[ARGUS] ra stops unexpectedly

[slif at bellsouth.net]

> 
> From: Carter Bullard <carter at qosient.com>
> Date: 2004/09/30 Thu AM 11:38:09 EDT
> To: <slif at bellsouth.net>, 
> 	Peter Van Epp <vanepp at sfu.ca>, 
> 	Argus <argus-info at lists.andrew.cmu.edu>
> Subject: Re: [ARGUS] ra stops unexpectedly
> 
> The problem is that if you aren't receiving MAR records,
> then the for argus is probably dead, and you won't receive
> anything ever again.


Why does the TCP protocol try so hard ?
In part because the authors realized there are so many
ways to make re-synchronizing painful and problematic.

Stopping when one "feels" a far end point is no longer connected
just doesn't seem right.  Sure I _can_ write yet another script
to monitor this program.  I would prefer to indicate more
that "Hey, I had to restart that process".  I would likely not
know the reason for the process terminating.  Without that
information, I will have more difficulty trying to apply
a remedy.

The solution that is localized to the problem is the easiest
to maintain.






> 
> So what's to keep the user from writing a script to respawn
> ra(), if that's what the user wants it do?  That's pretty easy
> isn't it?
> 
> 
> 
> 
> > From: <slif at bellsouth.net>
> > Date: Wed, 29 Sep 2004 18:00:56 -0400
> > To: Peter Van Epp <vanepp at sfu.ca>, <argus-info at lists.andrew.cmu.edu>
> > Subject: Re: Re: [ARGUS] ra stops unexpectedly
> > 
> > I don't see the justification for stopping based on
> > not seeing MAR records.  If the connecction was not reset by peer,
> > I would prefer the client do everything it possibly can
> > to connect to its server.
> > 
> > If the connection breaks, throw a log message and try again.
> > If that fails, wait one minute.
> > Repeat until an operator or user stops the client.
> > 
> > Then again, I don't know whether the argus clients meet
> > the expectations of other users.
> > 
> > 
> > 
> >> 
> >> From: Peter Van Epp <vanepp at sfu.ca>
> >> Date: 2004/09/29 Wed PM 05:28:06 EDT
> >> To: argus-info at lists.andrew.cmu.edu
> >> Subject: Re: [ARGUS] ra stops unexpectedly
> >> 
> >> It looks like this shouldn't happen :-). Even on an idle link you
> >> should be getting mar records every reporting interval and that (perhaps
> >> anyway) should reset the counter I'd expect. As a quick workaround (until
> >> Carter can suggest what may really be wrong :-)) try commenting out the
> >> timeout
> >> in argus_parse.c:
> >> 
> >> at line 2737
> >> 
> >>                   ArgusAdjustGlobalTime(&ArgusRealTime);
> >> 
> >> /*              
> >>                   if (input->hostname && input->ArgusMarInterval) {
> >>                      if (input->ArgusLastTime.tv_sec) {
> >>                         if ((ArgusRealTime.tv_sec -
> >> input->ArgusLastTime.tv_sec)
> >>> (3 * input->ArgusMarInterval)) {
> >>                            ArgusLog (LOG_WARNING, "ArgusReadStream %s: idle
> >> stre
> >> am: closing", input->hostname);
> >>                            ArgusCloseInput(input);
> >>                            ArgusRemoteFDs[i] = NULL;
> >>                         }
> >>                      }
> >>                   }
> >> */
> >> 
> >> That should stop the timeout, (it may also do something else
> >> undesirable though :-)). The trick would be to see where (and by what)
> >> 
> >> input->ArgusLastTime.tv_sec
> >> 
> >> is being updated. I'd expect MAR records to do that and thus avoid this. All
> >> that said my link must not get busy, because it doesn't happen here (of
> >> course 
> >> the link between the two is a 3 ft crossover cable too).  Could you be seeing
> >> a link interruption between the sensor and the host that ra is running on so
> >> you really don't see any MAR records for an interval? That would be another
> >> possibility.
> >> 
> >> Peter Van Epp / Operations and Technical Support
> >> Simon Fraser University, Burnaby, B.C. Canada
> >> 
> >> On Wed, Sep 29, 2004 at 04:53:02PM -0400, slif at bellsouth.net wrote:
> >>>        The remote argus is from argus-2.0.6.fixes.1
> >>> 
> >>>   Running "ra -w FILE -S IP" from argus-clients-2.0.6.fixes.1
> >>> 
> >>>  "ra" will return unexpectedly.
> >>>  This message is displayed :
> >>> 
> >>>     "ArgusWarning: ra[PID]: ArgusReadStream IP: idle stream: closing"
> >>> 
> >>> 
> >>>  What can be done so that "ra" will not stop when stream
> >>>    is apparently idle ?
> >>> 
> >> 
> > 
> > 
> 
> 
>