Cheshire Cat Computing

Hello Steve,
hello Eventlogagentuser,

we have your wonderful eventlogagent on all W2K3 Servers installed.
I'm now trying to get an EventSource Filter that the Events from following Sources:

a) Backup Exec
b) Backup Exec System Recovery
c) LoadPerf
d) APCPBEAgent

should not be submitted to our nagios host. Somthing works fine - as long as only
ONE Source is defined in the Match Rules Settings. But if i would like to define more than one Source with blanks in the description i can't get things to work ...

I'm unsure how to tell the filter that more than one source with blanks in the description should be filtered. If it is the Seperator the blank ... i would have trouble.

I use Version 1.8.1.0 of your Agent and Control App 1.8.0.0.

Actually following Filtersettings are in Registry:
[HKEY_LOCAL_MACHINE\SOFTWARE\Cheshire Cat\Nagios\Filter2]
"Audit Failure"=dword:00000000
"Audit Success"=dword:00000000
"Error"=dword:00000001
"eventLog"=dword:00000001
"eventLogName"="Application"
"filterDesc"="Application Log"
"ID"="4314,3,63,1000,42,40,9548,1022,21245,21421,21423,10021,9327,5008,47,2003,1524,13031,13032"
"Information"=dword:00000000
"matchString"=""
"notID"=dword:00000001
"notMatch"=dword:00000000
"notSource"=dword:00000001
"serviceName"="Anwendung Ereignisanzeige"
"source"="Backup Exec,Backup Exec System Recovery,LoadPerf,APCPBEAgent"
"status"=dword:00000002
"Warning"=dword:00000001


As you can see, i used commata as seperator between the particular source definitions - but unfortunatly this doesn't work ... Can you tell me the correct seperator?

I would be glad to hear from you. Your Eventlog-Tool is very great.



Greetings from Germany
wollila

Wolfgang Stroehlein
Networkadministrator
Diakonie Neuendettelsau

Thing's still not working ...

But i'm unsure how to get filtered out from different eventsources --- could it be the character problem or is the Problem in the way i use the filterdefinition?

I'm still haven't found the correct syntax ...



Greetings
wollila

Only the EventID field allows a comma separated list.

The Source is a single text field, and the description is a Regular Expression. Either can contain embedded spaces, although trailing spaces may cause a problem.

I admit this can make things a bit difficult. The only way to achieve what you want is to create a separate filter for each Source.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11