3.0 multiple output files, separate filters

[Carter Bullard]

Jonathan,
I've fixed this bug, at least as much as I have tested it, so please  
take
a look at *.rc.33* when I get it up on the server later today.

I have changed the syntax slightly, (and updated the documentation),
so try this syntax:
      ARGUS_OUTPUT_FILE="/full/path/file/name filter"

Thanks for the email!!!!!!!!

Carter


On Oct 13, 2006, at 5:01 PM, carter at qosient.com wrote:

> Hey Jonathan,
> It should work, so let's call it a bug.  I'll look into it Sun or  
> Mon.  I would normally not recommend having argus write to multiple  
> files, as it takes cycles away from processing packets.  Why not  
> have a single client do it instead?
>    ra -S localhost -w outfile.1 'filter' -w outfile.2 'filter'
>
> Just a suggestion.
>
> Carter
>
>
> Carter Bullard
> QoSient LLC
> 150 E. 57th Street Suite 12D
> New York, New York 10022
> +1 212 588-9133 Phone
> +1 212 588-9134 Fax
>
> -----Original Message-----
> From: Jonathan Towne <jontow at hijacked.us>
> Date: Fri, 13 Oct 2006 15:13:48
> To:argus-info at lists.andrew.cmu.edu
> Subject: [ARGUS] 3.0 multiple output files, separate filters
>
> All,
>
>
> Doing a bit of testing, I wanted to collect session data on a link,  
> and
> have a separate output file just for one IP address.
>
> I found the option to do this with one instance of argus running,
> but can't seem to get it to work.
>
>
> Found in the example config:
>
> # The format is:
> #      ARGUS_OUTPUT_FILE=/full/path/file/name
> #      ARGUS_OUTPUT_FILE=/full/path/file/name "filter"
>
>
> Now, if I do:
>
> ARGUS_OUTPUT_FILE=/usr/local/argus/log/full.out
> ARGUS_OUTPUT_FILE=/usr/local/argus/log/onecustomer.out "host 1.2.3.4"
>
>
> Both files catch all session data, the filter does not appear to be
> applied.
>
>
> Just curious if this is a bug, or unfinished feature, or if I'm just
> not setting it up quite right, or other?
>
>
> I'm running a build of 3.0.0.rc.31 from Wednesday afternoon, on an  
> i386
> machine with FreeBSD 6.1-STABLE from mid-July.
>
>
> Thanks;
>
> -- Jonathan Towne
>




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20061016/812a09b4/attachment.html>