[ARGUS] argus data rates experience?

[Thorbjörn Axelsson]

Richard Johnson wrote:

>I've just reread Peter Van Epp's :login; article from 2001, as it's the
>only place I can find any numbers regarding Argus performance on sample
>networks.  (IOW, article good, my search abilities bad. :-)
>
>I'm now charged with logging traffic across a WAN interface that's peaking
>at 250 Mbps and 30,000 packets/sec.
>
>I'm going to try a 2GHz dual CPU system running FreeBSD using a SysKonnect
>SK9843 GigE interface and a fibrechannel array TBD connected via a Qlogic
>ISP2300 card, and see if it can keep up.  Does that raise any red flags?
>
>In addition, I'm very uncertain as to the storage requirements for log
>files (IOW, how big a chunk of that array will I need?).  Can anyone give
>an idea of how fast the log files might grow per packet under a typical
>university mix of interactive logins and file transfers?
>  
>
Peaks and environment seems to be about the same here, so here's some 
numbers.

This is data for one hour (largest logfile since yesterday):

$ racount -r argus-040402.14
racount    records       total_pkts         src_pkts         
dst_pkts      total_bytes        src_bytes        dst_bytes
    sum    1775757        111579659         60544539         
51035120      86776373674      43645448688      43130924986

$ ll argus-040402.14
-rw-r--r--    1 argus     argus     231129628 Apr  2 14:04 argus-040402.14

Another hour (smallest since yesterday):

$ racount -r argus-040403.07
racount    records       total_pkts         src_pkts         
dst_pkts      total_bytes        src_bytes        dst_bytes
    sum     477808         28198618         13627804         
14570814      20957844828       3918131572      17039713256

$ ll argus-040403.07
-rw-r--r--    1 argus     argus     60425748 Apr  3 07:01 argus-040403.07

regards,
Thorbjörn