racluster issues

[VIEAU Cédric 172196]

Hi Carter,

I'm using argus-clients 3.0 rc.23 with argus v2 data files on Debian Etch EM64. Here are two small segfaults with racluster and a question about racluster.conf.

First, racluster generates a segfault with parameter '-f' if the config file does not exist.
In argus_client.c line 5865, ArgusLog('file not found') calls ArgusShutdown() but it returns instead of exiting because ArgusParser->RaParseDone == 0.
See attached file "gdb_f_segault.txt" for gdb output.

Next, one of my argus data files generates a segfault with racluster, whereas racount just says "ArgusReadStreamSocket (0x11960) record length is zero". Corresponding gdb output is in attached file "gdb_zero_length_rec.txt". Unfortunately I can't provide the data file because it contains some sensitive information.

Finally, it seems that using any of the racluster.conf options (RACLUSTER_MODEL_NAME, RACLUSTER_PRESERVE_FIELDS, etc.) disables the flows definitions, as if no '-f racluster.conf' where given. 
Looking at the source code in argus_client.c::ArgusParseAggregator(), it seems that those options are not implemented. Could you confirm that racluster.conf options are not available, and do you plan on adding this features in future releases?

Thanks,
Cedric
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: gdb_f_segfault.txt
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20060810/ebcd0cb2/attachment.txt>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: gdb_zero_length_rec.txt
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20060810/ebcd0cb2/attachment-0001.txt>