<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style>
<!--
@font-face
{font-family:Calibri}
@font-face
{font-family:Tahoma}
@font-face
{font-family:Consolas}
@font-face
{font-family:"Arial Narrow"}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline}
p
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black}
pre
{margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black}
span.HTMLPreformattedChar
{font-family:"Consolas","serif";
color:black}
span.EmailStyle20
{font-family:"Calibri","sans-serif";
color:#1F497D}
.MsoChpDefault
{font-size:10.0pt}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
div.WordSection1
{}
-->
</style>
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D">If the eventlog data being transmitted is too large to transmit until the clientlocal.cfg is sent back and populated in BBWin, then why not disable the eventlog
client in BBWin until it successfully sends 2-3 status messages? By that time the clientlocal.cfg will be populated on the client and you can enable the eventlog reader again and everything should work fine.
</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D"> </span></p>
<div>
<p class="MsoNormal"><b><span style="font-size:9.0pt; font-family:"Arial Narrow","sans-serif"">Scot Kreienkamp </span></b><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D">
</span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D"> </span></p>
<div style="border:none; border-left:solid blue 1.5pt; padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none; border-top:solid #B5C4DF 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt; font-family:"Tahoma","sans-serif"; color:windowtext">From:</span></b><span style="font-size:10.0pt; font-family:"Tahoma","sans-serif"; color:windowtext"> Xymon [mailto:xymon-bounces@xymon.com]
<b>On Behalf Of </b>David Baldwin<br>
<b>Sent:</b> Wednesday, July 10, 2013 4:19 AM<br>
<b>To:</b> Phil Crooker<br>
<b>Cc:</b> xymon@xymon.com<br>
<b>Subject:</b> Re: [Xymon] problem with receiving bbwin data</span></p>
</div>
</div>
<p class="MsoNormal"> </p>
<div>
<p class="MsoNormal">Phil,<br>
<br>
Just found a fix that works for me :)</p>
</div>
<blockquote style="margin-top:5.0pt; margin-bottom:5.0pt">
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper">
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper">
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"; background:white">I've been having difficulties setting up the bbwin client (ver 0.13 going to xymon 4.3.10 server) running on win7 sp1, 2008r2 and win2012 boxes in central mode. I've had
zero response from the bbwin-help forum for this, so please bear with me.</span><span style="font-family:"Calibri","sans-serif""></span></p>
</div>
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper">
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif""> </span></p>
</div>
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper">
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"; background:white">For background: I can't get the bbwin client to stop sending all the logs, it ignores any maxdata parameters I use. Eg:</span><span style="font-family:"Calibri","sans-serif""></span></p>
</div>
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper">
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif""> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif""> eventlog:system:1024</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif""> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"">It sends everything anyway. If I use log:system:1024, the bbwin client throws an error that it can't find the system log file. It does find the file without the maxdata parameter.</span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif""> </span></p>
</div>
</div>
</div>
</div>
</blockquote>
<p class="MsoNormal"><br>
One problem with the settings in client-local.cfg on the xymon server is that they only propagate to the client after a successful sending of a client message. The mechanics is that after the client message has been sent, BBWin does a shutdown on the write
socket and then reads from the read socket until EOF. If the write socket is never shutdown because the server breaks the connection due to flooding, then the client-local.cfg section will never be sent to the client.<br>
<br>
I've previously attempted to manually create C:\Program Files(x86)\BBWin\tmp\clientlocal.cfg to trick it, but with limited success. Just played around with it again - with client reporting to my primary server I just got it going - previously I was reporting
to 2 servers. The trick seems to be in having logfetch.status also created. I then modified my BBWin.cfg back to 2 servers and it broke again. Maybe the 2nd server is responding differently. It is undefined which server's clientlocal.cfg to believe anyway
:) Swapped the order of the servers around and it seems stable.<br>
<br>
If the server just discarded all the flooding data beyond MAXMSG_* and then returned the client config section anyway maybe it could be made to work, but there may be good reasons why that would not be sensible.
