argusarchive.

[Peter Van Epp]

	I have. I found the ragator step in the script was running out of 
memory on big files and exiting. I fixed this (and didn't remember to report
it) by doing this:

          
#if [ -f $ARCHIVE.tmp ]; then
#  $RAGATOR -VRr $ARCHIVE.tmp -w - | $RASORT -w $ARCHIVE
#  $RASORT -r $ARCHIVE.tmp -w $ARCHIVE
#else
#   echo "argus data file not moved."
#   exit
#fi

	To test feed one of the files that didn't convert to ragator on the 
command line and see if you get an out of memory complaint (and/or check
the output from the script if you are keeping it).

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada


> 
> 
> > Hey Scott,
> >    This is not a good thing.  I have not had this
> > happen.  So a few questions.  What system, what is the
> > approximate record load, and how often are you running
> > argusarchive.  Any corefiles laying around?  Did this
> > just start, or has it been going on for a while?
> > 
> 
> This is a new behaviour, however, it's also a new system, which no doubt
> confuses things more.  Debian is the OS, some other stats:
> 
> gcc version 2.95.4 20011006
> argus 2.0.3 (but just upgraded to 2.0.4)
> argusarchive runs hourly.
> No core files
> 
> Loading information:
> 
> racount    records       total_pkts         src_pkts         dst_pkts total_bytes        src_bytes        dst_bytes
>     sum    7492124        201363675        119306845         82056830 121512216040      56550949602      64961266438
> 
> That's for an hour when it did rotate correctly.  For one that did not:
> 
> racount    records       total_pkts         src_pkts         dst_pkts total_bytes        src_bytes        dst_bytes
>     sum    9087465        217167747        132217881         84949866 121941656909      56882605415      65059051494
> 
> Not a huge difference..
> 
> Scott
> 
>