Re: [hobbit] Looking for sample BBWIN configs for filtering Windows event logs

["Bob Gordon" <rgordonjr (at) gmail.com>]

On Thu, Oct 9, 2008 at 1:04 PM, Shawn Heisey <elyograg (at) elyograg.org> wrote:

> It looks like the ignore section only uses text matches, in this case
> regular expressions, right?  That would mean it can't match on event ID
> unless I encode something like "Print (8)" in a regular expression format.
>
> Not that this is a huge problem, but having a nice clean field like event
> ID is one of the good things about BBWin's local config mode.  I'm just
> tired of having to remote into the client to change something, especially
> when I have to do it on more than one client.
>
> Thanks for the info!  Only one more thing I'd want - do you have an
> examples of centrally defined service monitoring?
>


In my case I found it easier to match based on the text rather than the ID.
You should be able to match on the ID rather than the text though...

The entries that I am doing service monitoring on have entries similar to
these:

	SVC "RFBOARD" startup=manual status=started color=red
	SVC "RFDB" startup=manual status=started color=red


Regards,

-- 
--==[ Bob Gordon ]==--