Hi,
New to xymon, currently testing on a few windows servers running 2003,2008,2012. I am using the bbwin client at the moment but am also aware of the PowerShell client (which I haven't tested yet). bbwin clients are all running in central mode and successfully sending data to the xymon server.
I'll give a brief background on what I have done to get event logs to work at all (this took lots of googling and playing around) I think this is the correct way to do it in central mode, if not please let me know and point me in the right direction as there isn't much information on the windows side of things:
Added this to analysis.cfg
CLASS=win32 LOG %.* %^critical.* COLOR=red LOG %.* %^error.* COLOR=red LOG %.* %^failure.* COLOR=yellow LOG %.* %^warning.* COLOR=yellow
This seems to work, the for example In the eventvwr where an event has Level=Warning in xymon this goes yellow.
Added rules in client-local.cfg to filter out certain events , this seems to use the description of the event and doesn't read the level at all (took a lot of googling and testing to work this out)
[win32] eventlog:security:10240 ignore .* permitted a connection ignore .* permitted a bind ignore Windows Firewall blocked an application eventlog:system:10240 ignore Big Brother Xymon Client service ignore .* The local computer may not have the necessary registry information eventlog:application:10240 ignore The (service BBWin|agent \w+\.dll) has been success ignore The agent externals generated this event message ignore .* shutting down due to idle timeout
Now the above all seems to work, events appear in the msgs column in xymon and they don't include any of the ones listed in the client-local.cfg. I can see the content of client-local.cfg being sent to the local machines and it all works.
My questions are
Why can't I filter on Success, Information etc in the client-local.cfg ? does this just not work or am I doing it wrong.Messages eventually disappear from the msgs column, so an error that had triggered it to go red will eventually go green even though the error may never have been fixed. I understand why this happens as it doesn't log an event to say the error is fixed so in that example it would always be red. But what controls how long the messages stay on the messages page for? And is there any way to for example have anything that is non green stay there until somehow they are acknowledged. Sort of like a to-do list of errors to resolve on each server.Does any of this work better/differently in the PowerShell client?
Brandon.