FWD: RE: Argus, and moving 'live files'

[Carter Bullard]

Hey Chris,
What others have seen, is that the second process that argus
spawns, is either eating up a lot of CPU or none at all.
This is the flow record multiplexor, and so if its not doing
what its suppose to do, then nothing is going to come out of
the argus.

There are several debugging strategies to find out what is
going on.  The first is to do a simple ps() to make sure that all
the processes are there.  In the case of writing out to a file,
you should have at least 3 argus processes running all the time.
If you do have 3 processes, you can use gdb to attach to each
running process, and then step through them for a few
instructions to see what they are doing.

Another strategy is to turn debug support on for each process.
If you've compiled in debug support, then you can send SIGUSR1
signals to any argus process to turn on its debug reporting. 
So as an example, assuming that the 3 processes are 200, 201
and 202:

   # kill -USR1 202

will turn on debug reporting and set the debug level to one.
Sending another SIGUSR1 will increment the debug level.  To
turn it off, send a SIGUSR2 to the process.

   # kill -USR2 202

So you can test them all, by getting their debug level to 3 or
4 and see what they think is going on.

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter at qosient.com
Phone +1 212 588-9133
Fax   +1 212 588-9134
http://qosient.com 

> -----Original Message-----
> From: Chris Newton [mailto:newton at unb.ca]
> Sent: Thursday, March 08, 2001 1:33 PM
> To: Carter Bullard; argus; Peter Van Epp
> Subject: RE: FWD: RE: Argus, and moving 'live files'
> 
> 
> >===== Original Message From <carter at qosient.com> =====
> >Hey Guys,
> >   Chris, more than likely your problem doesn't have anything
> >to do with the file moving itself.  If Argus breaks, you will
> >see that your file moving strategy will suddenly stop, as
> >there won't be a file to move any more.  So the file moving
> >makes the problem much more apparent.
> 
>   Thats whats happening.  I get errors from my script that 
> the 'argus-output' 
> file does not exist, and therefore, can't be moved.  Argus is 
> still running 
> happily though.
> 
>   It happens out of the blue (the couple of times it has 
> happened).  The 
> moving script runs happily along.. then, boom... errors, 'no 
> such file'.  I 
> check, sure enough, Argus isn't recreating the new 
> 'argus-output' file 
> anymore.  Kill restart argus, everything returns to normal.
> 
> Chris
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20010308/d0efbd23/attachment.html>