Cheshire Cat Computing

I've just done some testing with Win Event Log and it works awesome, despite some C runtime errors during install on win2k3 (what's up with that anyway?). I'm now looking towards deploying it across our windows server fleet however much to my surprise there is no config file! There's far too many servers and far too few of me to configure each one manually is there some way of setting apps the config unattended?

Thanks!

Ninja edit: Can you disable the heartbeat function? NSclient should catch it when it fails.

The install errors come when it fails to register the message DLL. I do not have enough windows knowledge to understand why sometimes this works but mostly it doesnt.

You can set the heartbeat time to 0 which disables it.

The configuration is held in the registry under HKEY_LOCAL_MACHINE/SOFTWARE/Cheshire Cat/Nagios
You can export all or part of this to a .reg file and then import it - often people do this for the filters.

You can also do a scripted install; there are a bunch of options to the install exe -- it is created by Inno Setup and their documentation is here: http://www.jrsoftware.org/ishelp/ look under 'Other Information', 'Setup command line parameters'.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

Thanks for the information (and the great little tool) Steve, that's going to make my life a whole lot better

So we finally got around to looking at rolling this out after collecting event ID's and noticed another piece of potential impending scalability doom and wanted your recommendation. We have some service (AD, Exchange for example) that are going to have some unique criteria... which makes patching them a challenge.

So we figured we would give the filter number for application specific stuff stupidly high numbers like 50 onwards and leave base OS and standard apps 0 - 50... we set the maxFilter value to 99. However we noticed when we tried to add a new filter this value was reset, unfortunately I don't trust our application teams not to press the button even when given strict instructions not too as it has never stopped them in the past.

The question I suppose is any suggestions on how to work around this?

Do you even need the maxFilter why not enumerate the FilterX keys on startup?

Thanks Steve!

When the agent starts up, it searches the registry for filters numbered from 1 to MaxFilter. Thus, if MaxFilter is too high, it can take a long time to start up. When you reorder the filters, then they are reenumerated and MaxFilter is recalculated. After loading, the highest number filter is known, and so maxfilter is again reset to this (and newly added filters come at the next value).

The filter number is supposed to be internal and not seen by the user. Originally, it sarted at 0 and counted up until it didnt find a filter; however that required reenumeration on a delete.

I'm not sure how you could manage this without risking duplicating filters (if someone reorders them) or getting overwrites (if someone adds a new one). You could push out a maxfilter value at the same time you push out the fixed filters by using a Policy though you'd still be risking problems if custom local filters were added or resequenced. It was never intended to be managed this way :/

The way we do it here is having a register export with the global filters and so on that is imported at install time, and them subsequently not managed.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

Fair enough, somewhat minor issue anyway, I guess I'll just go get a big stick to keep the developers away . Thanks!