ra loops forever on cisco netflow file

dbrumley at puttputt.Stanford.EDU dbrumley at puttputt.Stanford.EDU
Tue Mar 6 14:42:49 EST 2001


>Description:
  ra() never exits when reading cisco netflow log files.

>How-To-Repeat:

  when reading a cisco log file, ra keeps looping.  I think this is
because the same code used to read from a udp socket is used to read
from a file.  However, they are different, as the read from udp should
continue until the user aborts (through control-c or some byte count),
while reading from a file should exit when EOF is reached.

Here's the code area:
(gdb) bt
#0  0xff2171d4 in _read () from /usr/lib/libc.so.1
#1  0x1be68 in ArgusReadCiscoStreamSocket (input=0x1214d0)
     at ./argus_parse.c:1479
#2  0x1c444 in ArgusReadStream () at ./argus_parse.c:1640
#3  0x19458 in main (argc=4, argv=0xffbefa6c) at ./argus_parse.c:494
(gdb)

read() just blocks.

>Fix:
  I don't know yet :)

>Submitter-Id:  dbrumley
>Originator:
>Organization:
  stanford university
>Argus support: none
>Release:       argus-2.0
>Product:       ra
>Synopsis:      ra loops forever on cisco netflow file
>Class:	        sw-bug
>Severity:      serious
>Priority:      medium

>Environment:   solaris 7 64 bit mode

System:  SunOS flw-clt-master 5.7 Generic_106541-04 sun4u sparc SUNW,Ultra-4
Arch:    sun4

Paths:    /usr/local/bin/ra /usr/local/bin/make /usr/pubsw/bin/gmake
/usr/local/bin/gcc /usr/local/bin/cc


RA:      Ra Version 2.0.0.beta.8


GCC:     Reading specs from
/usr/local/lib/gcc-lib/sparc-sun-solaris2.7/2.8.1/specs gcc version 2.8.1

LIBC:
-rw-r--r--   1 bin      bin       1694308 Nov  2 22:06 /lib/libc.a
lrwxrwxrwx   1 root     root           11 May 13  1999 /lib/libc.so ->
./libc.so.1 -rwxr-xr-x   1 bin      bin       1115940 Nov  2 22:06
/lib/libc.so.1 -rw-r--r--   1 bin      bin       1694308 Nov  2 22:06
/usr/lib/libc.a lrwxrwxrwx   1 root     root           11 May 13  1999
/usr/lib/libc.so -> ./libc.so.1 -rwxr-xr-x   1 bin      bin       1115940
Nov  2 22:06 /usr/lib/libc.so.1


---------- End Forwarded Message ----------



---
Jeffrey T. Eaton                    esp              jeaton+ at andrew.cmu.edu
Research Systems Programmer                      Carnegie-Mellon University



More information about the argus mailing list