<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Phil,<br>
</div>
<blockquote
cite="mid:fb17d99777314c90866ddf4194b17269@vho64pw41.orix.com.au"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<style type="text/css" id="owaParaStyle" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<style>
<!--
@font-face
{font-family:Calibri}
@font-face
{font-family:Tahoma}
@font-face
{font-family:Consolas}
@font-face
{font-family:"Arial Narrow"}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline}
pre
{margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black}
span.HTMLPreformattedChar
{font-family:"Consolas","serif";
color:black}
span.EmailStyle20
{font-family:"Calibri","sans-serif";
color:#1F497D}
.MsoChpDefault
{font-size:10.0pt}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
-->
</style>
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper"
style="font-family:Calibri,Arial,Helvetica,sans-serif;
font-size:12pt; color:#000000; margin:0">
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper"
style="font-family:Calibri,Arial,Helvetica,sans-serif;
font-size:12pt; color:#000000; margin:0">
Thanks for the reply.</div>
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper"
style="font-family:Calibri,Arial,Helvetica,sans-serif;
font-size:12pt; color:#000000; margin:0">
<br>
</div>
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper"
style="font-family:Calibri,Arial,Helvetica,sans-serif;
font-size:12pt; color:#000000; margin:0">
Before continuing, what is supposed to be in logfetch.status?
and in clientversion.cfg?<br>
</div>
</div>
</blockquote>
logfetch.status will possibly only exist if you are checking any
regular logfiles - e.g. if client-local.cfg contains something like:<br>
<br>
[win32]<br>
log:c:\WINDOWS\WindowsUpdate.log:20480<br>
<br>
clientlocal.cfg will contain the relevant section similar to your 4
line example below. clientversion.cfg doesn't exist on my systems<br>
<br>
As BBWin runs, check the size of clientlocal.cfg - if it gets wiped,
try saving the contents back again. Also, updating BBWin.cfg should
cause BBWin to run immediately without restarting the service. I
haven't played around with commenting out msgs.dll<br>
<br>
David.<br>
<br>
<blockquote
cite="mid:fb17d99777314c90866ddf4194b17269@vho64pw41.orix.com.au"
type="cite">
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper"
style="font-family:Calibri,Arial,Helvetica,sans-serif;
font-size:12pt; color:#000000; margin:0">
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper"
style="font-family:Calibri,Arial,Helvetica,sans-serif;
font-size:12pt; color:#000000; margin:0">
<div>So, I have one server with the msgs.dll out of the
config. It has been running for many days with the client
updating fine. I redid the xymon client-local.cfg, stopped
bbwin, deleted \tmp\clientlocal.cfg and restarted it (as it
wouldn't update), the \tmp\clientlocal.cfg now reads what
the client-local has:</div>
<div><br>
</div>
<div><span style="font-size:12pt"> </span><span
style="font-size:12pt">eventlog:application:1024</span></div>
<div>
<div> ignore BigBrotherXymonClient</div>
<div> eventlog:system:1025</div>
<div> eventlog:security:10240</div>
</div>
<div><br>
</div>
<div>I let that run a cycle, it still updates OK. I then put
in the msgs.dll statement in BBWin.cfg; that registers and
BBWin.log shows:</div>
<div><br>
</div>
<div>
<div>2013/07/11 10:42:55 [DEBUG]: [bbwinupdate]: can't open
C:\Program Files (x86)\BBWin\etc\clientversion.cfg : The
system cannot find the file specified.</div>
<div>2013/07/11 10:42:55 [DEBUG]: [cpu]: cpu review started</div>
<div>2013/07/11 10:42:55 [DEBUG]: [cpu]: cpu review ended</div>
<div>2013/07/11 10:42:55 [DEBUG]: [disk]: drive string A:\</div>
<div>2013/07/11 10:42:55 [DEBUG]: [disk]: drive string C:\</div>
<div>2013/07/11 10:42:55 [DEBUG]: [disk]: drive string D:\</div>
<div>2013/07/11 10:42:55 [DEBUG]: [disk]: drive string E:\</div>
<div>2013/07/11 10:42:55 [DEBUG]: [filesystem]: start
AgentFileSystem::InitCentralMode</div>
</div>
<div>
<div>2013/07/11 10:42:55 [DEBUG]: [filesystem]: checking
file C:\Program Files (x86)\BBWin\tmp\clientlocal.cfg</div>
<div>2013/07/11 10:42:55 [DEBUG]: [filesystem]: reading file
C:\Program Files (x86)\BBWin\tmp\clientlocal.cfg</div>
<div>2013/07/11 10:42:55 [DEBUG]: [msgs]: start
AgentMsgs::InitCentralMode</div>
<div>2013/07/11 10:42:55 [DEBUG]: [msgs]: checking file
C:\Program Files (x86)\BBWin\tmp\clientlocal.cfg</div>
<div>2013/07/11 10:42:55 [DEBUG]: [msgs]: reading file
C:\Program Files (x86)\BBWin\tmp\clientlocal.cfg</div>
<div>2013/07/11 10:42:55 [DEBUG]: [msgs]: will use maxdata
size : 1024</div>
<div>2013/07/11 10:42:55 [DEBUG]: [msgs]: will ignore :
BigBrotherXymonClient</div>
<div>2013/07/11 10:42:55 [DEBUG]: [msgs]: will use maxdata
size : 1025</div>
<div>2013/07/11 10:42:55 [DEBUG]: [msgs]: will use maxdata
size : 10240</div>
<div><br>
</div>
</div>
<div>and no more updates. The .\tmp\msgs.hostname.txt file is
88MB. </div>
<div><br>
</div>
<div>thanks, Phil</div>
<div><br>
<div style="color:rgb(40,40,40)">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font
