I don’t think that you can filter the Event ID on the checkmk Agent.
We are also monitoring the Microsoft-Windows-Backup as described here: CheckMK2 RAW - Windows Event Log auslesen (Windows Backup) und Wartungszeiten definieren - #7 by redseven
logwatch:
# enabled: yes
# sendall: no # this is MANDATORY
vista_api: yes # this is RECOMMENDED
# max_size: 500000 # default value
# entries in the windows eventlog
logfile:
- 'Microsoft-Windows-Backup': warn context
We are filtering the relevant Event IDs in the checkmk EventConsole.