[xymon] bb-win & client-local.cfg

[David Baldwin]

Vernon,
> Hi all
>
> Hoping for a little help on this one.
> Got a stream of errors coming through from some wintendo clients
> running bb-win.
> See example below.
> We would like to ignore some errors related to certain messages.
> I was under the impression that the following in client-local.cfg
> would do it.
>
> [win32]
> eventlog:Security
> ignore Success
> eventlog:System
> ignore Information
> *eventlog:Application
> ignore Citrix System Monitoring
> ignore MetaFrameEvents*
>
> Appears to not be the case.
> How do we configure the client-local.cfg to ignore instances of the
> first and last error, but not instances like the middle one below?
> (The messages are for illustrative purposes only - their relative
> importance and why I should or shouldn't ignore them is not under
> discussion)
>
> Regards
>      Vernon
>
I grappled with the same problem for ages. My situation was complicated
by the fact I have success and failure auditing also enabled, which
means the client messages could be huge, and even bumping up
MAXMSG_CLIENT to around 15MB was still not enough. I never worked out
how to filter a single message out.

My eventual solution was to disable msgs reporting entirely in BBWIN
(comment out the BBWIN.CFG line loading the msgs DLL), and set up event
log forwarding using SNARE (
http://www.intersectalliance.com/projects/SnareWindows/index.html ) to
rsyslog on the logging/monitoring server (running xymon/hobbit) and then
write a test to filter the forwarded logs. This also allowed me to
filter on severity, error code, etc. so was a better solution due to
some of the bizarre errors Windows generates which can be safely ignored
(browser service, etc). Been meaning to contribute it and write it up
but haven't had time yet.

Note also that the event log reporting in BBWIN doesn't work at all well
for Windows 2008/Vista/7 due to the new event log system. The old BBNT
client doesn't cut it either.

David.
> red application: error - 2010/07/26 11:41:53 - Citrix System Monitoring Agent (37) - NT AUTHORITY\SYSTEM 
>
>  "The Queue thread stopped responding. The Citrix System Monitoring Agent will shutdown
>  and restart."
>
> yellow application: warning - 2010/07/26 11:40:52 - Citrix-Multimedia-Flash (50) - stuff/deleted 
>
>  "The client does not support HDX MediaStream for Flash. Server-side Flash rendering
>  will be used if available."
>   
> yellow application: warning - 2010/07/26 11:33:59 - MetaFrameEvents (1103) - n/a 
>
>  "An error occurred while retrieving client printer properties. Default printer properties
>  will be used instead. Client name: (WI_-fCiFejFrIHBbXrfM) Printer: (CompanyName
>  Pull Print PS [UPD:PS] (from WI_-fCiFejFrIHBbXrfM) in session 6) Printer driver:
>  ()"
>
>   


-- 
David Baldwin - IT Unit
Australian Sports Commission          www.ausport.gov.au
Tel 02 62147830 Fax 02 62141830       PO Box 176 Belconnen ACT 2616
david.baldwin at ausport.gov.au          Leverrier Street Bruce ACT 2617


-------------------------------------------------------------------------------------
Keep up to date with what's happening in Australian sport visit http://www.ausport.gov.au

This message is intended for the addressee named and may contain confidential and privileged information. If you are not the intended recipient please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. If you receive this message in error, please delete it and notify the sender.
-------------------------------------------------------------------------------------