reading argus files using non-sequential access

[Peter Van Epp]

On Thu, Feb 01, 2007 at 09:27:10AM -0600, Karl Tatgenhorst wrote:
> 
>   The files I generate are large (> 2GB) and I can see using the offsets
> as a tremendous boon for reanalyzing data, but only if I have a way of
> displaying the offset originally. Then when someone wants to look at my
> data they can start at the point in the file where the actual data shows
> up, shaving seconds off their seek time.
> 
> 
> Karl
> 

	That initial offset is of course the rub. I suspect the answer to that
is to (optionally?) have argus or more likely ra (since argus is likely 
writing to a socket on a high volume installation and ra is archiving) output 
the offset of a record in the output file every once in a while probably with 
a timestamp so as to create an offset index to the argus file by time (that
still leaves the problem of wanting to filter for some particular field other
than time though). 

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada