Windows Logs not working, Zabbix 4.0.17

[dkoski]

After migration from 3.x to 4.0, many hosts do not report Windows Logs at all. Some of the hosts that report properly are older versions but all proxies and the server are 4.0. I have tried to remove and add the Template with no change in outcome. I was once able to get a host to report properly after uninstalling the agent, removing the configuration and starting over. Others I have tried this to failed. I have tried both active and passive proxy settings. Host names and IP addresses were checked multiple times. I have configured active checks on the host to go directly to the server, bypassing the proxy. On the server or proxy, the message in the log seems to be "no active checks on server [<IP_Address>]: host [<hostname>] not found". This I would expect on a proxy before a sync but the problem persists regardless how long I wait. Looks like the server does not have the configuration for Windows Logs, an active template. Any clues welcome.

[dkoski]

Bump. Anybody?

[Atsushi]

Check that the character string specified for Hostname in zabbix_agentd.conf matches the character string of the host name registered on the Zabbix server web front end.

[dkoski]

Re: "Check that the character string.." I have checked many times and have created new configs in the server and agent with new names with no change of outcome. At one time I created a new config in the server, again leaving the old in place, then reconfigured the agent with the new name. Then both configs started working! Bizarre.

[dkoski]

For testing, I just added a new config for an agent. The existing config host name was like server1 and the new config is server1a. I changed the agent config to reflect the name server1a. Both configs are still in the server but the original config for server1 is still getting data, but not Windows Logging. It does not appear that the hostname string works properly.

[dkoski]

I see the log on the server is reporting:

4575:20200319:114054.291 cannot send list of active checks to "12.34.56.78": host [terminal10a] not found

But it does. I just verified.

[dkoski]

Solved! The Zabbix proxy had a failed primary DNS server but the secondary worked. Presumably, this caused a delay when the agent queried the proxy for active checks. I could see in the agent log with log level at 4:

End of refresh_active_checks():FAIL

I'm still not sure if it broke between the agent and proxy or server and proxy but the server had no indication in the log, with a default log level. Once I fixed the DNS configuration on the proxy server it all worked, even the other hosts that were not reporting active checks immediately started working.