[hobbit] Looking for sample BBWIN configs for filtering Windows event logs

[Shawn Heisey]

Bob Gordon wrote:
> In my case I found it easier to match based on the text rather than 
> the ID.  You should be able to match on the ID rather than the text 
> though...
>
> The entries that I am doing service monitoring on have entries similar 
> to these:
> 	SVC "RFBOARD" startup=manual status=started color=red
> 	SVC "RFDB" startup=manual status=started color=red
>   
This is going to be so incredibly helpful.  Do you happen to know if the 
uptime "yellow alarm" value can be centrally controlled?  I've got some 
Windows machines that have been up for more than 1000 days, so BBWin 
reports yellow.  I haven't bothered with changing the value because 
right now I'd have to do it on dozens of machines individually.

The systems with high uptimes are in continuous production, so I haven't 
been able to convince the integration folks to install updates and get 
them rebooted.  They're firmly behind firewalls, so I am not SUPER 
concerned about their security.