style="font-size:11pt" color="#000000" face="Calibri,
sans-serif"><b>From:</b> Scot Kreienkamp<br>
<b>Sent:</b> Wednesday, 10 July 2013 10:19 PM<br>
<b>To:</b> David Baldwin; Phil Crooker<br>
<b>Cc:</b> <a class="moz-txt-link-abbreviated" href="mailto:xymon@xymon.com">xymon@xymon.com</a><br>
<b>Subject:</b> RE: [Xymon] problem with receiving
bbwin data</font>
<div> </div>
</div>
<div>
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:#1F497D">If the eventlog data being
transmitted is too large to transmit until the
clientlocal.cfg is sent back and populated in
BBWin, then why not disable the eventlog client in
BBWin until it successfully sends 2-3 status
messages? By that time the clientlocal.cfg will
be populated on the client and you can enable the
eventlog reader again and everything should work
fine.
</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:#1F497D"> </span></p>
<div>
<p class="MsoNormal"><b><span
style="font-size:9.0pt;
font-family:"Arial
Narrow","sans-serif"">Scot
Kreienkamp </span></b><span
style="font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:#1F497D">
</span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:#1F497D"> </span></p>
<div style="border:none; border-left:solid blue 1.5pt;
padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none; border-top:solid #B5C4DF
1.0pt; padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span
style="font-size:10.0pt;
font-family:"Tahoma","sans-serif";
color:windowtext">From:</span></b><span
style="font-size:10.0pt;
font-family:"Tahoma","sans-serif";
color:windowtext"> Xymon
[<a class="moz-txt-link-freetext" href="mailto:xymon-bounces@xymon.com">mailto:xymon-bounces@xymon.com</a>]
<b>On Behalf Of </b>David Baldwin<br>
<b>Sent:</b> Wednesday, July 10, 2013 4:19
AM<br>
<b>To:</b> Phil Crooker<br>
<b>Cc:</b> <a class="moz-txt-link-abbreviated" href="mailto:xymon@xymon.com">xymon@xymon.com</a><br>
<b>Subject:</b> Re: [Xymon] problem with
receiving bbwin data</span></p>
</div>
</div>
<p class="MsoNormal"> </p>
<div>
<p class="MsoNormal">Phil,<br>
<br>
Just found a fix that works for me :)</p>
</div>
<blockquote style="margin-top:5.0pt;
margin-bottom:5.0pt">
<div name="divtagdefaultwrapper"
id="divtagdefaultwrapper">
<div name="divtagdefaultwrapper"
id="divtagdefaultwrapper">
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif";
background:white">I've been having
difficulties setting up the bbwin client
(ver 0.13 going to xymon 4.3.10 server)
running on win7 sp1, 2008r2 and win2012
boxes in central mode. I've had zero
response from the bbwin-help forum for
this, so please bear with me.</span><span
style="font-family:"Calibri","sans-serif""></span></p>
</div>
<div name="divtagdefaultwrapper"
id="divtagdefaultwrapper">
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif""> </span></p>
</div>
<div name="divtagdefaultwrapper"
id="divtagdefaultwrapper">
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif";
background:white">For background: I can't
get the bbwin client to stop sending all
the logs, it ignores any maxdata
parameters I use. Eg:</span><span
style="font-family:"Calibri","sans-serif""></span></p>
</div>
<div name="divtagdefaultwrapper"
id="divtagdefaultwrapper">
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif""> </span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif"">
eventlog:system:1024</span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif""> </span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif"">It
sends everything anyway. If I use
log:system:1024, the bbwin client throws
an error that it can't find the system
log file. It does find the file without
the maxdata parameter.</span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif""> </span></p>
</div>
</div>
</div>
</div>
</blockquote>
<p class="MsoNormal"><br>
One problem with the settings in client-local.cfg
on the xymon server is that they only propagate to
the client after a successful sending of a client
message. The mechanics is that after the client
message has been sent, BBWin does a shutdown on
the write socket and then reads from the read
socket until EOF. If the write socket is never
shutdown because the server breaks the connection
due to flooding, then the client-local.cfg section
will never be sent to the client.<br>
<br>
I've previously attempted to manually create
C:\Program Files(x86)\BBWin\tmp\clientlocal.cfg to
trick it, but with limited success. Just played
around with it again - with client reporting to my
primary server I just got it going - previously I
was reporting to 2 servers. The trick seems to be
in having logfetch.status also created. I then
modified my BBWin.cfg back to 2 servers and it
broke again. Maybe the 2nd server is responding
differently. It is undefined which server's
clientlocal.cfg to believe anyway :) Swapped the
order of the servers around and it seems stable.<br>
<br>
If the server just discarded all the flooding data
beyond MAXMSG_* and then returned the client
config section anyway maybe it could be made to
work, but there may be good reasons why that would
not be sensible.
