Within the last two weeks, an event log monitor that watches the Security log on a domain controller stopped reporting events. The monitor has an OK status, but it does not match any events. As a test, I created a monitor that watches the Security log but does not filter events. This monitor does not report any events either.
Running as the PAdmin service account, Event Viewer can connect to and view the remote log. WBEMTEST proves that it can query the Security log.
