What does ramon (TopN mode) actually do?

Andrew Pollock andrew-argus at andrew.net.au
Tue Jul 1 23:58:30 EDT 2003


On Tue, Jul 01, 2003 at 11:38:41AM -0400, Carter Bullard wrote:
> Hey Andrew,
>    It's easy to get the data to agree, it's just you
> have to make sure that you know what you're asking for
> so you can get the filtering right.  But I think that
> there is still some confusion.  While ramon() does
> generate valid argus output, you can't take the output
> of a Svc run and then process it to get a TopN report,
> as the models are not compatible.  The keys that each
> are using to do the aggregation are not comparable from
> a relational algebraic perspective.  Its like trying
> to count the number of tennis shoes from a set of data
> that reference only the color of pants in a group.

I understand the "apples and oranges" factor of what I'm trying to do.
 
>    If you want ramon() to provide you with an interface
> oriented breakdown by protocol for each address, we
> can add that ramon() without any trouble.  Just need
> come up with a name for the mode and I'll whip it up in
> an hour or so.

You're most kind. I need to be able to do it on a per address and a per 
net basis.

Andrew



More information about the argus mailing list