[xymon] Data flooding from x.x.x.x

[David Baldwin]

Henrik Størner wrote:
> In <4CC17F18.7040309 at shihad.org> Iain M Conochie <iain at shihad.org> writes:
>   
>> Good afternoon xymoners.
>> Is there a large risk in increasing the MAX_HOBBIT_INBUFSZ to above 
>> 10MB to try to avoid these error messages?
>> Latest errormessages:
>>
>> Data flooding from X.X.X.X, closing connection
>>
>> These are windows boxes and most likely there is something wrong with 
>> the client but we are seeing this very consistently.
>>     
>
> I've seen this lately, triggered by huge Windows event-logs.
> On Windows-systems, that's probably the only piece of data
> that can get so huge.
>
> If you know which hosts are causing this - look at the IP's - 
> then I would recommend that the first action should be to look
> at why there are so many log-entries in the eventlog. And
> since eventlog-scanning can load a system rather heavily, you
> may want to consider turning off eventlog monitoring completely.
> Or at least for the particular log that generates so much data.
>   
In my experience, this is caused by the BBWin client and as Henrik
suspects from event logs. If you have Success Auditing turned on it is
almost a certainty that the messages will be too big on a busy server.

My workaround for these is to disable the eventlog reporting in
BBWin.cfg by commenting out the following line:

    <!-- load name="msgs" value="msgs.dll"/ -->

This probably breaks reporting on other (filesystem-based) log files.

I was unable to work out how to set up filtering or disabling of
eventlogs any other way in BBWin centralised mode.

David.

-- 
David Baldwin - IT Unit
Australian Sports Commission          www.ausport.gov.au
Tel 02 62147830 Fax 02 62141830       PO Box 176 Belconnen ACT 2616
david.baldwin at ausport.gov.au          Leverrier Street Bruce ACT 2617


-------------------------------------------------------------------------------------
Keep up to date with what's happening in Australian sport visit http://www.ausport.gov.au

This message is intended for the addressee named and may contain confidential and privileged information. If you are not the intended recipient please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. If you receive this message in error, please delete it and notify the sender.
-------------------------------------------------------------------------------------