<html>
<head>
<style>
P
{
margin:0px;
padding:0px
}
body
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body>
Thanks for the reply, I will have too weigh out taking a swag at this module vs. moving forward with deployment of BBWIN Is BBWIN considered production stable? I was also reading about the centralized updates, does this include ability for the agent to upgrade/udpate its self? This is a huge step for folks in my position with windows hosts in the hundreds with no central LDAP/AD, or even common logons it means manually touching each system for updates and config changes on the current bbnt client. I am really looking forward to getting bbwin roled out! <br><br>> Date: Thu, 10 May 2007 18:57:40 +0200<br>> To: hobbit@hswn.dk<br>> From: henrik@hswn.dk<br>> Subject: Re: [hobbit] Filtering event logs from windows sytems bbnt client<br>> <br>> On Wed, May 09, 2007 at 04:21:54PM +0000, Aaron Stranberg wrote:<br>> > <br>> > Hi All, Is it possible using the hobbit-clients.cfg <br>> > file to centrally filter out windows eventlog messages by key word?<br>> <br>> Unfortunately, no. The hobbit-clients.cfg only works on real "hobbit"<br>> clients that use the hobbit-specific way of reporting data which is<br>> then analysed at the server. The bbnt client determines the status all<br>> by itself and sends the status update directly to the server, so it<br>> isn't possible to filter data on the server.<br>> <br>> I can see a couple of ways you can do it, though. You can create a<br>> custom Hobbit server-side module, which is passed all of the "msgs"<br>> status data. Then you could filter these and generate a new status<br>> column - "msgs2", or whatever you'd call it - from these filtered data.<br>> <br>> Writing server-side modules may seem daunting, but it really isn't.<br>> If you grab the current Hobbit snapshot at http://www.hswn.dk/beta/<br>> then you'll find a perl program which is such a server-side module:<br>> It's in the hobbitd/hobbitd_rootlogin.pl file.<br>> <br>> You'd need to write a tool that reads the "msgs" status data it gets.<br>> The "msgs" status report (if I recall correctly) has the interesting<br>> lines listed with a red/yellow marker first, like:<br>> &red This is a critical message<br>> &yellow This is a warning<br>> &yellow This is pure noise<br>> So your script could weed out the "noise" lines, and then look at the<br>> remaining lines (if any) to see what the new status color should be.<br>> From that, it should be easy to generate the new "msgs2" status and<br>> feed it into Hobbit.<br>> <br>> <br>> Regards,<br>> Henrik<br>> <br>> <br>> To unsubscribe from the hobbit list, send an e-mail to<br>> hobbit-unsubscribe@hswn.dk<br>> <br>> <br><br /><hr />Change is good. See what's different about Windows Live Hotmail. <a href='www.windowslive-hotmail.com/learnmore/default.html?locale=en-us&ocid=RMT_TAGLM_HMWL_reten_changegood_0507' target='_new'>Check it out!</a></body>
</html>