<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="blue" vlink="purple">
<!--ppd46--><!--ppd54--><!--ppd50--><!--ppd55--><!--ppd48-->
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I’m not a C++ programmer, but if I’m reading the code correctly then the maxdata parameter is ignored in the eventlog scanning function (AgentMsgs::Run in
msgs.cpp), and also in Session::Execute in EventLog.cpp<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Note it’s a big if, and I’d be happier if someone with C++ experience could give a more reliable assessment.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><br>
Carl<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div><span id="ppe_48">
<div style="WIDTH: 375px"><br>
<font face="Calibri">Carl Inglis </font> <font size="2" face="Calibri"><b><br>
Systems Administrator</b><br>
<br>
<b>Rakon UK Limited</b><br>
</font><font size="1" face="Calibri">Dowsett House, Sadler Road, Lincoln LN6 3RS, United Kingdom<br>
Tel: +44 (0)1522 812630 | Fax: +44 (0) 1522 812664 | Mob: +44 (0) 7786 552915</font><br>
<font color="#34b233" size="1" face="Calibri">Carl.Inglis@rakon.com | www.rakon.com</font></div>
</span><span id="ppe_55">
<div style="TEXT-ALIGN: left; WIDTH: 100px"><br>
<img style="MARGIN: 0px" border="0" alt="The Queens Awards for Enterprise 2012" src="cid:db1f5eb7b67244429894f5042bbb3ad5">
</div>
</span><span id="ppe_50">
<div style="WIDTH: 375px"><br>
<img style="MARGIN: 0px" border="0" alt="Rakon Logo" src="cid:91ab61d584b748ba95ef9184d951b1da"></div>
</span><span id="ppe_54">
<div style="WIDTH: 375px"><font size="1" face="Calibri"><br>
This message together with any attachments contains confidential information and may be<br>
subject to privilege. If you are not the intended recipient you may not distribute it in any<br>
way, you must notify the sender immediately and delete any copies of the message along<br>
with its attachments.</font></div>
</span><span id="ppe_46">
<div style="WIDTH: 375px"><font size="1" face="Verdana"><br>
<em>Rakon UK Ltd is a limited company registered in England and Wales. <br>
Registered Office: Dowsett House, Sadler Road, Lincoln LN6 3RS <br>
Company Registration Number: 5128090. <br>
<br>
Please be aware that Rakon UK Limited may monitor email traffic data<br>
including the date, time, subject line, sender and recipients for the <br>
purposes of security and usage monitoring. Automated monitoring <br>
systems may also be applied to ascertain whether incoming/outgoing <br>
emails are likely to contain viruses, other destructive devices or <br>
inappropriate content. </em></font></div>
</span>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Xymon [mailto:xymon-bounces@xymon.com]
<b>On Behalf Of </b>Phil Crooker<br>
<b>Sent:</b> 10 July 2013 07:24<br>
<b>To:</b> xymon@xymon.com<br>
<b>Subject:</b> [Xymon] problem with receiving bbwin data<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper">
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper">
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black;background:white">I've been having difficulties setting up the bbwin client (ver 0.13 going to xymon 4.3.10 server) running on win7 sp1, 2008r2 and win2012 boxes in central mode. I've
had zero response from the bbwin-help forum for this, so please bear with me.</span><span style="font-family:"Calibri","sans-serif";color:black"><o:p></o:p></span></p>
</div>
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper">
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper">
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black;background:white">For background: I can't get the bbwin client to stop sending all the logs, it ignores any maxdata parameters I use. Eg:</span><span style="font-family:"Calibri","sans-serif";color:black"><o:p></o:p></span></p>
</div>
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper">
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"> eventlog:system:1024<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">It sends everything anyway. If I use log:system:1024, the bbwin client throws an error that it can't find the system log file. It does find the file without the maxdata parameter.<o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">This aside, I do need to get this working as I have to start monitoring 10 new windows servers and have<span style="background:white"> to monitor the event logs, so I can't just
stop sending them as has been suggested. Yes I could do some powershell scripts and send them via bbwincmd but the bbwin client is made for this task.....</span><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">So, <span style="background:white">looking at this from the other side, the xymon server appears to be resetting the session after about 22MB of data has been sent (I know, this
is ludicrous, but it is windows). Nothing in the xymond logs (except for the occasional data flooding error ("1st line client", always)); on the client side it reports it can't send the data to the xymon server. </span><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black;background:white">I've set the MAXMSG_* to quite silly levels:</span><span style="font-family:"Calibri","sans-serif";color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black;background:white"># ipcs</span><span style="font-family:"Calibri","sans-serif";color:black"><o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black;background:white">------ Shared Memory Segments --------<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black;background:white">key shmid owner perms bytes nattch status <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black;background:white">0x01034be7 16908288 xymon 600 102400000 2 <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black;background:white">0x02034be7 16941057 xymon 600 102400000 2 <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black;background:white">0x03034be7 16973826 xymon 600 102400000 2 <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black;background:white">0x04034be7 17006595 xymon 600 102400000 2 <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black;background:white">0x05034be7 17039364 xymon 600 262144 1 <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black;background:white">0x06034be7 17072133 xymon 600 32768 1 <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black;background:white">0x07034be7 17104902 xymon 600 102400000 2 <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black;background:white">0x08034be7 17137671 xymon 600 102400000 2 <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black;background:white">0x09034be7 17170440 xymon 600 131072 1 <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black;background:white"><o:p> </o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black;background:white">Anything up to and including this size has no effect on the problem.</span><span style="font-family:"Calibri","sans-serif";color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black;background:white">Looking at the tcpdump stream, the bbwin client sends data normally with regular ACKs from xymond till around that 22MB mark then xymond responds with a FIN packet,
then with RST packets and the session shuts down. Nothing in the packets themselves indicate what the problem is.</span><span style="font-family:"Calibri","sans-serif";color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black;background:white">If anyone can help with this, please, it would be great.</span><span style="font-family:"Calibri","sans-serif";color:black"><o:p></o:p></span></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-family:"Calibri","sans-serif";color:black">thanks, Phil<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray">
<hr size="2" width="100%" align="center">
</span></div>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray">Please consider the environment before printing this e-mail</span></b><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray"><br>
<br>
This message from ORIX Australia may contain confidential and/or privileged information. If you are not the intended recipient, any use, disclosure or copying of this message (or of any attachments to it) is not authorised. If you have received this message
in error, please notify the sender immediately and delete the message and any attachments from your system. Please inform the sender if you do not wish to receive further communications by email. ORIX handles personal information according to a Privacy Policy
that is consistent with the National Privacy Principles. Please let us know if you would like a copy.<br>
<br>
It is also available at <a href="http://www.orix.com.au">www.orix.com.au</a><o:p></o:p></span></p>
</div>
</div>
</body>
</html>