Hi folks. I've been trying to validate that my analysis.cfg and alerts.cfg settings are set up right to get good info for certain ports and services (SQL Ports, and SQL services on windows machines).

While tweaking things I noticed my messages may have been truncated, which I believe leads to invalidate status and emails (now using html_mail.pl) I changed the values in xymonserver.cfg as shown below: MAXLINE="32768" MAXMSG_STATUS="384" MAXMSG_CLIENT="1024" MAXMSG_DATA="1024"

Are there going to be problems on the xymon server with me making these values larger? Should I add a MAXMSG_CLICHG setting to fix the "Oversize clichg" truncation?

Here is a snip from the xymond.log file showing truncated msgs…

012-04-26 13:58:35 Oversize clichg msg from xymond for SERVERNAME truncated (n=3985606, limit=524288) 2012-04-26 13:58:35 Oversize clichg msg from xymond for SERVERNAME truncated (n=3985606, limit=524288) 2012-04-26 16:01:41 Oversize data/client msg from xxx.xx.xx.xx truncated (n=4471230, limit 1048576) 2012-04-26 16:06:48 Oversize data/client msg from xxx.xx.xx.xx truncated (n=4471517, limit 1048576)

Should I be doing something else for the analysis.cfg to watch SQL ports and services?

I'm sending another email with the analysis.cfg and alerts.cfg settings to keep this from being too long.

Any thoughts appreciated.

Thanks

Don K