[ARGUS] ragator flowfile format change?

[Roman Festchook]

Hmm - probably autocorrection useful thing - I just miss it when figuring why 
results of ragator differ.
Thanks for help and info!

On Monday 10 May 2004 18:42, Carter Bullard wrote:
> Hey Roman,
> New code, hidden options.  Take a look at the sample ragator.conf file
> in the ./support/Config directory, it mentions 4 new options, and we need
> to turn one on to get the output you're looking for.
>
> Add this line to the beginning of your 195.68.217.13.new configuration:
>
> RAGATOR_AUTO_CORRECTION=no
>
> You should get the correct output after that.  The record autocorrection
> logic is/was on by default, and it was 'fixing' your data for you.
> This undocumented auto correction feature 'fix's records that may be
> flipped, and it does this by looking to see if the reverse flow is in
> the cache if the forward flow can't be found.  In your case,
>
>    *        <->   x.y.z.w
>
> wasn't in the cache when ragator first see's it in the stream, but
>
>    x.y.z.w  <->   *
>
> is, so, unfortunately, ragator 'corrected' the record.  Not what
> you're looking for.
>
> Its definitely not suppose to be on by default, so I'll fix this
> in the current ragator().
>
>
> Hope this helps!!!!
>
> Carter

-- 
Roman Festchook
Network Engineer
RF2-UANIC FRA11-RIPE