I sent this message to the BBWin mailing list several days ago and have not gotten a response there. I hope to find an audience here.
I've got a bunch of machines reporting to my Xymon 4.3 server, of which a large percentage are Windows, running BBWin 0.12 in local mode. I want to convert everything to central mode, but I cannot seem to get the log filtering to work. I'm starting with my Exchange 2003 server, on 32-bit Windows 2003 SP2.
Here's what I've got in my client-local.cfg:
=-=-=-=-=-=-=-=-= [win32] eventlog:System ignore TermServDevices ignore Printer Driver ignore Big Brother Hobbit Client eventlog:Application ignore information ignore TermServDevices ignore BigBrotherHobbitClient ignore Failed to create a new named ignore Error 0x7da
Here's what's in hobbit-clients.cfg:
=-=-=-=-=-=-=-=-= HOST=exchange.slc SVC IMAP4Svc startup=automatic status=started SVC MSExchangeIS startup=automatic status=started SVC MSExchangeSA startup=automatic status=started SVC RESvc startup=automatic status=started SVC SMTPSVC startup=automatic status=started SVC W3SVC startup=automatic status=started
CLASS=%win32 LOAD 50 75 PORT STATE=LISTENING MIN=0 TRACK=Listen TEXT=Listen LOG %.* %^error.* COLOR=red LOG %.* %^warning.* COLOR=yellow
Nothing is being filtered by the ignore entries in client-local.cfg. They show up in the log on the website and are tagged as red alarms. The config is being transferred to the BBWin tmp folder. If I turn on debugging, the BBWin log shows all of the ignore lines, but it still doesn't work.
I took a look through the trunk source code for msgs.dll, but found my meager C++ skills quickly overwhelmed and I was not able to follow it.
Does anyone have a working BBWin/Xymon 4.3 central mode config with log filtering that they can share? I'd like the logs filtered before they get to Xymon, and from what I understand, if I use the IGNORE syntax in hobbit-clients.cfg, it has to transfer all log entries to the server. Windows is notorious for spamming the event log with useless informational messages when there's a problem, so it might exceed the buffer size and cause me to miss events if they are not filtered first.
Thanks, Shawn