[Xymon] Hobbit Server Overload Due To Windows Event Logs

[Claessens Jurgen]

Hi Scott,

Open your config file with a text editor that support html layout, like notepad++. This makes it easier for editing.
Make comment from the entire section.
<!-- <msgs>

<\msgs> -->
Check if the entire section is now set as comment. As an additional check, you can verify in the eventlog if the service has restarted ok.

Regards
Jurgen Claessens

From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Rebman,Scott (HHSC Contractor)
Sent: dinsdag 21 oktober 2014 19:22
To: xymon at xymon.com
Cc: Mills,David (HHSC Contractor)
Subject: [Xymon] Hobbit Server Overload Due To Windows Event Logs

We're trying to completely shut down all Windows event logs being sent from the clients to the Xymon server. We experimented and only seemed able to achieve this by deleting the:

                <load name="msgs" value="msgs.dll"/>

line and the entire "<msgs> ...</msgs>" stanza from the local BBWin.cfg. We thought we had a recipe for success on the rest of our Windows clients but when we started trying to make it work on two other boxes, we found that the "procs" and "timediff" tests went purple!

We experimented by putting parts of the <msgs> ... stanza back in but we found that (apparently) the client data was not making it back to the server from the client after the mods. So - we got it working on our test box, but on two other "live" boxes it failed and interfered with other tests.

This is a hot item for us since our Hobbit server is being overwhelmed by incoming data, in large part coming from these huge Windows event logs.

Thanks!

Scott Allen Rebman
Solaris System Administrator
HHS/HHSC/Contractor
TIERS Operations
(512)873-6864 (CrossPark)
(512)275-6122 (cell)
Scott.Rebman at hhsc.state.tx.us<mailto:Scott.Rebman at hhsc.state.tx.us>






This e-mail and all files transmitted as attachment(s) thereto are confidential and solely intended for the individual to whom or the organization to which they are addressed. If you received this e-mail by mistake, please notify Cegeka's Service Desk at cegeka.support at cegeka.be or call +32 (0)11 240 363. We thank you in advance. Cegeka hereby confirms that this message has been swept by Sophos for the presence of viruses.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20141022/dda5781b/attachment.html>