One Win server does not collect any Windows Event ID from Event Viewer

[mzeman81]

Hi,

please can somebody help me with my issue, that only one server does not collect Windows Event ID from Event Viewer even
the Event Viewer shows the Event ID (4624) which I am monitoring also on other Windows servers?

I remove and add again the template which controls Windows Event ID on the particular Windows server but nothing happen.

Any idea what could be wrong?


Other Windows 2019 servers sends to Zabbix the Windows Event ID 4624 correctly.

The Zabbix client is in version 6.2.6.


Many thanks.
R,
M.

[MaterazziSan]

Hi,

Maybe you can check agent and server logs.

Best regards

[mzeman81]

Ok, and exactly should I check agent and server logs?

Many thanks.

[guille.rodriguez]

Check this post, maybe its useful for your problem

https://www.zabbix.com/forum/zabbix-troubleshooting-and-problems/454140-windows-eventlog-trigger-but-using-localtime

[mzeman81]

Well, I dont think so. My Item works on other servers only one server have the problem.

[MaterazziSan]

Ok, and exactly should I check agent and server logs?

Many thanks.

Yes, it might provide some clue.

Best regards

[mzeman81]

Ok, one server does not show in Zabbix server webconsole none Windows Event ID 4624 records, other yes. What should I check on the one server? I tried restart Zabbix client, remove and add the template but nothing worked. I dont have another idea what to do next.

[MaterazziSan]

Hi,

Maybe you can check "zabbix_agentd" for checking those items locally in both servers, server running fine and server does not collect information to compare output.

Best regards

[mzeman81]

I am sorry but find out the issue.
The issue was wrong server name.
It was filled with small letters and in "zabbix_agent2.conf" it was with capital letters :_(