Here's the scenario.
In Agent -> Machine Status -> Event Log Settings, I had added the Security event log with only "Failure Audit" enabled. I was really only interested in seeing when people failed to log in. Now things have changed a little bit, so I went back in the same please, edited the Security event log setting to Success and Failure, so I can log every thing.
However, when I now go to Agent -> Machine Status -> Agent Logs, and pick the Domain controller, then the Security log, I get almost no new events logged at all. There's been 3 events logged in the last 30 minutes, while on the server itself, there's at least 50 in that same time period.
So, where are all my events?
What other items are you monitoring for on this domain controller?
Have you tried ensuring a full check-in has occurred on the agent?
The easiest way to force this is to run a script on the agent. Any script will do it. If an agent checks in and there is nothing to do, it will do a quick check-in and one of the things not always included in a quick check-in is uploading of windows logs.