Well...

NXlog (last vrsion from this site) installed on windows server 2012R2

Configured to get win-logs:

SavePos TRUE

    Module      im_msvistalog
    Query     <QueryList>                        \
              <Query Id="0" Path="Security">            \
                <Select Path="Application">*</Select>    \
                    <Select Path="Security">*</Select>    \
                    <Select Path="System">*</Select>    \
                    <Suppress Path="Security">*[System[(EventID=5156 or EventID=4663 or EventID=5158 or EventID=5440 or EventID=5444)]]</Suppress>    \
                    <Suppress Path="System">*[System[(EventID=5156 or EventID=4663 or EventID=5158 or EventID=5440 or EventID=5444)]]</Suppress>    \
                  </Query>                \
        </QueryList>

As a result I see events only from System and Application... Nothing from Security

Any Idea why it can happen?

Logs are captured by windows - I can see it with eventvwr.msc, but nothing with Nxlog

NXlog have no information, looks like everything is ok:

...INFO nxlog-ce-2.8.1248 started... - no errors, no warnings... nothing else