[ARGUS] Argus clients on Linux on SPARC?

[Carter Bullard]

Hey Guys,
   Sorry for the delayed response, I was on the road.  Yes,
evidently 64bit machines change the definition of (struct timeval)
which we use for the two flow timestamps in each record, to 2
64-bit values (seconds and uSecond), instead of the two
32-bit values argus expects.  This will mess every thing up
in terms of aligning data, (IP addresses are not where they
are suppose to be).

   The clients are next on the list of things to do, so 64-biting
the clients seems to be high on the list?

   On the sorting side, I have a solution, rasplit() which
takes files and splits them up based on things like time, number
of records, or file size.  Amazingly, I even have a manpage.
I'll add this to the client package.  If anyone thinks they need
this almost immediately, send mail to the list and I'll send a
copy of the client to you.

Carter





-----Original Message-----
From: owner-argus-info at lists.andrew.cmu.edu
[mailto:owner-argus-info at lists.andrew.cmu.edu] On Behalf Of Andrew Pollock
Sent: Saturday, June 05, 2004 4:09 AM
To: Peter Van Epp
Cc: argus-info at lists.andrew.cmu.edu
Subject: Re: [ARGUS] Argus clients on Linux on SPARC?

On Thu, Jun 03, 2004 at 09:06:51PM -0700, Peter Van Epp wrote:
> 	Is it a 64 bit Sparc/Linux? Someone on FreeBSD (I think) had
problems
> with time_t being 64 bits instead of the assumed 32. Something like that
seems
> a likely cause here (in which case there isn't an immediate cure other
than
> downgrading to a 32 bit implementation if that is possible).

I'm wondering if that's got something to do with it.

As I understand it, the kernel's 64 bit, but all the userspace stuff is
compiled 32 bit.

Certainly, uname -m yields "sparc64". If I run sparc32 first, it yields just
"sparc", but the manpage for sparc32 says that that's pretty much what
sparc32's supposed to do.

The most recent build log is at
http://buildd.debian.org/fetch.php?&pkg=argus-client&ver=2.0.6.beta.47-1&arc
h=sparc&stamp=1085621337&file=log&as=raw

but it doesn't scream 64 bit or 32 bit. I'm just trying a test build in a
sparc32 environment to see what happens...

No joy.

regards

Andrew