<font size=2 face="sans-serif">Hi</font>
<br><font size=2 face="sans-serif">I think this is a bug in bbwin in central
mode.</font>
<br>
<br><font size=2 face="sans-serif">This works for me, it gets yellow, but
a lot of other things dont work.</font>
<br><font size=2 face="sans-serif">i've given up trying any more.</font>
<br>
<br><font size=2 face="sans-serif">put this last in analysis.cfg</font>
<br>
<br><font size=2 face="sans-serif">CLASS=win32</font>
<br><font size=2 face="sans-serif">LOG %.* %^failure.* COLOR=yellow </font>
<br>
<br><font size=2 face="sans-serif">Here is the result in Xymon</font>
<br>
<table align=center>
<tr>
<td><tt><font size=3><br>
<br>
Warnings in </font></tt><a href="http://en-xymon-02/xymon-cgi/svcstatus.sh?CLIENT=EN-ORA-04&SECTION=msgs:eventlog_security"><tt><font size=3 color=blue><u>eventlog_security</u></font></tt></a><tt><font size=3><br>
</font></tt>
<br><tt><font size=3> failure - 2011/09/14 19:54:12 - Security (529)
- Logon Failure: Reason: Unknown user name or bad password User Name:</font></tt></table>
<br>
<br>
<br><font size=2 face="sans-serif">Regards</font>
<br><font size=2 face="sans-serif">Martin</font>
<br>
<br>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">Frċn:
</font><font size=1 face="sans-serif">"Neil Simmonds"
<Neil.Simmonds@express-gifts.co.uk></font>
<br><font size=1 color=#5f5f5f face="sans-serif">Till:
</font><font size=1 face="sans-serif"><xymon@xymon.com></font>
<br><font size=1 color=#5f5f5f face="sans-serif">Datum:
</font><font size=1 face="sans-serif">2011-09-23 15:38</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Ärende:
</font><font size=1 face="sans-serif">[Xymon] FW:
Regular expression</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Sänt av:
</font><font size=1 face="sans-serif">xymon-bounces@xymon.com</font>
<br>
<hr noshade>
<br>
<br>
<br><font size=2 color=blue face="Arial">Thanks for that Daniel,</font>
<br><font size=2 color=blue face="Arial"> </font>
<br><font size=2 color=blue face="Arial">It’s still not working. I’ve
even reduced it down to the following,</font>
<br><font size=2 color=blue face="Arial"> </font>
<br><font size=2 color=blue face="Arial">LOG eventlog:application Error
COLOR=red</font>
<br><font size=2 color=blue face="Arial"> </font>
<br><font size=2 color=blue face="Arial">I’ve also tried</font>
<br><font size=2 color=blue face="Arial"> </font>
<br><font size=2 color=blue face="Arial">LOG eventlog_application Error
COLOR=red</font>
<br><font size=2 color=blue face="Arial"> </font>
<br><font size=2 color=blue face="Arial">And</font>
<br><font size=2 color=blue face="Arial"> </font>
<br><font size=2 color=blue face="Arial">LOG application Error COLOR=red</font>
<br><font size=2 color=blue face="Arial"> </font>
<br><font size=2 color=blue face="Arial">All with no success. These entries
are all in analysis.cfg on the server and the BBWin agent is running in
central mode.</font>
<br><font size=2 color=blue face="Arial"> </font>
<br><font size=2 color=blue face="Arial">I’d really like to get this working
if anyone can help?</font>
<br><font size=2 color=blue face="Arial"> </font>
<br><font size=2 color=blue face="Arial">Regards,</font>
<br><font size=2 color=blue face="Arial">Neil.</font>
<div align=center>
<br>
<hr></div>
<br><font size=2 face="Tahoma"><b>From:</b> xymon-bounces@xymon.com [</font><a href="mailto:xymon-bounces@xymon.com"><font size=2 face="Tahoma">mailto:xymon-bounces@xymon.com</font></a><font size=2 face="Tahoma">]
<b>On Behalf Of </b>McDonald, Dan<b><br>
Sent:</b> 22 September 2011 16:43<b><br>
To:</b> Xymon<b><br>
Subject:</b> Re: [Xymon] Regular expression</font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman"><br>
</font>
<p><font size=2 face="Times New Roman">On 9/22/11 7:54 AM, "Neil Simmonds"
<Neil.Simmonds@express-gifts.co.uk><br>
wrote:<br>
<br>
> Hi all,<br>
> <br>
> Iım trying to monitor a Windows event log for an error,<br>
> <br>
> Iıve got BBWin 0.12 installed in central mode and Iıve successfully
got the<br>
> eventlogs showing up in messages,<br>
> <br>
> However if I get an error from Backup Exec similar to this,<br>
> <br>
> error - 2011/09/22 13:30:00 - Backup Exec System Recovery (100) -
Error<br>
> EC8F17B7: Cannot create recovery points for job: BACKUP_SCHED_01_30_SAT.
