i made new Agent Policie under template with the following content
SubAgent=wineventsync.nsm
[WinEventSync]
EventLog=Application
EventLog=Security
EventLog=System
But i dont see it being applied to nodes, even when i click force deployment of agent policies. I think it only gets applied when template is assigned to new node, and not already existing nodes.
Policy will be applied only to nodes, to which the template is applied (but should work in any sequence - either template was applied first and then policy was added, or otherwise).
On Windows systems default location for configuration policy files is
C:\Windows\System32\config\systemprofile\AppData\Local\nxagentd\config_ap
so you can watch this folder to check if policy gets there. Agent restart is needed so it can catch up the new configuration.
Also, on a side node, there are two ways how to monitor Windows Event logs - one is Windows Event Sync, when logs are sent to NetXMS server and stored there (so it requires bandwidth and DB space. The other is Log File Parser Policy - you can specify Windows Event Logs there in file name field, e.g. *Security