Re: [hobbit] MSGS from BBWin client goes purple

["Etienne Grignon" <etienne.grignon (at) gmail.com>]

Hello,

2008/4/22, Ricardo Alberto Schutz <ricardo (at) redix.com.br>:
> Can someone help on this?
>
>  We are having some trouble with BBWin. Our linux clients are configured in
> central mode, so all the configuration is made on the server. Now we have to
> watch some Windows clients, which are configured in local mode.
>
>  The problem is with the "msgs". One specific client goes purple sometimes.
> But not the entire host, only msgs column. Procs, disk, memory, svcs and etc
> are all green, only msgs column goes purple.
>
>  My BBWin.cfg is as follows
>
>  <?xml version="1.0" encoding="utf-8" ?> <configuration> <bbwin>   <setting
> name="bbdisplay" value="ourbbdisplay:1984" />
>    ...
>    <setting name="mode" value="local" />   <setting name="configclass"
> value="win32" />   ...
>    <load name="msgs" value="msgs.dll"/>   <load name="procs"
> value="procs.dll"/>   <load name="stats" value="stats.dll"/>
>    <load many others...>
>    ...
>  </bbwin> <cpu>   ...
>  </cpu> <disk>   ...
>  </disk> <externals>   ...
>  </externals> <memory>   ...
>  </memory> <msgs>   <setting name="alwaysgreen" value="false" />   <setting
> name="delay" value="30m" />   <match logfile="System" type="error"
> alarmcolor="red" />   <match logfile="System" type="warning"
> alarmcolor="yellow" />   <match logfile="Application" type="error"
> alarmcolor="red" />   <match logfile="Application" type="warning"
> alarmcolor="yellow" />   <match logfile="Security" type="fail" />
> <ignore logfile="Security" eventid="537" />   <ignore logfile="Application"
> eventid="17" />
>  </msgs> <procs>   ...
>  </procs> <svcs>    ...
>  </svcs> <uptime>   ...
>  </uptime> </configuration>
>
>  Is there something wrong with the configuration? How can I find out why is
> it going purple? There's no "Client data" avaliable, maybe because it's
> running in "local mode"?
>


The problem may be that there are too many events in your event log,
so it takes too much time to get the last 30 minutes events to be sent
to hobbit.

Could you check how many events are generated in your event log every minute ?

Regards,

-- 
Etienne GRIGNON