</p>
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper">
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper">
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"">This aside, I do need to get this working as I have to start monitoring 10 new windows servers and have<span style="background:white"> to monitor the event logs, so I can't just stop sending
them as has been suggested. Yes I could do some powershell scripts and send them via bbwincmd but the bbwin client is made for this task.....</span></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif""> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"">So, <span style="background:white">looking at this from the other side, the xymon server appears to be resetting the session after about 22MB of data has been sent (I know, this is ludicrous,
but it is windows). Nothing in the xymond logs (except for the occasional data flooding error ("1st line client", always)); on the client side it reports it can't send the data to the xymon server. </span></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif""> </span></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal">Depending on what auditting you have enabled, 22MB is very easy to achieve! Turn on Security event logging including success and failure and it's almost guaranteed :)<br>
<br>
David.<br>
<br>
</p>
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper">
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper">
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"; background:white">I've set the MAXMSG_* to quite silly levels:</span><span style="font-family:"Calibri","sans-serif""></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif""> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"; background:white"># ipcs</span><span style="font-family:"Calibri","sans-serif""></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"; background:white">------ Shared Memory Segments --------</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"; background:white">key shmid owner perms bytes nattch status </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"; background:white">0x01034be7 16908288 xymon 600 102400000 2 </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"; background:white">0x02034be7 16941057 xymon 600 102400000 2 </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"; background:white">0x03034be7 16973826 xymon 600 102400000 2 </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"; background:white">0x04034be7 17006595 xymon 600 102400000 2 </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"; background:white">0x05034be7 17039364 xymon 600 262144 1 </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"; background:white">0x06034be7 17072133 xymon 600 32768 1 </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"; background:white">0x07034be7 17104902 xymon 600 102400000 2 </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"; background:white">0x08034be7 17137671 xymon 600 102400000 2 </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"; background:white">0x09034be7 17170440 xymon 600 131072 1 </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"; background:white"> </span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"; background:white">Anything up to and including this size has no effect on the problem.</span><span style="font-family:"Calibri","sans-serif""></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif""> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"; background:white">Looking at the tcpdump stream, the bbwin client sends data normally with regular ACKs from xymond till around that 22MB mark then xymond responds with a FIN packet, then
with RST packets and the session shuts down. Nothing in the packets themselves indicate what the problem is.</span><span style="font-family:"Calibri","sans-serif""></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif""> </span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"; background:white">If anyone can help with this, please, it would be great.</span><span style="font-family:"Calibri","sans-serif""></span></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-family:"Calibri","sans-serif""> </span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-family:"Calibri","sans-serif"">thanks, Phil</span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"> </p>
<div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:8.0pt; font-family:"Arial","sans-serif"; color:gray">
<hr size="2" width="100%" align="center">
</span></div>
<p class="MsoNormal"><b><span style="font-size:8.0pt; font-family:"Arial","sans-serif"; color:gray">Please consider the environment before printing this e-mail</span></b><span style="font-size:8.0pt; font-family:"Arial","sans-serif"; color:gray"><br>
<br>
This message from ORIX Australia may contain confidential and/or privileged information. If you are not the intended recipient, any use, disclosure or copying of this message (or of any attachments to it) is not authorised. If you have received this message
in error, please notify the sender immediately and delete the message and any attachments from your system. Please inform the sender if you do not wish to receive further communications by email. ORIX handles personal information according to a Privacy Policy
that is consistent with the National Privacy Principles. Please let us know if you would like a copy.<br>
<br>
It is also available at <a href="http://www.orix.com.au">www.orix.com.au</a></span></p>
</div>
<p class="MsoNormal"><br>
<br>
<br>
</p>
<pre>_______________________________________________</pre>
<pre>Xymon mailing list</pre>
<pre><a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a></pre>
<pre><a href="http://lists.xymon.com/mailman/listinfo/xymon">http://lists.xymon.com/mailman/listinfo/xymon</a></pre>
<p class="MsoNormal"><br>
<br>
<br>
</p>
<pre>-- </pre>
<pre>David Baldwin - Senior Systems Administrator (Datacentres + Networks)</pre>
<pre>Information and Communication Technology Services</pre>
<pre>Australian Sports Commission <a href="http://ausport.gov.au">http://ausport.gov.au</a></pre>
<pre>Tel 02 62147830 Fax 02 62141830 PO Box 176 Belconnen ACT 2616</pre>
<pre><a href="mailto:david.baldwin@ausport.gov.au">david.baldwin@ausport.gov.au</a> Leverrier Street Bruce ACT 2617</pre>
<p class="MsoNormal"> </p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<p class="MsoNormal">Keep up to date with what's happening in Australian sport visit
<a href="http://www.ausport.gov.au">www.ausport.gov.au</a> <br>
<br>
<span style="font-size:7.5pt; font-family:"Arial","sans-serif"">This message is intended for the addressee named and may contain confidential and privileged information. If you are not the intended recipient please note that any form of distribution, copying
or use of this communication or the information in it is strictly prohibited and may be unlawful. If you receive this message in error, please delete it and notify the sender.</span>
</p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
</div>
</div>
<br>
<br>
<br>
This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, please note that you are strictly
prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number.
Thank you.
</body>
</html>