[hobbit] Looking for sample BBWIN configs for filtering Windows event logs

[Rafal Roginela]

Hi Tom,

What you are talking about is a process that shapes the exceptions per
server. I monitor all of our logs here and we have about 10 servers with
different functions so on each client (I use BBWin and local configs)
initially I looked at the logs and found the pointless errors and
ignored those right away and I still sometimes have to adjust the list
if applications or hardware changes. Here is an excerpt from 2 different
configuration files to give you an example of what I mean:

Server1
	<setting name="alwaysgreen" value="false" />
	<match logfile="System" type="error" delay="1h" alarmcolor="red"
/>
	<match logfile="Application" type="error" delay="1h"
alarmcolor="red" />
	<ignore logfile="System" eventid="1111" />
	<ignore logfile="System" eventid="16" />
	<ignore logfile="System" eventid="12294" />
	<ignore logfile="System" eventid="5805" />
	<ignore logfile="System" eventid="5723" />
	<ignore logfile="Application" eventid="1000" />
	<ignore logfile="Application" eventid="11" />
	<ignore logfile="Application" eventid="34113" />
	<ignore logfile="System" source="Backup Exec" />

Server2
	<setting name="alwaysgreen" value="false" />
	<match logfile="System" type="error" delay="1h" alarmcolor="red"
/>
	<match logfile="Application" type="error" delay="1h"
alarmcolor="red" />
	<ignore logfile="System" eventid="1111" />
	<ignore logfile="System" eventid="16" />
	<ignore logfile="System" eventid="39" />
	<ignore logfile="System" eventid="1106" />
	<ignore logfile="System" eventid="61" />
	<ignore logfile="Application" eventid="107" />
	<ignore logfile="Application" eventid="1106" />
	<ignore logfile="Application" eventid="1000" />
	<ignore logfile="Application" eventid="101" />
	<ignore logfile="Application" eventid="2002" />
	<ignore logfile="Application" eventid="1015" />

As you can see the list is not huge and our servers are ones I inherited
so they experience more weirdness then I'm used to with my own builds,
but you can always find a useless errors in a windows event log. Hope
this helps.

Thank You.

Rafal Roginela

-----Original Message-----
From: Kauffman, Tom [mailto:KauffmanT at nibco.com] 
Sent: Thursday, October 09, 2008 10:31 AM
To: hobbit at hswn.dk
Subject: [hobbit] Looking for sample BBWIN configs for filtering Windows
event logs

We haven't been putting the Windows Server msgs column on our bb2 page,
nor alerting on msgs, because of the number of events that seem to
trigger warnings or errors.

Would anyone be willing to share with is your event log filter entries
for BBWIN, to use as a starting point?

TIA

Tom Kauffman


To unsubscribe from the hobbit list, send an e-mail to
hobbit-unsubscribe at hswn.dk