ra oddities

[Steve McInerney]

Hi,

got a bit of an odd one here:

We have an argus output file that has gotten corrupted. I believe it was 
due to a powerfail, and then compounded by a lack of argus outfile 
rotation on restart. Ouch.

Consequently the 2.0.5 version of ra can read thru to the point of the 
failure, but no further - which is a bummer as that's only about 400Mb 
ish thru a 680Mb ish uncompressed file...


Being optimistic, I thought I'd give the ra version from 
argus-clients-2.0.6.beta.38 a whirl. Curiously it doesn't even get as 
far as the 2.0.5 ra. Like about 9 days earlier. Which is, needless to 
say but will anyway, odd. There's no system reasons that I'm aware of 
that would have caused anything evil at that point in time.


FWIW, the original file is a gz, if I run the 2.0.5 ra against the 
compressed file it segfaults at the point of the corruption. If I 
manually uncompress or feed via zcat to stdin, no segfault, no warning - 
just not enough records....
The beta 38 ra doesn't give any messages as to why it's dropped earlier 
unless, same as 2.0.5, it's also dealing directly with the compressed 
file. Then you get: "ArgusWarning: ra[3002]: ArgusReadSocketStream: 
malformed argus record len 0"


Any thoughts/suggestions as to what I could do/try to get access to the 
rest of the file? My current thinking is along the lines of "binary cut 
the early ok part and corruption bit's from the start of the 
uncompressed file; ra the post corruption as a separate file". I have no 
idea how easy or difficult this will/would be. :-)


Thanks


- Steve