[hobbit] Filtering event logs from windows sytems bbnt client
Thanks for the reply, I will have too weigh out taking a swag at this module vs. moving forward with deployment of BBWIN Is BBWIN considered production stable? I was also reading about the centralized updates, does this include ability for the agent to upgrade/udpate its self? This is a huge step for folks in my position with windows hosts in the hundreds with no central LDAP/AD, or even common logons it means manually touching each system for updates and config changes on the current bbnt client. I am really looking forward to getting bbwin roled out! > Date: Thu, 10 May 2007 18:57:40 +0200> To: hobbit at hswn.dk> From: henrik at hswn.dk> Subject: Re: [hobbit] Filtering event logs from windows sytems bbnt client> > On Wed, May 09, 2007 at 04:21:54PM +0000, Aaron Stranberg wrote:> > > > Hi All, Is it possible using the hobbit-clients.cfg > > file to centrally filter out windows eventlog messages by key word?> > Unfortunately, no. The hobbit-clients.cfg only works on real "hobbit"> clients that use the hobbit-specific way of reporting data which is> then analysed at the server. The bbnt client determines the status all> by itself and sends the status update directly to the server, so it> isn't possible to filter data on the server.> > I can see a couple of ways you can do it, though. You can create a> custom Hobbit server-side module, which is passed all of the "msgs"> status data. Then you could filter these and generate a new status> column - "msgs2", or whatever you'd call it - from these filtered data.> > Writing server-side modules may seem daunting, but it really isn't.> If you grab the current Hobbit snapshot at http://www.hswn.dk/beta/> then you'll find a perl program which is such a server-side module:> It's in the hobbitd/hobbitd_rootlogin.pl file.> > You'd need to write a tool that reads the "msgs" status data it gets.> The "msgs" status report (if I recall correctly) has the interesting> lines listed with a red/yellow marker first, like:> &red This is a critical message> &yellow This is a warning> &yellow This is pure noise> So your script could weed out the "noise" lines, and then look at the> remaining lines (if any) to see what the new status color should be.> From that, it should be easy to generate the new "msgs2" status and> feed it into Hobbit.> > > Regards,> Henrik> > > To unsubscribe from the hobbit list, send an e-mail to> hobbit-unsubscribe at hswn.dk> >
Add some color. Personalize your inbox with your favorite colors. www.windowslive-hotmail.com/learnmore/personalize.html?locale=en-us&ocid=TXT_TAGLM_HMWL_reten_addcolor_0507
I don't think Etienne has the centralized rollout done, yet, but he'd have to speak to that. It's been a few months since the last update to .9.
=G=
Aaron Stranberg wrote:
Thanks for the reply, I will have too weigh out taking a swag at this module vs. moving forward with deployment of BBWIN Is BBWIN considered production stable? I was also reading about the centralized updates, does this include ability for the agent to upgrade/udpate its self? This is a huge step for folks in my position with windows hosts in the hundreds with no central LDAP/AD, or even common logons it means manually touching each system for updates and config changes on the current bbnt client. I am really looking forward to getting bbwin roled out!
Date: Thu, 10 May 2007 18:57:40 +0200 To: hobbit at hswn.dk From: henrik at hswn.dk Subject: Re: [hobbit] Filtering event logs from windows sytems bbnt client
On Wed, May 09, 2007 at 04:21:54PM +0000, Aaron Stranberg wrote:
Hi All, Is it possible using the hobbit-clients.cfg file to centrally filter out windows eventlog messages by key word?
Unfortunately, no. The hobbit-clients.cfg only works on real "hobbit" clients that use the hobbit-specific way of reporting data which is then analysed at the server. The bbnt client determines the status all by itself and sends the status update directly to the server, so it isn't possible to filter data on the server.
I can see a couple of ways you can do it, though. You can create a custom Hobbit server-side module, which is passed all of the "msgs" status data. Then you could filter these and generate a new status column - "msgs2", or whatever you'd call it - from these filtered data.
Writing server-side modules may seem daunting, but it really isn't. If you grab the current Hobbit snapshot at http://www.hswn.dk/beta/ then you'll find a perl program which is such a server-side module: It's in the hobbitd/hobbitd_rootlogin.pl file.
You'd need to write a tool that reads the "msgs" status data it gets. The "msgs" status report (if I recall correctly) has the interesting lines listed with a red/yellow marker first, like: &red This is a critical message &yellow This is a warning &yellow This is pure noise So your script could weed out the "noise" lines, and then look at the remaining lines (if any) to see what the new status color should be. From that, it should be easy to generate the new "msgs2" status and feed it into Hobbit.
Regards, Henrik
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
Change is good. See what's different about Windows Live Hotmail. Check it out! <www.windowslive-hotmail.com/learnmore/default.html?locale=en-us&ocid=RMT_TAGLM_HMWL_reten_changegood_0507>
I have three servers
tools-www-01 (hobbitd server, BBDISPLAY BBNET BBPAGER) tools-pol-03 (Big Brother BBNET) tools-pol-04 (Big Brother BBNET)
on tools-www-01 I have several hosts that are failing the conn test from tools-www-01 and paging me the problem is, tools-www-01 should not be testing these hosts from my understanding of the tags in the bb-hosts file
bb-hosts on tools-www-01:
10.10.9.9 tools-www-01.domain.com # BBDISPLAY BBNET BBPAGER NET:tools-pol-03.domain.com 10.10.10.10 hostname-prov-db-02.domain.com # NET:tools-pol-04.domain.com
From what I gather, prov-db-02 should only be tested from dev-pol-04 (and that connection is successful)
What I am getting is constant "flaps" of it being up/down/up/down - when I get the down page, the failure source is tools-www-01, not tools-pol-04. When tools-pol-04 sends green it recovers
Am I not using locations correctly? Or is there something more for me to look at?
