Hi everyone, i encountered such a problem. I want to collect some event logs from windows server, so i made several items that schould collect events with a specific id. But not all the data is received on the server. And also events that happened a long time ago can come.
For example, about 40 minutes after these items were configured and launched, I needed to change the password for the account in AD. This generated event 4724, but it never arrived in zabbix, although the item for collecting this log was configured. The only thing that more or less normally arrives are events 4624 and 4634, although also not always completely.
To solve this problem, I tried changing the "RefreshActiveChecks", "StartAgents" and "Timeout" options. Since I thought that there were not enough computing resources and time to process a large log. But this did not help.
All my items looks like this, but with different event ids
In the log file at level 4 there is such an entry, although recently there was definitely such an event
In process_value() key:'hostname:eventlog[Security,,,,4724,,skip]' lastlogsize:550520586 value:'(null)'
I really hope for your help)
For example, about 40 minutes after these items were configured and launched, I needed to change the password for the account in AD. This generated event 4724, but it never arrived in zabbix, although the item for collecting this log was configured. The only thing that more or less normally arrives are events 4624 and 4634, although also not always completely.
To solve this problem, I tried changing the "RefreshActiveChecks", "StartAgents" and "Timeout" options. Since I thought that there were not enough computing resources and time to process a large log. But this did not help.
All my items looks like this, but with different event ids
In the log file at level 4 there is such an entry, although recently there was definitely such an event
In process_value() key:'hostname:eventlog[Security,,,,4724,,skip]' lastlogsize:550520586 value:'(null)'
I really hope for your help)