<HTML><BODY>
I've got BBWin 0.13 successfully running on Windows 2008r2 machines in<BR>
central mode.<BR>
<BR>
I've actually had the problem you describe on some 2003 servers as well<BR>
(usually on Domain Controllers)<BR>
<BR>
The way I got round it was to comment out in the BBWin.cfg file, the<BR>
msgs.dll line, like this,<BR>
<BR>
<!--load name="msgs" value="msgs.dll" --><BR>
<BR>
This prevents it collecting any log data. Also if you add a CLASS:win32<BR>
to your hosts in hosts.cfg on the server you will find that it will pick<BR>
up the right lines from client-local.cfg<BR>
<BR>
The bit I haven't had chance to try yet (as we're not bothered about<BR>
collecting event log messages from the servers where I have the issue)<BR>
is setting up all the necessary exclusions in the client-local.cfg file<BR>
and then switching the msgs.dll line back in.<BR>
<BR>
If you've got the right exclusions in then this should work as the BBWin<BR>
agent will have created the clientlocal.cfg file on the windows server. <BR>
<BR>
Try looking at the 67Mb file that you get in the tmp directory and I'm<BR>
sure you'll find that the majority if it is event log entries and you<BR>
should be able to work out a decent set of exclusions to remove most of<BR>
the unneeded messages.<BR>
<BR>
As an example, this is part of my client-local.cfg for a windows server<BR>
security event log. I find the security one is the one that often has<BR>
floods of messages in.<BR>
<BR>
eventlog:security<BR>
ignore Successful Network Logon<BR>
ignore User Logoff<BR>
ignore Microsoft-Windows-Security-Auditing<BR>
ignore success<BR>
ignore Logon attempt by<BR>
ignore Authentication Ticket Request<BR>
ignore Service Ticket Request<BR>
ignore Logon attempt using<BR>
ignore Special privileges assigned to new logon<BR>
ignore Handle Closed<BR>
ignore Object Open<BR>
ignore Pre-authentication failed<BR>
ignore An account was logged off<BR>
ignore Special privileges assigned to new logon<BR>
ignore The description for Event ID<BR>
<BR>
Regards,<BR>
Neil Simmonds<BR>
<BR>
-----Original Message-----<BR>
From: <a href="mailto:xymon-bounces@xymon.com">xymon-bounces@xymon.com</a> [mailto:xymon-bounces@xymon.com] On Behalf <BR>
Of Andersson Tomas<BR>
Sent: 01 October 2012 14:42<BR>
To: <a href="mailto:xymon@xymon.com">xymon@xymon.com</a> <BR>
Subject: [Xymon] getting xymon to work with win2008r2 clents in<BR>
centralmode<BR>
<BR>
Hi there !<BR>
Has anybody got xymon to function properly with windows 2008r2 clients<BR>
in central mode ??<BR>
I get it to function properly using local mode but I want to use central<BR>
mode usinf the latest BBwin 0.13.<BR>
<BR>
When we tried to specify central mode we found that there was some<BR>
problem for the BBWin to create the logfile to be sent to the xymon<BR>
server<BR>
Apparently since the bbwin was installed in the ...Program files (x86)<BR>
folder and after quoting the Path parameter in the bbwin config file<BR>
It suddenly started creating a huge 67 MB ! file to send (included all<BR>
event error and application logs ...).<BR>
<BR>
So we then configured the client-local.cfg on the xymon server to try to<BR>
ignore those.<BR>
Unfortunately the xymon server did not send the client-local.cfg to the<BR>
client.<BR>
<BR>
Qestions:<BR>
the file client-local.cfg on the server where you specify what log files<BR>
should be sent back to the server and what text matching you want<BR>
the syntax is like:<BR>
<BR>
[win32]<BR>
eventlog:Security:10240<BR>
ignore Success<BR>
eventlog:System:10240<BR>
ignore Information<BR>
eventlog:Application:10240<BR>
ignore Information<BR>
<BR>
[freebsd]<BR>
log:/var/log/messages:10240<BR>
<BR>
[netbsd]<BR>
log:/var/log/messages:10240<BR>
...<BR>
<BR>
The OS-name whithin brackets [ ] is this name win32 for windows 2008r2<BR>
also or should this "OS-name" (uname on all unixlike machines) be<BR>
specified to something else like win64 on windows 2008r2 machines or ??<BR>
Is there a command that xymon uses to figure out the os type on windows<BR>
server or how does this function ??<BR>
<BR>
Is it possible to specify [] or [*] as a default entry in the<BR>
client-local.cfg on the xymon server ???<BR>
<BR>
<BR>
<BR>
<BR>
Best Regards,<BR>
/Tomas Andersson<BR>
<BR>
Unix System Admin/Tech/Dev<BR>
SCA IT Services<BR>
<BR>
Tel. +46 31 7460313<BR>
Mob. +46 703 610313<BR>
<BR>
<BR>
<BR>
This message may contain confidential, proprietary or legally<BR>
privileged information and is intended for the addressee's use<BR>
only. Any usage, disclosure, distribution, print or copying of<BR>
any part of this message is prohibited unless you are the<BR>
intended recipient. If you receive this message in error,<BR>
please delete it from any computer and notify the sender. If<BR>
you suspect that this message may have been altered, please<BR>
notify the sender. SCA has taken every reasonable precaution<BR>
to ensure that this e-mail and any attachments to this e-mail<BR>
has been scanned for viruses. However, SCA does not accept<BR>
liability for any damage caused by software viruses brought to<BR>
you by this mail.<BR>
_______________________________________________<BR>
Xymon mailing list<BR>
<a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a> <BR>
<a href="http://lists.xymon.com/mailman/listinfo/xymon" target="_blank">http://lists.xymon.com/mailman/listinfo/xymon</a> <BR>
<span style='mso-ascii-font-family:Calibri;mso-hansi-font-family:Calibri;mso-bidi-font-family:
Calibri;color:black'></span></p>
<p class=MsoNormal><span style='font-size:9.0pt'>Name & Registered Office:
EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company
No. 00718151.</span></p>
<p class=MsoNormal style='border:none;mso-border-bottom-alt:solid windowtext 1.5pt;
padding:0cm;mso-padding-alt:0cm 0cm 1.0pt 0cm'><span style='font-size:9.0pt'>Express
Gifts Limited is authorised and regulated by the Financial Services Authority</span></p>
<hr width="100%">
<p class=MsoNormal><span style='font-size:9.0pt'>NOTE: This email and any
information contained within or attached in a separate file is confidential and
intended solely for the Individual to whom it is addressed. The information or
data included is solely for the purpose indicated or previously agreed. Any
information or data included with this e-mail remains the property of Findel
PLC and the recipient will refrain from utilising the information for any
purpose other than that indicated and upon request will destroy the information
and remove it from their records. Any views or opinions presented are solely
those of the author and do not necessarily represent those of Findel PLC. If
you are not the intended recipient, be advised that you have received this
email in error and that any use, dissemination, forwarding, printing, or
copying of this email is strictly prohibited. No warranties or assurances are
made in relation to the safety and content of this e-mail and any attachments.
No liability is accepted for any consequences arising from it. Findel Plc
reserves the right to monitor all e-mail communications through its internal
and external networks. If you have received this email in error please notify
our IT helpdesk on +44(0) 1254 303030<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:9.0pt'><o:p> </o:p></span></p>
</BODY></HTML>