</p>
<div name="divtagdefaultwrapper"
id="divtagdefaultwrapper">
<div name="divtagdefaultwrapper"
id="divtagdefaultwrapper">
<div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif"">This
aside, I do need to get this working as
I have to start monitoring 10 new
windows servers and have<span
style="background:white"> to monitor
the event logs, so I can't just stop
sending them as has been suggested.
Yes I could do some powershell scripts
and send them via bbwincmd but the
bbwin client is made for this
task.....</span></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif""> </span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif"">So, <span
style="background:white">looking at
this from the other side, the xymon
server appears to be resetting the
session after about 22MB of data has
been sent (I know, this is ludicrous,
but it is windows). Nothing in the
xymond logs (except for the occasional
data flooding error ("1st line
client", always)); on the client side
it reports it can't send the data to
the xymon server. </span></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif""> </span></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal">Depending on what auditting you
have enabled, 22MB is very easy to achieve! Turn
on Security event logging including success and
failure and it's almost guaranteed :)<br>
<br>
David.<br>
<br>
</p>
<div name="divtagdefaultwrapper"
id="divtagdefaultwrapper">
<div name="divtagdefaultwrapper"
id="divtagdefaultwrapper">
<div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif";
background:white">I've set the MAXMSG_*
to quite silly levels:</span><span
style="font-family:"Calibri","sans-serif""></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif""> </span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif";
background:white"># ipcs</span><span
style="font-family:"Calibri","sans-serif""></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif";
background:white">------ Shared Memory
Segments --------</span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif";
background:white">key
shmid owner perms
bytes nattch status </span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif";
background:white">0x01034be7 16908288
xymon 600 102400000 2
</span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif";
background:white">0x02034be7 16941057
xymon 600 102400000 2
</span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif";
background:white">0x03034be7 16973826
xymon 600 102400000 2
</span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif";
background:white">0x04034be7 17006595
xymon 600 102400000 2
</span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif";
background:white">0x05034be7 17039364
xymon 600 262144 1
</span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif";
background:white">0x06034be7 17072133
xymon 600 32768 1
</span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif";
background:white">0x07034be7 17104902
xymon 600 102400000 2
</span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif";
background:white">0x08034be7 17137671
xymon 600 102400000 2
</span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif";
background:white">0x09034be7 17170440
xymon 600 131072 1
</span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif";
background:white"> </span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif";
background:white">Anything up to and
including this size has no effect on the
problem.</span><span
style="font-family:"Calibri","sans-serif""></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif""> </span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif";
background:white">Looking at the tcpdump
stream, the bbwin client sends data
normally with regular ACKs from xymond
till around that 22MB mark then xymond
responds with a FIN packet, then with
RST packets and the session shuts down.
