Xymon Mailing List Archive search

Hobbit Server Overload Due To Windows Event Logs

list Scott Rebman
Tue, 21 Oct 2014 17:40:02 +0000
Message-Id: <user-c0c26a612393@xymon.invalid>

We are at xymon version 4.3.3 and bbwin is at 0.13.

Scott Allen Rebman
Solaris System Administrator
HHS/HHSC/Contractor
TIERS Operations
(512)873-6864 (CrossPark)
(512)275-6122 (cell)
user-bcaa70f63753@xymon.invalid


From: Rebman,Scott (HHSC Contractor)
Sent: Tuesday, October 21, 2014 12:22 PM
To: xymon at xymon.com
Cc: Mills,David (HHSC Contractor)
Subject: Hobbit Server Overload Due To Windows Event Logs


We're trying to completely shut down all Windows event logs being sent from the clients to the Xymon server. We experimented and only seemed able to achieve this by deleting the:

                <load name="msgs" value="msgs.dll"/>

line and the entire "<msgs> ...</msgs>" stanza from the local BBWin.cfg. We thought we had a recipe for success on the rest of our Windows clients but when we started trying to make it work on two other boxes, we found that the "procs" and "timediff" tests went purple!

We experimented by putting parts of the <msgs> ... stanza back in but we found that (apparently) the client data was not making it back to the server from the client after the mods. So - we got it working on our test box, but on two other "live" boxes it failed and interfered with other tests.

This is a hot item for us since our Hobbit server is being overwhelmed by incoming data, in large part coming from these huge Windows event logs.

Thanks!

Scott Allen Rebman
Solaris System Administrator
HHS/HHSC/Contractor
TIERS Operations
(512)873-6864 (CrossPark)
(512)275-6122 (cell)
user-bcaa70f63753@xymon.invalid<mailto:user-bcaa70f63753@xymon.invalid>