[ARGUS] ra stops unexpectedly

Peter Van Epp vanepp at sfu.ca
Wed Sep 29 17:28:06 EDT 2004

	It looks like this shouldn't happen :-). Even on an idle link you 
should be getting mar records every reporting interval and that (perhaps
anyway) should reset the counter I'd expect. As a quick workaround (until 
Carter can suggest what may really be wrong :-)) try commenting out the timeout
in argus_parse.c:

at line 2737


                  if (input->hostname && input->ArgusMarInterval) {
                     if (input->ArgusLastTime.tv_sec) {   
                        if ((ArgusRealTime.tv_sec - input->ArgusLastTime.tv_sec)
 > (3 * input->ArgusMarInterval)) {
                           ArgusLog (LOG_WARNING, "ArgusReadStream %s: idle stre
am: closing", input->hostname);
                           ArgusRemoteFDs[i] = NULL;

	That should stop the timeout, (it may also do something else 
undesirable though :-)). The trick would be to see where (and by what)


is being updated. I'd expect MAR records to do that and thus avoid this. All 
that said my link must not get busy, because it doesn't happen here (of course 
the link between the two is a 3 ft crossover cable too).  Could you be seeing 
a link interruption between the sensor and the host that ra is running on so 
you really don't see any MAR records for an interval? That would be another 

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada

On Wed, Sep 29, 2004 at 04:53:02PM -0400, slif at bellsouth.net wrote:
>        The remote argus is from argus-2.0.6.fixes.1
>   Running "ra -w FILE -S IP" from argus-clients-2.0.6.fixes.1
>  "ra" will return unexpectedly.
>  This message is displayed :
>     "ArgusWarning: ra[PID]: ArgusReadStream IP: idle stream: closing"
>  What can be done so that "ra" will not stop when stream
>    is apparently idle ?

More information about the argus mailing list