Nothing in the packets themselves
indicate what the problem is.</span><span
style="font-family:"Calibri","sans-serif""></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif""> </span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span
style="font-family:"Calibri","sans-serif";
background:white">If anyone can help
with this, please, it would be great.</span><span
style="font-family:"Calibri","sans-serif""></span></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"
style="background:white"><span
style="font-family:"Calibri","sans-serif""> </span></p>
</div>
<div>
<p class="MsoNormal"
style="background:white"><span
style="font-family:"Calibri","sans-serif"">thanks,
Phil</span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"> </p>
<div>
<div class="MsoNormal" style="text-align:center"
align="center"><span style="font-size:8.0pt;
font-family:"Arial","sans-serif";
color:gray">
<hr align="center" size="2" width="100%">
</span></div>
<p class="MsoNormal"><b><span
style="font-size:8.0pt;
font-family:"Arial","sans-serif";
color:gray">Please consider the environment
before printing this e-mail</span></b><span
style="font-size:8.0pt;
font-family:"Arial","sans-serif";
color:gray"><br>
<br>
This message from ORIX Australia may contain
confidential and/or privileged information. If
you are not the intended recipient, any use,
disclosure or copying of this message (or of
any attachments to it) is not authorised. If
you have received this message in error,
please notify the sender immediately and
delete the message and any attachments from
your system. Please inform the sender if you
do not wish to receive further communications
by email. ORIX handles personal information
according to a Privacy Policy that is
consistent with the National Privacy
Principles. Please let us know if you would
like a copy.<br>
<br>
It is also available at <a
moz-do-not-send="true"
href="http://www.orix.com.au">www.orix.com.au</a></span></p>
</div>
<p class="MsoNormal"><br>
<br>
<br>
</p>
<pre>_______________________________________________</pre>
<pre>Xymon mailing list</pre>
<pre><a moz-do-not-send="true" href="mailto:Xymon@xymon.com">Xymon@xymon.com</a></pre>
<pre><a moz-do-not-send="true" href="http://lists.xymon.com/mailman/listinfo/xymon">http://lists.xymon.com/mailman/listinfo/xymon</a></pre>
<p class="MsoNormal"><br>
<br>
<br>
</p>
<pre>-- </pre>
<pre>David Baldwin - Senior Systems Administrator (Datacentres + Networks)</pre>
<pre>Information and Communication Technology Services</pre>
<pre>Australian Sports Commission <a moz-do-not-send="true" href="http://ausport.gov.au">http://ausport.gov.au</a></pre>
<pre>Tel 02 62147830 Fax 02 62141830 PO Box 176 Belconnen ACT 2616</pre>
<pre><a moz-do-not-send="true" href="mailto:david.baldwin@ausport.gov.au">david.baldwin@ausport.gov.au</a> Leverrier Street Bruce ACT 2617</pre>
<p class="MsoNormal"> </p>
<div class="MsoNormal" style="text-align:center"
align="center">
<hr align="center" size="2" width="100%">
</div>
<p class="MsoNormal">Keep up to date with what's
happening in Australian sport visit
<a moz-do-not-send="true"
href="http://www.ausport.gov.au">www.ausport.gov.au</a>
<br>
<br>
<span style="font-size:7.5pt;
font-family:"Arial","sans-serif"">This
message is intended for the addressee named and
may contain confidential and privileged
information. If you are not the intended
recipient please note that any form of
distribution, copying or use of this
communication or the information in it is
strictly prohibited and may be unlawful. If you
receive this message in error, please delete it
and notify the sender.</span>
</p>
<div class="MsoNormal" style="text-align:center"
align="center">
<hr align="center" size="2" width="100%">
</div>
</div>
</div>
<br>
<br>
<br>
This message is intended only for the individual or
entity to which it is addressed. It may contain
privileged, confidential information which is exempt
from disclosure under applicable laws. If you are not
the intended recipient, please note that you are
strictly prohibited from disseminating or distributing
this information (other than to the intended recipient)
or copying this information. If you have received this
communication in error, please notify us immediately by
e-mail or by telephone at the above number. Thank you. </div>
</div>
</div>
</div>
</div>
<br>
<div style="font-size:8pt; font-family:'Arial',sans-serif;
color:gray">
<hr>
<b>Please consider the environment before printing this e-mail</b><br>
<br>
This message from ORIX Australia may contain confidential and/or
privileged information. If you are not the intended recipient,
any use, disclosure or copying of this message (or of any
attachments to it) is not authorised. If you have received this
message in error, please notify the sender immediately and
delete the message and any attachments from your system. Please
inform the sender if you do not wish to receive further
communications by email. ORIX handles personal information
according to a Privacy Policy that is consistent with the
National Privacy Principles. Please let us know if you would
like a copy.<br>
<br>
It is also available at <a moz-do-not-send="true"
href="http://www.orix.com.au">www.orix.com.au</a></div>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
David Baldwin - Senior Systems Administrator (Datacentres + Networks)
Information and Communication Technology Services
Australian Sports Commission <a class="moz-txt-link-freetext" href="http://ausport.gov.au">http://ausport.gov.au</a>
Tel 02 62147830 Fax 02 62141830 PO Box 176 Belconnen ACT 2616
<a class="moz-txt-link-abbreviated" href="mailto:david.baldwin@ausport.gov.au">david.baldwin@ausport.gov.au</a> Leverrier Street Bruce ACT 2617
</pre>
</body>
</html>