Fixed one bug, got some more for ya though :)

[Chris Newton]

Ok, I changed the value to 2048, and I'll see how it handles our net with 
that.  Thanks :)

Chris

>===== Original Message From <carter at qosient.com> =====
>Hey Chris,
>One value for you to play with is ARGUS_MAXWRITENUM in
>ArgusUtil.c.  This is the maximum number of records
>that we will write out to the socket on each pass.  For
>some situations we only process 10 passes a second, and
>so increasing this number to say 1024, or 2048 may be
>more than appropriate.  Now, large numbers here will
>get in the way of argus getting back to process packets,
>so you don't want to go toooo high here.
>
>ARGUS_LISTREPORTLEN is just the number in the queue
>that will trigger syslog events saying that you're queues
>are getting a bit full.  The ARGUS_LISTREPORTTIME is just
>how frequently are you going to get messages once the
>queue has gotten over the limit.  Current we send out
>syslog messages every 30 seconds.
>
>So when these messages are being printed, there are
>currently 10,000 argus records queue'd to be written
>out to, say the file, or the remote socket.  That's not
>a huge number, as in some situations, argus can generate
>10,000 records a second.  We don't give up on the
>queue until about 200,000 records, so 10K is a bit low
>for a warning condition.
>
>Carter
>
>-----Original Message-----
>From: Chris Newton [mailto:newton at unb.ca]
>Sent: Thursday, June 14, 2001 11:08 AM
>To: Carter Bullard
>Cc: Argus (argus-info)
>Subject: RE: Fixed one bug, got some more for ya though :)
>
>
>>One thing you can do is to increase the values of the thresholds. If
>>you double the value for ARGUS_MAXERROR in ArgusUtil.c, that will help
>>a bit.  Also raising the watermark for printing out when queues are
>>getting big will help, so increase the value of ARGUS_LISTREPORTLEN to
>>something like 50,000. This is also in ArgusUtil.c.
>
>  So, what does ARGUS_LISTREPORTLEN actually control?  The number of
>flows to
>burst out at a time?
>
>  I also notice a ARGUS_LISTREPORTTIME set to 30, is this a delay
>setting?
>Reason I'm asking is it _seems_ to me, that during these times of issue
>on our
>net, argus gets bunged up a bit because it isn't dumping records out as
>fast
>as it could be.
>
>  What values control this?  I'd be willing to try various values
>here... so
>that I can find some 'best middle ground', between letting the collector
>and
>stats parts of argus do it's job, and the 'dumper' push records out as
>fast as
>possible.
>
>Thanks
>
>Chris
>
>_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
>
>Chris Newton, Systems Analyst
>Computing Services, University of New Brunswick
>newton at unb.ca 506-447-3212(voice) 506-453-3590(fax)
>
>"The best way to have a good idea is to have a lot of ideas." Linus
>Pauling (1901 - 1994) US chemist

_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/

Chris Newton, Systems Analyst
Computing Services, University of New Brunswick
newton at unb.ca 506-447-3212(voice) 506-453-3590(fax)

"The best way to have a good idea is to have a lot of ideas."
Linus Pauling (1901 - 1994) US chemist