ra time range option

Carter Bullard carter at qosient.com
Tue Jan 30 09:37:34 EST 2001


Hey Clauss,
   I believe that I will leave the time range specification
as it is in "V", with the modified data format.  This gives
enough flexibility so that one can select records based on
a time criteria.  A better job can be the focus of another
ra* client, that we can release at anytime.

   I do like your suggestions, and I've started a rudimentary
client to implement it, but it will be weeks before I have the
time to do a good job on it.  We'll need a name, so racron()? 
racronus()? ratime()?

   Maybe perl is the way to go with this?

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter at qosient.com
Phone +1 212 813-9426
Fax   +1 212 813-9426


> -----Original Message-----
> From: Clauss Strauch [mailto:Clauss_Strauch at aquila.fac.cs.cmu.edu]
> Sent: Monday, January 29, 2001 2:39 PM
> To: Carter Bullard
> Cc: argus at lists.andrew.cmu.edu
> Subject: Re: ra time range option 
> 
> 
> Hello,
> 	Here are some ideas on specifying time ranges for ra.  
> I don't know
> how tough they'd be to implement, but 'pick' (the MH command) 
> does something 
> similar.
> 
> 						-- Clauss
> 
> ----------------------------------------------------------------
> a given time t partitions flows into 3 sets:
> 
> flows that overlap that time.
> 
> flows that end before t
> 
> flows that start after t
> 
> two time vals, t1 < t2, partition flows into 6 sets (Fn is an 
> example flow
> for each set):
> 
>       F1 |======| 				 F2 |=========|
>            F3 |================|
>                                            F4 |=========|
>               F5 |===========================================|
> 
>                       F6 |=====================|
>      |-------------|-----------------------------|-----------------|
> 		  t1				t2
> 
> 
> F1: flows that end before t1
> F2: flows that start after t2 
> F3: flows that overlap t1 but not t2 
> F4: flows that overlap t2 but not t1 
> F5: flows that overlap both  t1 and t2
> F6: flows that begin and end in the t1..t2 interval
> 
> Also, we're interested in a another set: 
> F7: the current time interval matching returns the union of 
> F3 & F4 & F6
> 
> we want to be able to specify any of these sets without being 
> too convoluted
> wrt argument syntax.
> 
> Use 3 time selection switches:
> 
> -before t
> -after t
> -during t[-t]
> -and 
> 
> -before t1      = selects all flows ending before t1
> -after t2       = selects all flows starting after t2
> -during t       = selects all flows overlapping t
> -during t1-t2   = selects all flows overlapping any  t1 =< t =< t2
> -and 		= union
> 
> F1: flows that end before t1                     = -before t1
> F2: flows that start after t2                    = -after t2
> F3: flows that overlap t1 but not t2             = -during t1 
> -and -before t2
> F4: flows that overlap t2 but not t1             = -during t2 
> - and -after t1
> F5: flows that overlap both                      = -during t1 
> -and -during t2
> F6: flows that begin/end in the t1..t2 interval  = -after t1 
> -and -before t2
> F7: the current time interval syntax		 = -during t1-t2
> 
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3699 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20010130/ca60b881/attachment.bin>


More information about the argus mailing list