[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [hobbit] Looking for sample BBWIN configs for filtering Windows event logs

It looks like the ignore section only uses text matches, in this case regular expressions, right? That would mean it can't match on event ID unless I encode something like "Print (8)" in a regular expression format.
Not that this is a huge problem, but having a nice clean field like event ID is one of the good things about BBWin's local config mode. I'm just tired of having to remote into the client to change something, especially when I have to do it on more than one client.
Thanks for the info! Only one more thing I'd want - do you have an examples of centrally defined service monitoring? 

Bob Gordon wrote:
On Thu, Oct 9, 2008 at 10:54 AM, Shawn Heisey <hobbit (at) elyograg.org <mailto:hobbit (at) elyograg.org>> wrote: 

    I have a question that's really more suited for the BBWin mailing
    list, but I've asked it there and gotten no response:  Does anyone
    have a complete server-side configuration example for BBWin
    clients, showing how to handle all aspects of the client
    configuration?
This is the one that I am using. I still have some cleanup to do on it though.... 

###########################################################
## The defaults used by the Hobbit clients
###########################################################
DEFAULT
        UP      30m
        DISK    * 90 95
        SWAP    85 90
        MEMPHYS 100 101
        MEMSWAP 90 95
        MEMACT  90 97
        CLOCK   30

###########################################################
## Windows Based Systems - Central Config Mode
###########################################################
CLASS=%win32*  EXHOST=server1,server2
        LOAD 80 90              # Load thresholds are in %
        PROC svchost.exe 2 -1
        PROC %[mM]cshield.exe 1 -1
        PROC nserver.exe 1 -1
        PROC nrouter.exe 1 -1
LOG %.* %.*error.* COLOR=red IGNORE=%(BigBrotherHobbitClient|SnapDrive|WinVNC4|TermDD|SV-GSX|TermServDevices|Perflib|PerfNet)
So far its worked out pretty well as my default setting... After the Default section and before the generic section above I have my system specific entries...