When Zabbix agent is used for log file monitoring, it sends log file modification time and size.

In case of some manipulations with server, it is possible to have re-read from previously read log files. For example:
1. When OS is recovered from backup.
2. Solaris OS upgrade procedure, using OS snapshot.

Existing log files will have smaller size than already read, in this case Zabbix agent decides that the log file is new and start read it from first byte.

Probably it is a good idea to store current Zabbix agent state locally and use such information as priority during such operations, like log file monitoring