ragator memory usage

[Carter Bullard]

Hmmmmm,
   Is this argus-clients code or argus-2.0.2 code?
Carter

-----Original Message-----
From: owner-argus-info at lists.andrew.cmu.edu
[mailto:owner-argus-info at lists.andrew.cmu.edu] On Behalf Of Russell
Fulton
Sent: Thursday, June 14, 2001 6:26 PM
To: argus-info at lists.andrew.cmu.edu
Subject: Re: RE: ragator memory usage


Thanks Carter,

On Thu, 14 Jun 2001 09:12:35 -0400 Carter Bullard <carter at qosient.com> 
wrote:

> Hey Russell,
>    No config file = infinite timeout.   Try a timeout

That's what I suspected.

> of around 3600 seconds.  If you have long running transactions, you'll

> still hourly status reports, which maybe good, maybe bad.

I'm processing hourly files one at a time so I'll set it to something 
less than 3600.

> 
> If this is not giving you what you want, then I can
> make a change to ragator() so that it has independent
> idle timeout and per transaction status timeouts.
> Right now they are the same number.
> 
> Give this config a try.
> 
> #label   id    SrcCIDRAddr  DstCIDRAddr Proto  SrcPort  DstPort
> ModelList  Duration
> Flow     100       *            *         *       *        *
200
> 3600
> 
> # label  id      SrcAddrMask     DstAddrMask      Proto  SrcPort
> DstPort
> Model    200   255.255.255.255 255.255.255.255     yes     yes
yes
> 

OK, i've tried this and I now get a segfault (but no core?) after 
processing for a few seconds.  This is a debian Linux system (potato) 
anyone suggest how I can force this to produce a dump?

I've tried various timeouts but it does not seem to make any difference.

Russell Fulton, Computer and Network Security Officer
The University of Auckland,  New Zealand