<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">I’m running xymon 4.3.10 and have a problem with a log event not being handled correctly. It is unclear whether this is a bbwin client issue or in xymond (perhaps both). The event:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In the windows eventlog:<o:p></o:p></p>
<p class="MsoNormal">Cmdlet failed. Cmdlet GetUserPhoto, parameters {Identity=username@domain}.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">As sent to xymond by the bbwin client:<o:p></o:p></p>
<p class="MsoNormal">error - 2013/08/26 11:19:57 - MSExchange CmdletLogs (6) - Cmdlet failed. Cmdlet %1, parameters %2.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve setup the following rule to ‘downgrade’ this basically meaningless windows event, with the catchall rule under it for the (remaining) errors that I do want to monitor:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> LOG %.* %Cmdlet.failed..Cmdlet COLOR=yellow<o:p></o:p></p>
<p class="MsoNormal"> LOG %.* %^error COLOR=red<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This entry still comes in as a red error:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">red Critical entries in eventlog_msexchange management<o:p></o:p></p>
<p class="MsoNormal">yellow error - 2013/08/26 11:19:57 - MSExchange CmdletLogs (6) - Cmdlet failed. Cmdlet %1, parameters %2.<o:p></o:p></p>
<p class="MsoNormal">yellow error - 2013/08/26 11:17:26 - MSExchange CmdletLogs (6) - Cmdlet failed. Cmdlet %1, parameters %2.<o:p></o:p></p>
<p class="MsoNormal">red error - 2013/08/26 11:19:57 - MSExchange CmdletLogs (6) - Cmdlet failed. Cmdlet %1, parameters %2.<o:p></o:p></p>
<p class="MsoNormal">red error - 2013/08/26 11:17:26 - MSExchange CmdletLogs (6) - Cmdlet failed. Cmdlet %1, parameters %2.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Looking at the windows event viewer, there is only one event for each of these times, so it is somehow being duplicated. Capturing the traffic shows it is not duplicated ‘on the wire’. Using the xymon xymondlog command shows it is duplicated.
If I remove the Cmdlet rule from analysis.cfg, it is not duplicated. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This doesn’t happen to all messages but to some, I haven’t worked out what the commonality is -- perhaps the message string itself is affecting the parsing…. The only way I’ve been able to stop this is to IGNORE the entry which I don’t
really want to entirely.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Can anyone help, please?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks, Phil<o:p></o:p></p>
</div>
</body>
</html>