Hi, I just upgraded one server to BBWIN 0.12 and I have a the Netstat test purple all the time... anyone had this issue ? All the other tests are working fine. Also I have no more truncated messages on hobbitd.log file.

Thanks

Stéphane Boisvert

Thanks Kapildev,

I did not see that the stats were in the Trends :-) thanks for the help

Steph

-----Original Message----- From: Kapildev Khemraj [mailto:khemdev at bc.edu] Sent: 16 juin 2008 16:09 To: hobbit at hswn.dk Subject: Re: [hobbit] BBwin 0.12

Here is Etienne GRIGNON solution for the netstat going purple.

Hello,

2008/3/6, Kapildev Khemraj <khemdev at bc.edu>:

Greetings,

I have BBWin 0.11 installed on 4 server2003 machines and one xp pro machine. I have the BBwin.cfg file set to central and everything works fine with the exception of the netstat test. The first time I started the BBwin client on each machine the netstat test reported fine to the hobbit server but than it went to purple. Is there something I am missing or doing wrong. Any help will be much appreciated.

It is normal. In local mode, the data used for network trends were sent with a status (netstat column). With the centralized mode, every thing is sent trough the clientdata report. So you will get all your network graphs in trends without the need to have a useless netstat column.

So, you just have to drop the purple netstat column on your hobbit server

./bb localhost "drop yourservername netstat"

Regards,

-- Etienne GRIGNON | On Mon, 16 Jun 2008 15:53:39 -0400 | "Stephane Boisvert" <sboisvert at hralloy.com> wrote: | Hi, | I just upgraded one server to BBWIN 0.12 and I have a the Netstat test purple all the time... anyone had this issue ? All the other tests are working fine. Also I have no more truncated messages on hobbitd.log file. |
|
| Thanks |
| Stéphane Boisvert |
| To unsubscribe from the hobbit list, send an e-mail to | hobbit-unsubscribe at hswn.dk |
|

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

I'll try to answer these:

1. Honestly I'm not sure. It shows up in the .txt file in tmp as eventlog_application but I have had more luck just using some sort of regex with application in it, like ^.*application.*$. No idea if this is a bug or not. One thing you could try to troubleshoot is just use an all-encompassing regex like .* for the file name to narrow it down.

2. Yes, I do see the [logfile:tlog] error when eventlog:Security is enabled, but I don't believe it is causing any issues.

3. I don't see any errors or failures in your security log, and nothing is in the application or system logs, so I'm not sure what to look for. Right now I'm using:

hobbit-client.cfg: CLASS=win32 LOG %.* "%error - .*" COLOR=red LOG %.* "%failure - .*" COLOR=red LOG %.* "%warning - .*" COLOR=yellow

client-local.cfg [win32] eventlog:security ignore Success eventlog:application ignore information eventlog:system ignore information

It can be more refined by specifying the log names, but it ensures that all errors, warnings or failures are caught no matter which log they are in. The ignore entries are an attempt to clean up the data being sent to the hobbit server, but I can't get them to work.

• Aaron Zink

-----Original Message----- From: McGraw, Robert P [mailto:rmcgraw at purdue.edu] Sent: Monday, June 16, 2008 15:26 To: hobbit at hswn.dk Subject: RE: [hobbit] BBWin and Hobbit msgs log question.

Aaron.

A couple questions:

[mailrelay.math.purdue.edu] is my win32 client I just use a host name.

On my server my client-local.cfg looks like the following:

    [mailrelay.math.purdue.edu]
    file:c:\Alligate\Digests\(rmcgraw at math.purdue.edu).txt
    eventlog:security

On the BBWin client I have

    $ cat clientlocal.cfg
    file:c:\Alligate\Digests\(rmcgraw at math.purdue.edu).txt
    eventlog:security

Which shows that it was read from the server correctly.

On the hobbit server in my hobbit-clients I have

    HOST=mailrelay.math.purdue.edu
            UP 30m 1w
            LOAD 40.0 70.0
            DISK * 90 95
            FILE c:\Alligate\Digests\(rmcgraw at math.purdue.edu).txt red

MTIME<43200 LOG %security "Login attempt" COLOR=yellow

1. The second parameter of the LOG entry should be the file name. What is the file name for the event security logs?

2. It seem that when I added "eventlog:security" I get the [logfile:tlog] error message in the msg.mailrelay.math.purdue.edu.txt file that is located in the BBWin/tmp directory. Do you get this?

3. From the information above and the snipit of my msg. file can you give me the LOG entry that you think would work.

Snipit from my msg.mailrelay.math.purdue.edu.txt fileon the BBwin client mailrelay.

[logfile:tlog] ERROR: The system cannot find the file specified.

