racluster dying consistently on some files.

[Russell Fulton]

No need :)  I've found the problem.  I was using -f <conf file> rather
then -F, sigh...

-f does not seem to be documented in any of the usage messages -- have
not looked at the man pages.  From memory it used to be used to supply a
pcap filter.  Anyway racluster ran with -f <conf file> and gave no
errors and then aborted.  It even produced an output file!

I've tripped over the confusion between -f and -F before with ragator,
now that I think about it.

Russell.

Carter Bullard wrote:
> Hey Russell,
> I'll need a file to see what is going on.   Shouldn't be a problem if
> we can get a sample.
>
> Carter
>
> On Feb 25, 2007, at 11:01 PM, Russell Fulton wrote:
>
>> This happened with rc39.
>>
>> racluster[1321]: 2007-02-26 16:43:51+1300.315332
>> ArgusRemoveFromQueue(0x9f1b8e8, 0x9f8cd60) obj not in queue
>>
>> The files were generated with an older version of argus 3.0 (rc37)
>>
>> Any ideas what is going on.
>>
>> I got a whole heap of hourly files from about a week ago that racluster
>> failed for.  I can try chopping one up to get a smaller file which
>> illustrates the problem.
>>
>>
>> Russell.
>>
>
>