Error<br>
> E7B70001: Win32/Win64 API DeviceIoControl(IOCTL_VSNAP_VDIFF_STOP)
failed.<br>
> Error EBAB03F1: The device does not recognize the command. Details:
0xE7B70001<br>
> Source: Backup Exec System Recovery<br>
> <br>
> Despite the fact that I have this, ³LOG eventlog:Application %(Backup
Exec<br>
> System Recovery\.+?|Error) COLOR=yellow² in my analysis.cfg file the
color<br>
> doesnıt change.<br>
<br>
Why did you escape the . ? If you remove the \ in front of the .,
it might<br>
work better.<br>
<br>
I don't think you need to specify greediness either.<br>
<br>
In other projects we tend to be very suspicious of unqualified .+<br>
expansions, as they can consume a lot of memory. You might try something<br>
like:<br>
%(Backup Exec System Recovery.{1,50}Error)<br>
<br>
That is read as "look for the exact words "Backup Exec System
Recovery",<br>
followed by the word "Error" no more than 50 characters later..."<br>
<br>
<br>
--<br>
Daniel J McDonald, CCIE # 2495, CISSP # 78281</font>
<p><font size=3><br>
Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE,
CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151.<br>
Express Gifts Limited is authorised and regulated by the Financial Services
Authority<br>
-------------<br>
NOTE: This email and any information contained within or attached in a
separate file is confidential and intended solely for the Individual to
whom it is addressed. The information or data included is solely for the
purpose indicated or previously agreed. Any information or data included
with this e-mail remains the property of Findel PLC and the recipient will
refrain from utilising the information for any purpose other than that
indicated and upon request will destroy the information and remove it from
their records. Any views or opinions presented are solely those of the
author and do not necessarily represent those of Findel PLC. If you are
not the intended recipient, be advised that you have received this email
in error and that any use, dissemination, forwarding, printing, or copying
of this email is strictly prohibited. No warranties or assurances are made
in relation to the safety and content of this e-mail and any attachments.
No liability is accepted for any consequences arising from it. Findel Plc
reserves the right to monitor all e-mail communications through its internal
and external networks. If you have received this email in error please
notify our IT helpdesk on +44(0) 1254 303030</font><tt><font size=2>_______________________________________________<br>
Xymon mailing list<br>
Xymon@xymon.com<br>
</font></tt><a href=http://lists.xymon.com/mailman/listinfo/xymon><tt><font size=2>http://lists.xymon.com/mailman/listinfo/xymon</font></tt></a><tt><font size=2><br>
_______________________________________________<br>
Xymon mailing list<br>
Xymon@xymon.com<br>
</font></tt><a href=http://lists.xymon.com/mailman/listinfo/xymon><tt><font size=2>http://lists.xymon.com/mailman/listinfo/xymon</font></tt></a><tt><font size=2><br>
</font></tt>
<p>