argus status

[Carter Bullard]

Gentle people,
   OK, I have addressed all faulting problems that I can test
for and so we're back to basic testing.  

I would like to start tackling ragator(), both testing and
documentation.   ragator (ra aggregator) is designed as a
general Argus Record Aggregator.  This tool replaces
connections() in the 1.x releases.  It allows you to
specify what records to merge together, how they should be
merged, and for how long.  The output is a standard Argus
Data file, with what should be considerable reduction in
size.

Without any options ragator() works just like connections()
in that it will merge records that belong to the same flow.
With the "-f option" you specify other aggregation strategies.
Since the configuration file is the basis of the tool, I
thought I would focus on it as a start on the documentation
and testing.   In "v", I have included a more detailed
example of a ragator() configuration in ./examples/fmodel.conf.
The example is somewhat "bogus" but it does provide a better
description on how to use the config.

I'm going to use the connections.1 man page as a start for
the ragator.1 man page.

If you could look at this and give feedback on anything
regarding this tool.  It is going to be a very good tool
for Argus, and so I'd like to do a good job.  As a result
I need your help.

It would probably be better if we had multiple examples,
that are shorter and to the point.  Does anyone have any
suggestions of configuration examples?  Does anyone have
any problems they need to solve that would involve merging
Argus records together?

Your opinions, no matter how simple they may seem, are very
important here, so please don't be quiet.

Carter   

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 17A
New York, New York  10022

carter at qosient.com
Phone +1 212 813-9426
Fax   +1 212 813-9426
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20001107/b75709de/attachment.html>