<div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">David, the cleaner way is to list exceptions on Hosts first, then the default for all Powershell clients. I believe your behaviour is due by Xymon stops parsing on the host name once it matches, then adds the (first) default. In the example below, I have the location of the Xymon client_config identified (has to be in the Client_config file downloaded or local), the WinLogon for PROC, and the RDP port so that the columns are normally Green. The servicecheck for WinCollect is ignored on the server if it doesn't exist. It's purpose is to restart a service if found to be stopped. I believe your SVC "<span style="font-family:Arial,Helvetica,sans-serif"> </span><span style="font-family:Arial,Helvetica,sans-serif">status=started startup=automatic" is legacy in BBWin but doesn't work in PSXymon that way.</span></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">Here is an Analysis example:</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">HOST=CCSWSUS<br> SVC WsusService status=started<br>SVC WinCollect status=started<br><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">HOST=CCSSophos<br> SVC Sophos_Management_Service status=started<br> SVC SophosPatchEndpointCommunicator status=started<br><br>HOST=CCS###<br> SVC MSSQL$SUPERCHARGER status=started<br>SVC WinCollect status=started<br><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">CLASS=powershell<br>UP 30m<br>Load 90 95<br>DISK * 85 95<br>MEMPHYS 70 95<br>MEMSWAP 60 85<br>PROC winlogon<br>SVC XymonPSClient status=started<br>SVC CSFalconService status=started<br>SVC SAVService status=started<br>SVC SAVAdminService status=started<br>SVC Sophos_Agent status=started<br>SVC Sophos_AutoUpdate_Service status=started<br>PORT "LOCAL=%([\.:]3389)$" STATE=LISTENING COLOR=YELLOW text=RDP<br>FILE C:\Utils\Xymonclient_config.xml</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">LOG eventlog_application Error|Warning</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">LOG eventlog_application Error IGNORE=[1008],[2004],[1018],[1022],[11],[1524],[1008],[2003],[4099],[8005],[12289],[4879],SAVOnAccessFilter<br>LOG eventlog_system Error IGNORE=[36874],[36871],[1002],[513],[4879],[36888],[157],[140],[50],[58],[137],[6037],[1],DCOM,Print,TermServDevices,SAVOnAccessFilter<br> LOG eventlog_system Warning COLOR=yellow<br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">Here is a Client_Config example:</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">clientversion:2.42:<a href="http://webserver/pub/XymonPS">http://webserver/pub/XymonPS</a></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">maxloop:720</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">xymonlogsend</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">file:c:\utils\Xymonclient_config.xml</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">servicecheck:WinCollect:5<br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">Keep the questions coming,</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">Tim</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jun 2, 2021 at 11:08 AM David Smith via Xymon <<a href="mailto:xymon@xymon.com">xymon@xymon.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br><br><br>---------- Forwarded message ----------<br>From: David Smith <<a href="mailto:david.smith@renfrewshire.gov.uk" target="_blank">david.smith@renfrewshire.gov.uk</a>><br>To: "<a href="mailto:xymon@xymon.com" target="_blank">xymon@xymon.com</a>" <<a href="mailto:xymon@xymon.com" target="_blank">xymon@xymon.com</a>><br>Cc: <br>Bcc: <br>Date: Wed, 2 Jun 2021 15:08:18 +0000<br>Subject: question about analysis.cfg and central mode for windows clients<br>
<div lang="EN-GB" style="overflow-wrap: break-word;">
<div class="gmail-m_-1280873596246375012WordSection1">
<p class="MsoNormal">Hi<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I am running Xymon server 4.3.30, and the vast majority of windows clients using BBwin, and trying xymonpsclient on a couple.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">After advise from another users, I could successfully use central mode for services, which is ok for a couple of clients but then gets quite wieldy when it is going to be dozens.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I tried the following in analysis.cfg file<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I created a regular expression for one pattern of hostnames, and then for the extra services that differ on certain servers, I added a specific host/service entry. This works fantastically well.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I then tried to add another regular expression for another pattern of hostnames, and would similarly try to add in exceptions.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">This does not work, the machines with the new pattern are still being given the services list for the first pattern. What I also tried was removing the second regular expression and just have a specific host/service entry. That also does
