[ARGUS] ra stops unexpectedly

slif at bellsouth.net slif at bellsouth.net
Wed Sep 29 18:00:56 EDT 2004


I don't see the justification for stopping based on
not seeing MAR records.  If the connecction was not reset by peer,
I would prefer the client do everything it possibly can
to connect to its server.

If the connection breaks, throw a log message and try again.
If that fails, wait one minute.
Repeat until an operator or user stops the client.

Then again, I don't know whether the argus clients meet
the expectations of other users.



> 
> From: Peter Van Epp <vanepp at sfu.ca>
> Date: 2004/09/29 Wed PM 05:28:06 EDT
> To: argus-info at lists.andrew.cmu.edu
> Subject: Re: [ARGUS] ra stops unexpectedly
> 
> 	It looks like this shouldn't happen :-). Even on an idle link you 
> should be getting mar records every reporting interval and that (perhaps
> anyway) should reset the counter I'd expect. As a quick workaround (until 
> Carter can suggest what may really be wrong :-)) try commenting out the timeout
> in argus_parse.c:
> 
> at line 2737
> 
>                   ArgusAdjustGlobalTime(&ArgusRealTime); 
> 
> /*                  
>                   if (input->hostname && input->ArgusMarInterval) {
>                      if (input->ArgusLastTime.tv_sec) {   
>                         if ((ArgusRealTime.tv_sec - input->ArgusLastTime.tv_sec)
>  > (3 * input->ArgusMarInterval)) {
>                            ArgusLog (LOG_WARNING, "ArgusReadStream %s: idle stre
> am: closing", input->hostname);
>                            ArgusCloseInput(input);
>                            ArgusRemoteFDs[i] = NULL;
>                         }
>                      }
>                   }
> */
> 
> 	That should stop the timeout, (it may also do something else 
> undesirable though :-)). The trick would be to see where (and by what)
> 
> input->ArgusLastTime.tv_sec 
> 
> is being updated. I'd expect MAR records to do that and thus avoid this. All 
> that said my link must not get busy, because it doesn't happen here (of course 
> the link between the two is a 3 ft crossover cable too).  Could you be seeing 
> a link interruption between the sensor and the host that ra is running on so 
> you really don't see any MAR records for an interval? That would be another 
> possibility.
> 
> Peter Van Epp / Operations and Technical Support 
> Simon Fraser University, Burnaby, B.C. Canada
> 
> On Wed, Sep 29, 2004 at 04:53:02PM -0400, slif at bellsouth.net wrote:
> >        The remote argus is from argus-2.0.6.fixes.1
> > 
> >   Running "ra -w FILE -S IP" from argus-clients-2.0.6.fixes.1
> > 
> >  "ra" will return unexpectedly.
> >  This message is displayed :
> > 
> >     "ArgusWarning: ra[PID]: ArgusReadStream IP: idle stream: closing"
> > 
> > 
> >  What can be done so that "ra" will not stop when stream
> >    is apparently idle ?
> > 
> 




More information about the argus mailing list