3.0 multiple output files, separate filters

[carter at qosient.com]

Hey Jonathan,
It should work, so let's call it a bug.  I'll look into it Sun or Mon.  I would normally not recommend having argus write to multiple files, as it takes cycles away from processing packets.  Why not have a single client do it instead?
   ra -S localhost -w outfile.1 'filter' -w outfile.2 'filter'

Just a suggestion.

Carter


Carter Bullard
QoSient LLC
150 E. 57th Street Suite 12D
New York, New York 10022
+1 212 588-9133 Phone
+1 212 588-9134 Fax  

-----Original Message-----
From: Jonathan Towne <jontow at hijacked.us>
Date: Fri, 13 Oct 2006 15:13:48 
To:argus-info at lists.andrew.cmu.edu
Subject: [ARGUS] 3.0 multiple output files, separate filters

All,


Doing a bit of testing, I wanted to collect session data on a link, and
have a separate output file just for one IP address.

I found the option to do this with one instance of argus running,
but can't seem to get it to work.


Found in the example config:

# The format is:
#      ARGUS_OUTPUT_FILE=/full/path/file/name
#      ARGUS_OUTPUT_FILE=/full/path/file/name "filter"


Now, if I do:

ARGUS_OUTPUT_FILE=/usr/local/argus/log/full.out
ARGUS_OUTPUT_FILE=/usr/local/argus/log/onecustomer.out "host 1.2.3.4"


Both files catch all session data, the filter does not appear to be
applied.


Just curious if this is a bug, or unfinished feature, or if I'm just
not setting it up quite right, or other?


I'm running a build of 3.0.0.rc.31 from Wednesday afternoon, on an i386
machine with FreeBSD 6.1-STABLE from mid-July.


Thanks;

-- Jonathan Towne