-Sean
Have you set the BBLOCATION variable in either hobbitserver.cfg or in hobbitlaunch.cfg on each server?
Thanks, Larry Barber
On 5/11/07, Sean R. Clark <sclark at nyroc.rr.com> wrote:
I have three servers
tools-www-01 (hobbitd server, BBDISPLAY BBNET BBPAGER) tools-pol-03 (Big Brother BBNET) tools-pol-04 (Big Brother BBNET)
on tools-www-01 I have several hosts that are failing the conn test from tools-www-01 and paging me the problem is, tools-www-01 should not be testing these hosts from my understanding of the tags in the bb-hosts file
bb-hosts on tools-www-01:
10.10.9.9 tools-www-01.domain.com # BBDISPLAY BBNET BBPAGER NET:tools-pol-03.domain.com 10.10.10.10 hostname-prov-db-02.domain.com # NET: tools-pol-04.domain.com
From what I gather, prov-db-02 should only be tested from dev-pol-04 (and that connection is successful)
What I am getting is constant "flaps" of it being up/down/up/down - when I get the down page, the failure source is tools-www-01, not tools-pol-04. When tools-pol-04 sends green it recovers
Am I not using locations correctly? Or is there something more for me to look at?
-Sean
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
Also, I don't know if it matters, but the NET is Net in our config and works fine. Case may or may not matter.
Tod Hansmann
Network Engineer
From: Larry Barber [mailto:lebarber at gmail.com] Sent: Friday, May 11, 2007 9:51 AM To: hobbit at hswn.dk Subject: Re: [hobbit] Net:Location appears not to work?
Have you set the BBLOCATION variable in either hobbitserver.cfg or in hobbitlaunch.cfg on each server?
Thanks, Larry Barber
On 5/11/07, Sean R. Clark <sclark at nyroc.rr.com> wrote:
I have three servers
tools-www-01 (hobbitd server, BBDISPLAY BBNET BBPAGER) tools-pol-03 (Big Brother BBNET) tools-pol-04 (Big Brother BBNET)
on tools-www-01 I have several hosts that are failing the conn test from tools-www-01 and paging me the problem is, tools-www-01 should not be testing these hosts from my understanding of the tags in the bb-hosts file
bb-hosts on tools-www-01:
10.10.9.9 tools-www-01.domain.com # BBDISPLAY BBNET BBPAGER NET:tools-pol-03.domain.com 10.10.10.10 hostname-prov-db-02.domain.com # NET:tools-pol-04.domain.com
From what I gather, prov-db-02 should only be tested from dev-pol-04 (and that connection is successful)
What I am getting is constant "flaps" of it being up/down/up/down - when I get the down page, the failure source is tools-www-01, not tools-pol-04. When tools-pol-04 sends green it recovers
Am I not using locations correctly? Or is there something more for me to look at?
-Sean
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
On Fri, May 11, 2007 at 10:39:28AM -0400, Sean R. Clark wrote:
I have three servers
tools-www-01 (hobbitd server, BBDISPLAY BBNET BBPAGER) tools-pol-03 (Big Brother BBNET) tools-pol-04 (Big Brother BBNET)
First, mixing Hobbit and BB network test tools does complicate things. There are quite a few settings in the bb-hosts file that the BB servers ignore - including the NET:foo setting.
on tools-www-01 I have several hosts that are failing the conn test from tools-www-01 and paging me the problem is, tools-www-01 should not be testing these hosts from my understanding of the tags in the bb-hosts file
bb-hosts on tools-www-01:
10.10.9.9 tools-www-01.domain.com # BBDISPLAY BBNET BBPAGER NET:tools-pol-03.domain.com 10.10.10.10 hostname-prov-db-02.domain.com # NET:tools-pol-04.domain.com
Make sure you have BBLOCATION set in the hobbitserver.cfg file on your Hobbit server (tools-www-01). If this isn't set, it will ignore all of the NET:foo settings in bb-hosts. On the other hand, when BBLOCATION is set Hobbit will test ONLY those hosts that have a matching NET: setting.
Your two Big Brother servers just ignore the NET: setting in bb-hosts, so they will test whatever hosts are listed in the bb-hosts file. Had they been running Hobbit, you would have set BBLOCATION=tools-pol-03.domain.com or BBLOCATION=tools-pol-04.domain.com in their hobbitserver.cfg file.
Regards, Henrik
participants (6)
-
a_stranberg＠hotmail.com
-
gjohnson＠trantor.org
-
henrik＠hswn.dk
-
lebarber＠gmail.com
-
sclark＠nyroc.rr.com
-
thansmann＠directpointe.com