Error messages on the agent on the servers who are forwarding:

[LOG] Unable to open the eventlog on forwarding server 'server name' (reason: 5)

or

[LOG] Unable to open the eventlog on forwarding...