<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!-- p { margin-top: 0px; margin-bottom: 0px; } .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left-color: rgb(128, 0, 0); border-left-width: 2px; border-left-style: solid; }--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Yes Windows event logs are quite verbose but completely ignoring them is rather extreme!<br>
</p>
<p><span style="font-size:12pt">I</span><span style="font-size:12pt"> don't think you can use wildcards for log filenames. </span><br>
</p>
<p><br>
</p>
<p><strong>client-local.cfg:</strong><br>
</p>
<p><span style="font-size:9pt"><span style="font-family:Consolas,monospace">[myhost]</span><br style="font-family:Consolas,monospace">
</span></p>
<div><span style="font-family:Consolas,monospace; font-size:9pt">eventlog:application:10240</span></div>
<div><span style="font-family:Consolas,monospace; font-size:9pt">ignore .*</span><br>
</div>
<div><span style="font-family:Consolas,monospace; font-size:9pt">eventlog:security:10240<br>
</span></div>
<div><span style="font-family:Consolas,monospace; font-size:9pt">ignore The Remote Desktop license server cannot update the license attributes<br>
</span></div>
<p><br>
</p>
<p>will tell the myhost BBWin client to completely ignore the application event log (nothing will be sent to the Xymon server). Similarly, lines with "The Remote Desktop license server cannot update the license attributes" of the security event log won't be
sent. <br>
</p>
<p>Note that the ignore pattern can only match text of the last field as displayed by the Xymon msgs column <br>
</p>
<p><br>
</p>
<p><span style="font-family:Consolas,monospace; font-size:9pt">warning - 2016/01/20 09:48:25 - TermServLicensing (4105) - The Remote Desktop license server cannot update the license attributes for user...</span><br>
</p>
<p><br>
</p>
<p><strong>analysis.cfg:</strong><br>
</p>
<p> <span style="font-family:Consolas,monospace; font-size:9pt">LOG eventlog_system %(?-i)^error IGNORE=%(?-i)NETLOGON\s\(5789\)</span><br>
</p>
<p><br>
</p>
<p>will set the color to red (default if omitted) when "error" pattern appears at the beginning of a line in system event log except for lines with "NETLOGON (5789)".
<br>
</p>
<p><br>
</p>
<p> <span style="font-family:Consolas,monospace; font-size:9pt">LOG eventlog_system %(?-i)^failure|^warning.* IGNORE=%(?-i)DCOM\s\(10009\) COLOR=yellow</span><br>
</p>
<p><br>
</p>
<p>Same for warning messages (yellow) with exception for lines with "DCOM (10009)"<br>
</p>
<p><br>
</p>
<p><br>
</p>
<p>Dominique Frise - UNIL<br>
</p>
<p><br>
</p>
<div style="color:rgb(33,33,33)">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>De :</b> Xymon <xymon-bounces@xymon.com> de la part de Rebman,Scott (HHSC Contractor) <Scott.Rebman@hhsc.state.tx.us><br>
<b>Envoyé :</b> mercredi 20 janvier 2016 14:48<br>
<b>À :</b> xymon@xymon.com<br>
<b>Objet :</b> [Xymon] xymon msgs column</font>
<div> </div>
</div>
<div><font face="Calibri" size="2"><span style="font-size:11pt">
<div>Looking for help to set all msgs columns for windows hosts to green.</div>
<div> </div>
<div>The only entries in the client-local.cfg for win32 are:</div>
<div> </div>
<div>[win32]</div>
<div>log:*</div>
<div>ignore failure</div>
<div>ignore error</div>
<div>ignore warning</div>
<div> </div>
<div>This is my existing analysis.cfg file contents for CLASS=win32:</div>
<div> </div>
<div>## System Level CLASSes and Defaults</div>
<div>CLASS=win32</div>
<div> LOAD 80 90 # Load threholds are in %</div>
<div> MEMPHYS 95 98</div>
<div> MEMSWAP 90 95</div>
<div> MEMACT 95 98</div>
<div> DISK C 90 95 # Can be harddrive or mount points</div>
<div> DISK D 90 95 # Can be harddrive or mount points</div>
<div> DISK E 90 95 # Can be harddrive or mount points</div>
<div> PROC BBWin.exe 1 1</div>
<div> PORT STATE=LISTENING MIN=0 TRACK=Listen TEXT=Listen</div>
<div> SVC BBWin startup=automatic status=started</div>
<div> </div>
<div> LOG %.system %error|warning|failure COLOR=green</div>
<div> LOG %.security %error|warning|failure COLOR=green</div>
<div> LOG %.* %^error|warning|failure COLOR=green</div>
<div> </div>
<div><font face="Script MT Bold" size="4"><span style="font-size:14pt"><b>Scott Allen Rebman</b><font face="Calibri" size="2"><span style="font-size:11pt">
<br>
</span></font><font face="Arial" size="2"><span style="font-size:10pt">Solaris System Administrator
<br>
</span></font><font face="Arial" size="2"><span style="font-size:10pt">HHS/HHSC/Contractor</span></font></span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt">TIERS Operations<font face="Calibri" size="2"><span style="font-size:11pt">
<br>
</span></font><font face="Calibri" size="2"><span style="font-size:11pt">(512)873-6864 (CrossPark)<br>
</span></font>(512) 549-0278 (Work Cell)</span></font></div>
<div>Scott.Rebman@hhsc.state.tx.us</div>
<div> </div>
<div> </div>
<div> </div>
<div> </div>
<div> </div>
</span></font></div>
</div>
</body>
</html>