not work, as it still gets the original services list even though the hostname does not fit the pattern.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">See below for excerpt from analysis.cfg<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Does anyone have any idea how/if I can do what I am trying?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Regards<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">David Smith<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">##A regular expression here for all the generic stuff on one pattern of servers<u></u><u></u></p>
<p class="MsoNormal">HOSTS=s[cgjprst][abghlrm]as01<u></u><u></u></p>
<p class="MsoNormal">##stuff that is on all old app servers<u></u><u></u></p>
<p class="MsoNormal">#backupexec stuff<u></u><u></u></p>
<p class="MsoNormal">SVC BackupExecAgentAccelerator status=started startup=automatic<u></u><u></u></p>
<p class="MsoNormal">SVC BackupExecAgentBrowser status=started startup=automatic<u></u><u></u></p>
<p class="MsoNormal">SVC BackupExecDeviceMediaService status=started startup=automatic<u></u><u></u></p>
<p class="MsoNormal">SVC BackupExecJobEngine status=started startup=automatic<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">##a bit more refined here, to add extra services for specific hosts<u></u><u></u></p>
<p class="MsoNormal">HOST=schas01<u></u><u></u></p>
<p class="MsoNormal">SVC SibeliusLicenceServerV6 status=started startup=automatic<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">HOST=sjhas01<u></u><u></u></p>
<p class="MsoNormal">SVC SibeliusLicenceServerV7 status=started startup=automatic<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">######STUFF below here doesnt obey the pattern<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">##A regular expression here for generic stuff on another pattern of servers<u></u><u></u></p>
<p class="MsoNormal">HOSTS=[cgjprst][abghlrm]-as1<u></u><u></u></p>
<p class="MsoNormal">##stuff that is on all new servers<u></u><u></u></p>
<p class="MsoNormal">SVC BrokerInfrastructure status=started startup=automatic<u></u><u></u></p>
<p class="MsoNormal">SVC IISADMIN status=started startup=automatic<u></u><u></u></p>
<p class="MsoNormal">SVC UALSVC status=started startup=automatic<u></u><u></u></p>
<p class="MsoNormal">SVC W3SVC status=started startup=automatic<u></u><u></u></p>
<p class="MsoNormal">SVC VeeamDeploySvc status=started startup=automatic<u></u><u></u></p>
<p class="MsoNormal">SVC VeeamEndpointBackupSvc status=started startup=automatic<u></u><u></u></p>
<p class="MsoNormal">SVC VeeamTransportSvc status=started startup=automatic<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">HOST=ndo-as1<u></u><u></u></p>
<p class="MsoNormal">SVC SibeliusLicenceServerV7 status=started startup=automatic<u></u><u></u></p>
</div>
<p> </p>
<p> </p>
<p>Renfrewshire Council Website -<a href="http://www.renfrewshire.gov.uk" target="_blank">http://www.renfrewshire.gov.uk</a></p>
<p>This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. Renfrewshire Council may, in
accordance with the Telecommunications(Lawful Business Practice) (Interception of Communications) Regulations 2000, intercept e-mail messages for the purpose of monitoring or keeping a record of communications on the Council's system. If a message contains
inappropriate dialogue it will automatically be intercepted by the Council's Internal Audit section who will decide whether or not the e-mail should be onwardly transmitted to the intended recipient(s).</p>
</div>
<br><br><br>---------- Forwarded message ----------<br>From: David Smith via Xymon <<a href="mailto:xymon@xymon.com" target="_blank">xymon@xymon.com</a>><br>To: "<a href="mailto:xymon@xymon.com" target="_blank">xymon@xymon.com</a>" <<a href="mailto:xymon@xymon.com" target="_blank">xymon@xymon.com</a>><br>Cc: <br>Bcc: <br>Date: Wed, 2 Jun 2021 15:08:18 +0000<br>Subject: [Xymon] question about analysis.cfg and central mode for windows clients<br>_______________________________________________<br>
Xymon mailing list<br>
<a href="mailto:Xymon@xymon.com" target="_blank">Xymon@xymon.com</a><br>
<a href="http://lists.xymon.com/mailman/listinfo/xymon" rel="noreferrer" target="_blank">http://lists.xymon.com/mailman/listinfo/xymon</a><br>
</blockquote></div>