Case:
If the eventlog monitoring results in "lastlogsize < FirstID", it will not be monitored correctly.

Envriment:
ZabbixServer 4.0.17
WindowsServer 2019

ItemSample:
Itemkey "eventlog[application,,Critical,,,,skip]"

Logs:

• zabbix_server.log of event occurrence

  2752:20210614:013034.182 active check "eventlog[application,,Critical,,,,skip]" is not supported: EvtNext failed: [0x000006C6] 配列の範囲が無効です。, EventRecordID:400445
  

• DebugLogs

  6760:20210624:151415.388 In process_eventslog6() source: 'application' previous lastlogsize: 400444, FirstID: 400657, LastID: 411140
  6760:20210624:151415.413 End of process_eventslog6():FAIL
  6760:20210624:151415.420 In finalize_eventlog6()
  6760:20210624:151415.427 End of finalize_eventlog6():SUCCEED
  6760:20210624:151415.433 active check "eventlog[application,,Warning,^Application Hang$,,,skip]" is not supported: EvtNext failed: [0x000006C6] 配列の範囲が無効です。, EventRecordID:400445
  6760:20210624:151415.439 In process_value() key:'TSCloud-vrai-01:eventlog[application,,Warning,^Application Hang$,,,skip]' lastlogsize:400444 value:'EvtNext failed: [0x000006C6] 配列の範囲>が無効です。, EventRecordID:400445'
  

The event IDs for the environment are as follows.

• EventRecordID:400445 did not exist.
• The latest log EventRecordID: 416475
• The oldest log EventRecordID: 400922

Result:
ZabbixAgent was not check eventlogs.

Expected:
It will probably become impossible to monitor if lastlogsize < FirstID.
Isn't this affected by the modification of ZBX-14441?
Where does there use the reading_startpoint that was used for calculations?

• eventlog.c

          if (lastlogsize >= FirstID && lastlogsize < LastID)
                  reading_startpoint = lastlogsize + 1;
          else
                  reading_startpoint = FirstID;
          if (reading_startpoint == LastID)       /* LastID = FirstID + count */
                  goto finish;