[msgs:eventlog_application] [msgs:eventlog_security] success - 2008/06/16 17:53:25 - Security (576) - Special privileges assigned to new logon: User Name: Domain: Logon ID: (0x0,0x84B6EDC) Privileges: SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege success - 2008/06/16 17:53:25 - Security (528) - Successful Logon: User Name: rmcgraw Domain: MAILRELAY Logon ID: (0x0,0x84B6EDC) Logon Type: 2 Logon Process: Advapi Authentication Package: Negotiate Workstation Name: MAILRELAY Logon GUID: - Caller User Name: sshd_server Caller Domain: MAILRELAY Caller Logon ID: (0x0,0x10A65) Caller Process ID: 2856 Transited Services: - Source Network Address: - Source Port: - success - 2008/06/16 17:53:25 - Security (552) - Logon attempt using explicit credentials: Logged on user: User Name: sshd_server Domain: MAILRELAY Logon ID: (0x0,0x10A65) Logon GUID: - User whose credentials were used: Target User Name: rmcgraw Target Domain: MAILRELAY Target Logon GUID:

• Target Server Name: localhost Target Server Info: localhost Caller Process ID: 2856 Source Network Address: - Source Port: - success - 2008/06/16 17:53:25 - Security (680) - Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account: rmcgraw Source Workstation: MAILRELAY Error Code: 0x0 success - 2008/06/16 17:49:42 - Security (538) - User Logoff: User Name: rmcgraw Domain: MAILRELAY Logon ID: (0x0,0x849D0DB) Logon Type: 7 success - 2008/06/16 17:49:42 - Security (576) - Special privileges assigned to new logon: User Name: rmcgraw Domain: MAILRELAY Logon ID: (0x0,0x849D0DB) Privileges: SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege success - 2008/06/16 17:49:42 - Security (528) - Successful Logon: User Name: rmcgraw Domain: MAILRELAY Logon ID: (0x0,0x849D0DB) Logon Type: 7 Logon Process: User32 Authentication Package: Negotiate Workstation Name: MAILRELAY Logon GUID: - Caller User Name: MAILRELAY$ Caller Domain: MATHNET Caller Logon ID: (0x0,0x3E7) Caller Process ID: 3008 Transited Services: - Source Network Address: 128.210.3.202 Source Port: 57339 success - 2008/06/16 17:49:42 - Security (552) - Logon attempt using explicit credentials: Logged on user: User Name: MAILRELAY$ Domain: MATHNET Logon ID: (0x0,0x3E7) Logon GUID: - User whose credentials were used: Target User Name: rmcgraw Target Domain: MAILRELAY Target Logon GUID: - Target Server Name: localhost Target Server Info: localhost Caller Process ID: 3008 Source Network Address: 128.210.3.202 Source Port: 57339 success - 2008/06/16 17:49:42 - Security (680) - Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account: rmcgraw Source Workstation: MAILRELAY Error Code: 0x0 [msgs:eventlog_system]

-----Original Message----- From: Aaron Zink [mailto:AaronZink at eharmony.com] Sent: Monday, June 16, 2008 2:43 PM To: hobbit at hswn.dk Subject: RE: [hobbit] BBWin and Hobbit msgs log question.

Robert,

If you are running in centralized mode, to get message log alerting you will also need something in client-local.cfg, such as:

[win32] eventlog:application ignore information ignore BigBrotherHobbitClient eventlog:system ignore information

Then your LOG entry in hobbit-clients.cfg *should* work after restarting hobbit and bbwin, but you probably need/want to use regexes to refine the alerts. For example, I use:

CLASS=win32 LOG %application.* "%error - .*" COLOR=red LOG %application.* "%warning - .*" COLOR=yellow

Hope this helps.

Aaron Zink Corporate IT Manager eHarmony.com 626.795.4814

-----Original Message----- From: McGraw, Robert P [mailto:rmcgraw at purdue.edu] Sent: Monday, June 16, 2008 07:09 To: bbwin-users at lists.sourceforge.net; hobbit at hswn.dk Subject: [hobbit] BBWin and Hobbit msgs log question.

HOBBIT SERVER: SunOS zorn.math.purdue.edu 5.10 Generic_120011-14 sun4u sparc SUNW,Sun-Fire-280R runnint Hobbit 4.2

BBWIN CLIENT: Microsoft Windows Server 2003, Standard Edition Service Pack 2 (build 3790) running BBWin V.12

On the hobbit server I have the following event logs under msgs that are coming from the BBWin server. I am not sure how I can monitor these log messages.

Full log eventlog_application information - 2008/06/16 09:52:34 - sshd (0) - The description for Event ID ( 0 ) in Source ( sshd ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: sshd: PID 3320: Connection closed by 128.210.3.177. information - 2008/06/16 09:47:33 - sshd (0) - The description for Event ID ( 0 ) in Source ( sshd ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: sshd: PID 3524: Connection closed by 128.210.3.177.

What would I put in the hobbit server hobbit-clients.cfg file to make the msgs icon for the bbwin client turn yellow.

I had tried

    LOG event_application information color=yellow

But that did not work.

Thanks

Robert

---

Robert P. McGraw, Jr. Manager, Computer System EMAIL: rmcgraw at purdue.edu Purdue University ROOM: MATH-807 Department of Mathematics PHONE: (765) 494-6055 150 N. University Street West Lafayette, IN 47907-2067

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk