Why is Zabbix collecting Windows Event Log data late?

[ZabTheo]

Hello,

I have the following items applied to all domain controllers to monitor security events.




Here are the corresponding triggers:



However the time that the event occurred on the domain controller (Local time), compared to the time Zabbix saw the event is always several hours later. This is causing the alert to trigger way past the event.




Here is the domain controllers latest data showing the time it last checked. I assume this is when Zabbix pulled the log and caused the problem alert above.




Any idea why this is happening? The item is an active check set to 1 second. I would expect Zabbix to get the info from the domain controller straight away.
Thanks!

[ZabTheo]

Doing some further investigation on this issue, it seems to be a common occurrence. There are quite a few posts where people are having the same issue.
Is this expected due to the number of log entries Zabbix is trying to process from the domain controllers?

[ZabTheo]

So I adjusted the update interval from 1 second to 10 seconds and they now seem to be alerting within a few minutes.