Cheshire Cat Computing

_________________
-Patrick

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

_________________
-Patrick

Something else strange:

When in regedit, looking at[HKEY_LOCAL_MACHINE\SOFTWARE\Cheshire Cat\Nagios\Filter], I have an entry looking like:

ID=644
matchString=
source=

But when I export the key set, the ID gets repeated in the other keys:

"ID"="644"
"matchString"="644"
"source"="644"

Is that something on my side, or something weird somewhere else?

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

I'm still getting an issue where I have a filter set for certain events. But other events are being logged at the same time. I'm pasting the registry code here for your review.

Filter0 should only show the eventid's shown. But event id's 677 and 537 are also being sent. They should be caught by Filter1 instead.

Config follows:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Cheshire Cat\Nagios]

"Port"=dword:00001623
"encryptionMethod"=dword:00000001
"DEBUG"=dword:00000000
"maxFilter"=dword:00000003
"processDelay"=dword:0000001e

[HKEY_LOCAL_MACHINE\SOFTWARE\Cheshire Cat\Nagios\Filter0]
"filterDesc"="Account Audit Failures"
"eventLogName"="Security"
"serviceName"="AccountEvents"
"ID"="675,676,681,642,632,636,660,624,644,517,528,529,530,531,532,533,534,535,539"
"matchString"=""
"source"=""
"eventLog"=dword:00000005
"Information"=dword:00000000
"status"=dword:00000002
"Warning"=dword:00000000
"Error"=dword:00000000
"Audit Success"=dword:00000000
"Audit Failure"=dword:00000001
"notID"=dword:00000000
"notMatch"=dword:00000000
"notSource"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Cheshire Cat\Nagios\Filter1]
"filterDesc"="Ignore Some Failure Audits"
"eventLogName"="Security"
"serviceName"="EventLogs"
"ID"="565,677,537"
"matchString"=""
"source"=""
"eventLog"=dword:00000005
"Information"=dword:00000000
"status"=dword:00000002
"Warning"=dword:00000000
"Error"=dword:00000000
"Audit Success"=dword:00000000
"Audit Failure"=dword:00000001
"notID"=dword:00000001
"notMatch"=dword:00000000
"notSource"=dword:00000000