Strane one.

[Neil Franken]

Hi Xymonsters

I got a interesting one. At a site we have a DC/Exchange machine that
has gone purple on the ports, procs and svcs tests. I had a look at the
hobbit column and found the following message. Oversize data/client msg
from 172.27.15.7 truncated (n=6562423, limit 524288). It turns out to be
the dc/exchange server with the purple columns. I had a look at the NT
event log we are pulling is huge due to a security issue. Any ideas on
how to resolve this? The network guys at this site is well let's just
say Mine Sweeper Consultants Solitaire Experts(aka MCSE no offence to
the decent ones out there) that cannot resolve the security issue. 

Can one set this size in hobbit?

Regards
Neil