ragator memory usage

[Russell Fulton]

Thanks Carter,

On Thu, 14 Jun 2001 09:12:35 -0400 Carter Bullard <carter at qosient.com> 
wrote:

> Hey Russell,
>    No config file = infinite timeout.   Try a timeout

That's what I suspected.

> of around 3600 seconds.  If you have long running
> transactions, you'll still hourly status reports,
> which maybe good, maybe bad.

I'm processing hourly files one at a time so I'll set it to something 
less than 3600.

> 
> If this is not giving you what you want, then I can
> make a change to ragator() so that it has independent
> idle timeout and per transaction status timeouts.
> Right now they are the same number.
> 
> Give this config a try.
> 
> #label   id    SrcCIDRAddr  DstCIDRAddr Proto  SrcPort  DstPort
> ModelList  Duration
> Flow     100       *            *         *       *        *         200
> 3600
> 
> # label  id      SrcAddrMask     DstAddrMask      Proto  SrcPort
> DstPort
> Model    200   255.255.255.255 255.255.255.255     yes     yes      yes
> 

OK, i've tried this and I now get a segfault (but no core?) after 
processing for a few seconds.  This is a debian Linux system (potato) 
anyone suggest how I can force this to produce a dump?

I've tried various timeouts but it does not seem to make any difference.

Russell Fulton, Computer and Network Security Officer
The University of Auckland,  New Zealand