[ARGUS] ra stops unexpectedly

[Peter Van Epp]

	It looks like this shouldn't happen :-). Even on an idle link you 
should be getting mar records every reporting interval and that (perhaps
anyway) should reset the counter I'd expect. As a quick workaround (until 
Carter can suggest what may really be wrong :-)) try commenting out the timeout
in argus_parse.c:

at line 2737

                  ArgusAdjustGlobalTime(&ArgusRealTime); 

/*                  
                  if (input->hostname && input->ArgusMarInterval) {
                     if (input->ArgusLastTime.tv_sec) {   
                        if ((ArgusRealTime.tv_sec - input->ArgusLastTime.tv_sec)
 > (3 * input->ArgusMarInterval)) {
                           ArgusLog (LOG_WARNING, "ArgusReadStream %s: idle stre
am: closing", input->hostname);
                           ArgusCloseInput(input);
                           ArgusRemoteFDs[i] = NULL;
                        }
                     }
                  }
*/

	That should stop the timeout, (it may also do something else 
undesirable though :-)). The trick would be to see where (and by what)

input->ArgusLastTime.tv_sec 

is being updated. I'd expect MAR records to do that and thus avoid this. All 
that said my link must not get busy, because it doesn't happen here (of course 
the link between the two is a 3 ft crossover cable too).  Could you be seeing 
a link interruption between the sensor and the host that ra is running on so 
you really don't see any MAR records for an interval? That would be another 
possibility.

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada

On Wed, Sep 29, 2004 at 04:53:02PM -0400, slif at bellsouth.net wrote:
>        The remote argus is from argus-2.0.6.fixes.1
> 
>   Running "ra -w FILE -S IP" from argus-clients-2.0.6.fixes.1
> 
>  "ra" will return unexpectedly.
>  This message is displayed :
> 
>     "ArgusWarning: ra[PID]: ArgusReadStream IP: idle stream: closing"
> 
> 
>  What can be done so that "ra" will not stop when stream
>    is apparently idle ?
>