How to Monitor Eventlog in Zabbix Agent 2

[ActiveAgent]

Dear Zabbix community,

I´ve installed zabbix Agent 2 with active checks. I linked the standard Template "Windows by Zabbix agent active" and a new Template for Windows EventLog to the Client.

When I use my Zabbix Agent 1 it's sending me information from my EventLog

but when I start the Agent 2 on the same machine with the same Config, it's not sending anything to that Item.

I´ve configured the Eventlog-Template according to Dimitirs Tutorial (https://www.youtube.com/watch?v=fTgJQ3aFE2U) too:

I've set it up according o Dimiti Lamberts Tutorial (https://www.youtube.com/watch?v=nBw5OD37zb8) - active and passive checks from the normal template "Windows by Zabbix agent active" are working.

I've added the latest templates from the GitHub repo (https://github.com/zabbix/zabbix/tre...r/templates/os) and updated my Server + proxy to the latest stable version 6.0.

What is missing, or what did I do wrong, since EventLog monitoring should work out-of-the-box, according to Dimitris Tutorial?

Thanks in advance!

[Atsushi]

Did you import the template for Zabbix 6.0? The URL you wrote is a master repository, so it may be for Zabbix 6.2 at this time. Did you select release/6.0 from the pull-down menu on the upper left and download it?

[ActiveAgent]

Thanks Atsushi for you're reply. Indeed, I imported version 6.2, you're right. It didn't give me an error for these templates, only the proxmox-template I couldn't import because it had 6.2 as version set in the file.

When I looked closer in the Logfile, I saw that the eventlog-plugin is loaded by default in the agent 2 and when I listened to Dimitri's Tutorial again, he says that all the elements in the "go" Folder in the GitHub source is compiled in the agent2 package and ready to use without further actions.

I got it to work last night by simply trying it again - I deleted the template for my event logs and created it again. Then entries appeared in the latest-data-set.

I think I know what was the error: I thought that the agent collect data from the past, but I know now, that he only collects new items (Items which appears after the agent starts monitoring the logfiles). I simply was too impatient to wait till new events appear in the log and the agent can collect them.
But feel free to add to this, so I can learn more about the system ... and other who experience the same thing can read and learn from it

[ActiveAgent]

Maybe you´ll find something helpful in this post, which also covers your event-ID:

https://github.com/Sean-Bradley/zabbix_windows_pci_dss_template