.50.111' port:10051 entries:20/100
6140:20210429:161344.675 send_buffer() now:1619705624 lastsent:1619705622 now-lastsent:2 BufferSend:5; will not send now
6140:20210429:161344.678 End of send_buffer():SUCCEED
6140:20210429:161344.680 In process_active_checks() server:'192.168.50.111' port:10051
6140:20210429:161344.682 In initialize_eventlog6() source:'System' previous lastlogsize:420
6140:20210429:161344.685 In zbx_open_eventlog6()
6140:20210429:161344.690 End of zbx_open_eventlog6():SUCCEED FirstID:1 LastID:14718 numIDs:14717
6140:20210429:161344.692 In zbx_get_handle_eventlog6(), previous lastlogsize:420
6140:20210429:161344.695 End of zbx_get_handle_eventlog6():SUCCEED
6140:20210429:161344.698 End of initialize_eventlog6():SUCCEED
6140:20210429:161344.701 In process_eventslog6() source: 'System' previous lastlogsize: 420, FirstID: 1, LastID: 14718
6140:20210429:161344.711 In zbx_parse_eventlog_message6() EventRecordID:421
6140:20210429:161344.713 In expand_message6()
6140:20210429:161344.718 End of expand_message6():NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on 'time.windows.com,0x8'. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9)
6140:20210429:161344.721 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161344.723 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:421 value:'NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on 'time.windows.com,0x8'. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9)'
6140:20210429:161344.725 buffer: new element 20
6140:20210429:161344.728 End of process_value():SUCCEED
6140:20210429:161344.730 In zbx_parse_eventlog_message6() EventRecordID:422
6140:20210429:161344.732 In expand_message6()
6140:20210429:161344.737 End of expand_message6():The TCP/IP NetBIOS Helper service entered the running state.
6140:20210429:161344.739 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161344.742 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:422 value:'The TCP/IP NetBIOS Helper service entered the running state.'
6140:20210429:161344.744 buffer: new element 21
6140:20210429:161344.747 End of process_value():SUCCEED
6140:20210429:161344.749 In zbx_parse_eventlog_message6() EventRecordID:423
6140:20210429:161344.751 In expand_message6()
6140:20210429:161344.755 End of expand_message6():NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on 'time.windows.com,0x8'. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9)
6140:20210429:161344.758 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161344.760 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:423 value:'NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on 'time.windows.com,0x8'. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9)'
6140:20210429:161344.762 buffer: new element 22
6140:20210429:161344.764 End of process_value():SUCCEED
6140:20210429:161344.767 In zbx_parse_eventlog_message6() EventRecordID:424
6140:20210429:161344.770 In expand_message6()
6140:20210429:161344.774 End of expand_message6():The time provider NtpClient is currently receiving valid time data from time.windows.com,0x8 (ntp.m|0x8|0.0.0.0:123->51.105.208.173:123).
6140:20210429:161344.776 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161344.779 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:424 value:'The time provider NtpClient is currently receiving valid time data from time.windows.com,0x8 (ntp.m|0x8|0.0.0.0:123->51.105.208.173:123).'
6140:20210429:161344.781 buffer: new element 23
6140:20210429:161344.783 End of process_value():SUCCEED
6140:20210429:161344.786 In zbx_parse_eventlog_message6() EventRecordID:425
6140:20210429:161344.788 In expand_message6()
6140:20210429:161344.792 End of expand_message6():The Application Information service entered the running state.
6140:20210429:161344.795 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161344.797 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:425 value:'The Application Information service entered the running state.'
6140:20210429:161344.800 buffer: new element 24
6140:20210429:161344.802 End of process_value():SUCCEED
6140:20210429:161344.804 In zbx_parse_eventlog_message6() EventRecordID:426
6140:20210429:161344.807 In expand_message6()
6140:20210429:161344.811 End of expand_message6():The Function Discovery Provider Host service entered the running state.
6140:20210429:161344.813 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161344.815 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:426 value:'The Function Discovery Provider Host service entered the running state.'
6140:20210429:161344.818 buffer: new element 25
6140:20210429:161344.820 End of process_value():SUCCEED
6140:20210429:161344.822 In zbx_parse_eventlog_message6() EventRecordID:427
6140:20210429:161344.825 In expand_message6()
6140:20210429:161344.829 End of expand_message6():The Function Discovery Resource Publication service entered the running state.
6140:20210429:161344.832 End of zbx_parse_eventlog_message6():SUCCEED
6140:20210429:161344.834 In process_value() key:'101017_HYPERV2019:eventlog[System,,,,,,]' lastlogsize:427 value:'The Function Discovery Resource Publication service entered the running state.'
6140:20210429:161344.836 buffer: new element 26
6140:20210429:161344.839 End of process_value():SUCCEED
6140:20210429:161344.841 In zbx_parse_eventlog_message6() EventRecordID:428
6140:20210429:161344.843 In expand_message6()
6140:20210429:161344.848 End of expand_message6():The system time has changed to 2021-04-15T11:59:39.486681300Z from 2021-04-15T20:59:40.458383100Z.

[gofree]

Hi
to me it seems that the item eventlog[System,,,,,,] works fine on the agent level

if other active items on the agent are working ( ? ) Id go to zabbix-proxy log if you see this values in there too , after check zabbix-server log - the data should be visible all the way ( with increased log level ) on all componenets

if they're not ( other active items ) double check the hostname in config file and zabbix gui ( anyway I guess you did that already )

[cyber]

Check interval 3600s ...
You did wait for one hour, I hope?
Just checking......