You should use [win32] instead of [dcstest2] in your

client-local.cfg because in your bbwin.cfg, the configclass is set to win32 (<setting name="configclass" value="win32" />). Once you will do that, BBWin, will get the rules you have set to ignore some events.

Does this mean that you cannot have a client entry in client-local.cfg or can we change the configclass in bbwin.cfg?

Also the COMMAND config parameter in client-local.cfg don't appear to work. I have the following entry in my client-local.cfg

file:C:\listing.cmd

The listing.cmd file contains the following entry dir "C:\CFusionMX\Mail\Spool"

hobbit-client.cfg contains FILE %C:\CFusionMX\Mail\Spool\.* MTIME>600 COLOR=red TRACK

But all i get is a No Files Checked in the status window

thanks Nick

On Thu, Apr 3, 2008 at 8:29 AM, Etienne Grignon <etienne.grignon at gmail.com> wrote:

Hi Matthew,

2008/4/2, Matthew.Roberts at nt.gov.au <Matthew.Roberts at nt.gov.au>:

...

Hi All,

I need a bit of assistance in setting up BBWin0.11 with Hobbit 4.3 in Centralised config mode.

My problem lies with the eventlog monitoring of my Windows hosts. When

running

...

BBWin in local config mode, I can setup filtering so that only specific event log types get sent to the hobbit server and displayed on the msgs page. However when I configure BBWin to use a central config, I cant filter which event logs get sent to the hobbit server and displayed on the msgs page. As a result my msgs page is full of eventlog entries which I dont need to know about.

Below is a copy of my BBWin.cfg and the client-local.cfg on the hobbit server

<?xml version="1.0" encoding="utf-8" ?> <configuration> <bbwin> ...

  <!-- bbwin mode local or central -->
  <setting name="mode" value="central" />
  <setting name="configclass" value="win32" />

...

...

  <setting name="logreportfailure" value="false" />

</bbwin>

client-local.cfg: (dcstest2 is the name of one of my hosts I am having

problems

...

with)

[dcstest2] eventlog:security ignore Success eventlog:application ignore information eventlog:system ignore information

You should use [win32] instead of [dcstest2] in your client-local.cfg because in your bbwin.cfg, the configclass is set to win32 (<setting name="configclass" value="win32" />). Once you will do that, BBWin, will get the rules you have set to ignore some events.

-- Etienne GRIGNON

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

Hi Etienne, Thanks for the info. I'm now trying to implement a vbs script solution ( perl is out of the question at the moment) and i'm getting errors. How do you run a vbs script from client-local? I've tried the following file:C:\listing.vbs [WARN]: [files]: C:\listing.vbs command failed : The handle is invalid. I tried this also file:cscript C:\listing.vbs and i get this error [WARN]: [files]: Unknow hash type for file configuration : \listing.vbs`

listing.vbs is a script i borrowed from microsoft's scripting repository

strComputer = "."

Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colFileList = objWMIService.ExecQuery _ ("ASSOCIATORS OF {Win32_Directory.Name='C:\CFusionMX\Mail\Spool'} Where " _ & "ResultClass = CIM_DataFile")

    For Each objFile In colFileList
    Wscript.Echo objFile.Name
Next

On Thu, Apr 3, 2008 at 10:12 AM, Etienne Grignon <etienne.grignon at gmail.com> wrote:

Hello Nick,

2008/4/3, ndegz <nndegz at gmail.com>:

...

...

You should use [win32] instead of [dcstest2] in your client-local.cfg because in your bbwin.cfg, the configclass is set to win32 (<setting name="configclass" value="win32" />). Once you will do that, BBWin, will get the rules you have set to ignore some events.

Does this mean that you cannot have a client entry in client-local.cfg

or

...

can we change the configclass in bbwin.cfg?

If you want to use something else than win32, then you will have to change the default configclass value in the bbwin.cfg file.

...

Also the COMMAND config parameter in client-local.cfg don't appear to work. I have the following entry in my client-local.cfg

file:C:\listing.cmd

The listing.cmd file contains the following entry dir "C:\CFusionMX\Mail\Spool"

hobbit-client.cfg contains FILE %C:\CFusionMX\Mail\Spool\.* MTIME>600 COLOR=red TRACK

But all i get is a No Files Checked in the status window

Can you check the output of the command "dir "C:\CFusionMX\Mail\Spool"

The output has to be very clean like this : dir "C:\CFusionMX\Mail\Spool" C:\CFusionMX\Mail\Spool\mail1 C:\CFusionMX\Mail\Spool\mail2 C:\CFusionMX\Mail\Spool\mail3

If you get something like this : C:\Program Files\BBWin\tmp>dir Volume in drive C is MainDisk Volume Serial Number is XXXX-XXXXX

Directory of C:\Program Files\BBWin\tmp

20/02/2008 19:15 <DIR> . 20/02/2008 19:15 <DIR> .. 20/02/2008 17:15 6 736 bbwin.cfg.work 20/02/2008 19:14 1 367 clientlocal.cfg 20/02/2008 19:15 274 logfetch.status 20/02/2008 19:14 208 287 msg.winxp.txt 4 File(s) 216 664 bytes 2 Dir(s) 8 418 668 544 bytes free

C:\Program Files\BBWin\tmp>

then it won't work.

You shall need to use something else than the dir command. You may write a small perl or vbscript which is more powerful than the dos commands.

Best regards,

-- Etienne GRIGNON

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk