time filtering with -t

[carter at qosient.com]

Hey Wolfgang,
Minor nit; I believe the syntax is lower case 'm' and 'h', not online so can't check.   I think 'M' is month, at least that is the intended syntax.

With "-t -5m" the time is relative to now.  So in most cases between runs of the same command, you will get different data, although none of your data looks quite right, and the uppercase may not explain it.

With "-t -5m+30m", you should just get the last 5 minutes.  I'll take a look at this on Monday.  Any different if you use lower case?

Carter


Carter Bullard
QoSient LLC
150 E. 57th Street Suite 12D
New York, New York 10022
+1 212 588-9133 Phone
+1 212 588-9134 Fax  

-----Original Message-----
From: wob at swobspace.de (Wolfgang Barth)
Date: Sat, 7 Apr 2007 16:19:53 
To:argus-info at lists.andrew.cmu.edu
Subject: [ARGUS] time filtering with -t

Hi,

I have some problems with -t.

% ra -r /var/log/argus/argus.log -s stime ltime dur -t -60M 
StartTime            LastTime        Dur 
2007-04-07 14:59:11 2007-04-07 15:00:06  54.765503
2007-04-07 14:59:15 2007-04-07 15:00:14  59.003147

=> correct.

but:

% ra -r /var/log/argus/argus.log -s stime ltime dur -t -60M 
          StartTime            LastTime        Dur 
2007-04-06 23:59:02 2007-04-06 23:59:02   0.022146
2007-04-06 23:59:03 2007-04-06 23:59:03   0.103231

=> should be the same.

% ra -R /var/argus/archive/2007/04 -r /var/log/argus/argus.log \
	-s stime ltime dur -t -1H 

          StartTime            LastTime        Dur 
2007-04-06 22:59:13 2007-04-06 23:00:12  59.156147
2007-04-06 22:59:20 2007-04-06 23:00:20  59.230412

=> wrong. It is the last hour from -R data, -r argus.log is ignored.

% ra -R /var/argus/archive/2007/04 -r /var/log/argus/argus.log \
	-s stime ltime dur -t -2d

=> no output. There is definitive data from all days since 2007-04-01 in
the directory /var/argus/archive/2007/04.

And what is about -t -5M+30M? It shows records from the past thirty
minutes. What is the expected behavior? The current one, or only the past 5
minutes?

Regards,
Wolfgang
-- 
<wob (at) swobspace de> * http://www.swobspace.de