<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=us-ascii" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 9.00.8112.16800"></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=059063218-22092016><FONT size=2
face=Arial>For example this does not work:</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=059063218-22092016><FONT size=2
face=Arial></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=059063218-22092016><FONT size=2
face=Arial> PROC "SVC:TermService C:\Windows\System32\svchost.exe -k
termsvcs" 1 1 red "TEXT=Terminal Services"<BR></FONT></SPAN></DIV>
<DIV><SPAN class=059063218-22092016><FONT size=2 face=Arial>But it is found in
the procs output... I have determined that much simpler SVC checks do work
though, so thanks Dave.</FONT></SPAN></DIV>
<DIV><SPAN class=059063218-22092016><FONT size=2
face=Arial></FONT></SPAN> </DIV>
<DIV><SPAN class=059063218-22092016><FONT size=2 face=Arial>In client-local.cfg,
should this work:</FONT></SPAN></DIV>
<DIV><SPAN class=059063218-22092016><FONT size=2
face=Arial>[host=SQL-CLU-N[12]]</FONT></SPAN></DIV>
<DIV><SPAN class=059063218-22092016><FONT size=2 face=Arial>as an alternative
to:</FONT></SPAN></DIV>
<DIV><SPAN class=059063218-22092016><FONT size=2 face=Arial>[SQL-CLU-N1]<BR>and
repeating everything in:</FONT></SPAN></DIV>
<DIV><SPAN class=059063218-22092016><FONT size=2
face=Arial>[SQL-CLU-N2]<BR></FONT></SPAN></DIV>
<DIV><SPAN class=059063218-22092016><FONT size=2 face=Arial>What should I do if
I want to match the latest log file like this (on
WinPSclient)</FONT></SPAN></DIV>
<DIV><SPAN class=059063218-22092016><FONT size=2
face=Arial>log:C:\Temp\myServiceLog15-09-16.6.log:10240<BR>where the date is the
date the service was last restarted and the number before the .log is
incremented when the log file is rotated, which is at least once per day?
What kind of wildcards can I use, and can I put commands in backticks? And
if I can use backticks, should they be in PowerShell?</DIV></FONT></SPAN><!-- Converted from text/rtf format -->
<P align=left><SPAN lang=en-gb><FONT size=2 face=Arial>Kind
regards,</FONT></SPAN> </P>
<P><SPAN lang=en-gb><FONT size=2
face=Arial>Sebastian </FONT></SPAN> <BR></P>
<DIV> </DIV><BR>
<BLOCKQUOTE
style="BORDER-LEFT: #000000 2px solid; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; MARGIN-RIGHT: 0px"
dir=ltr>
<DIV dir=ltr lang=en-us class=OutlookMessageHeader align=left>
<HR tabIndex=-1>
<FONT face=Tahoma><FONT size=2><B>From:</B> Dav<SPAN
class=059063218-22092016><FONT
face=Arial>e </FONT></SPAN><BR><B>Sent:</B> 16 September 2016
19:42<BR><B>To:</B> SebA<BR><B>Subject:</B> Re: [Xymon] Xymon WinPSclient
central config examples<BR></FONT></FONT><BR></DIV>
<DIV></DIV>
<DIV dir=ltr>
<DIV>
<DIV>SebA,<BR><BR></DIV> I don't think there
needs to be anything special in the client-local.cfg for parsing PROCS
(and PORTS).<BR></DIV>
<DIV>Here's a few of my rules:<BR><BR></DIV>
<DIV>SVC %^Netbackup.Client.Service$<BR></DIV>
<DIV>SVC XymonPSClient<BR></DIV>
<DIV>PORT "LOCAL=%(0:445)$" state=LISTENING TEXT=smb<BR></DIV>
<DIV>PORT "LOCAL=%(0:3389)$ state=LISTENING TEXT=rdp<BR><BR><BR></DIV>
<DIV>Note, I had to use the periods in the "Netbackup Client Service" because
of the spaces in the service name.<BR></DIV>
<DIV>I added the PORTS for additional ref in parsing the data.<BR></DIV>
<DIV><BR><BR></DIV>
<DIV>Dave<BR></DIV>
<DIV><BR></DIV></DIV>
<DIV class=gmail_extra><BR>
<DIV class=gmail_quote>On Thu, Sep 15, 2016 at 9:03 AM, SebA <SPAN
dir=ltr><<A href="mailto:spah@syntec.co.uk"
target=_blank>spah@syntec.co.uk</A>></SPAN> wrote:<BR>
<BLOCKQUOTE
style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex"
class=gmail_quote><U></U>
<DIV>
<DIV><SPAN><FONT size=2 face=Arial>Hi, does anyone have any examples of
monitoring logs and procs using Xymon WinPSclient that they can share with
me?<FONT size=3 face="Times New Roman"> client-local.cfg and
analysis.cfg</FONT></FONT></SPAN></DIV>
<DIV><SPAN><FONT size=2 face=Arial></FONT></SPAN> </DIV>
<DIV><SPAN><FONT size=2 face=Arial>Or tell me why this does not match
anything when, excluding the %^ and $, this is what is displayed in the
procs listing (names changed):</FONT></SPAN></DIV>
<DIV><SPAN><FONT size=2 face=Arial></FONT></SPAN> </DIV>
<DIV><SPAN><FONT size=2 face=Arial> PROC "%^SVC:WindowsServiceName
C:\Services\MyLongServerName.<WBR>exe$" 1 1 red "TEXT=My
Service"<BR></FONT></SPAN></DIV>
<DIV><SPAN><FONT size=2 face=Arial>This is returning red when the service is
running - 0 instances found.</FONT></SPAN></DIV>
<DIV style="TEXT-ALIGN: left"><SPAN style="FONT-SIZE: 12px"><SPAN
style="FONT-FAMILY: arial,helvetica,sans-serif"><BR>Kind
regards,<BR><BR>Seb<SPAN>A</SPAN></SPAN></SPAN></DIV></DIV><BR>______________________________<WBR>_________________<BR>Xymon
mailing list<BR><A href="mailto:Xymon@xymon.com">Xymon@xymon.com</A><BR><A
href="http://lists.xymon.com/mailman/listinfo/xymon" rel=noreferrer
target=_blank>http://lists.xymon.com/<WBR>mailman/listinfo/xymon</A><BR><BR></BLOCKQUOTE></DIV><BR></DIV></BLOCKQUOTE></BODY></HTML>