[hobbit] Filtering event logs from windows sytems bbnt client

[Galen Johnson]

I don't think Etienne has the centralized rollout done, yet, but he'd 
have to speak to that.  It's been a few months since the last update to .9.

=G=

Aaron Stranberg wrote:
> Thanks for the reply, I will have too weigh out taking a swag at this 
> module vs. moving forward with deployment of BBWIN  Is BBWIN 
> considered production stable?  I was also reading about the 
> centralized updates, does this include ability for the agent to 
> upgrade/udpate its self?  This is a huge step for folks in my position 
> with windows hosts in the hundreds with no central LDAP/AD, or even 
> common logons it means manually touching each system for updates and 
> config changes on the current bbnt client. I am really looking forward 
> to getting bbwin roled out! 
>
> > Date: Thu, 10 May 2007 18:57:40 +0200
> > To: hobbit at hswn.dk
> > From: henrik at hswn.dk
> > Subject: Re: [hobbit] Filtering event logs from windows sytems bbnt 
> client
> >
> > On Wed, May 09, 2007 at 04:21:54PM +0000, Aaron Stranberg wrote:
> > >
> > > Hi All, Is it possible using the hobbit-clients.cfg
> > > file to centrally filter out windows eventlog messages by key word?
> >
> > Unfortunately, no. The hobbit-clients.cfg only works on real "hobbit"
> > clients that use the hobbit-specific way of reporting data which is
> > then analysed at the server. The bbnt client determines the status all
> > by itself and sends the status update directly to the server, so it
> > isn't possible to filter data on the server.
> >
> > I can see a couple of ways you can do it, though. You can create a
> > custom Hobbit server-side module, which is passed all of the "msgs"
> > status data. Then you could filter these and generate a new status
> > column - "msgs2", or whatever you'd call it - from these filtered data.
> >
> > Writing server-side modules may seem daunting, but it really isn't.
> > If you grab the current Hobbit snapshot at http://www.hswn.dk/beta/
> > then you'll find a perl program which is such a server-side module:
> > It's in the hobbitd/hobbitd_rootlogin.pl file.
> >
> > You'd need to write a tool that reads the "msgs" status data it gets.
> > The "msgs" status report (if I recall correctly) has the interesting
> > lines listed with a red/yellow marker first, like:
> > &red This is a critical message
> > &yellow This is a warning
> > &yellow This is pure noise
> > So your script could weed out the "noise" lines, and then look at the
> > remaining lines (if any) to see what the new status color should be.
> > From that, it should be easy to generate the new "msgs2" status and
> > feed it into Hobbit.
> >
> >
> > Regards,
> > Henrik
> >
> >
> > To unsubscribe from the hobbit list, send an e-mail to
> > hobbit-unsubscribe at hswn.dk
> >
> >
>
> ------------------------------------------------------------------------
> Change is good. See what's different about Windows Live Hotmail. Check 
> it out! 
> <www.windowslive-hotmail.com/learnmore/default.html?locale=en-us&ocid=RMT_TAGLM_HMWL_reten_changegood_0507>