problem experienced with ra client: unequal results

[carter at qosient.com]

Hey Réal,
Yes, put the file in the incoming directory at qosient.com (anonymous ftp).

Carter

Carter Bullard
QoSient LLC
150 E. 57th Street Suite 12D
New York, New York 10022
+1 212 588-9133 Phone
+1 212 588-9134 Fax

-----Original Message-----
From: real.melancon at videotron.ca

Date: Thu, 05 Jul 2007 13:32:05 
To:carter at qosient.com
Cc:Argus <argus-info at lists.andrew.cmu.edu>
Subject: Re : Re: [ARGUS] problem experienced with ra client: unequal results


Hi Carter. Additionnal information:

I think the problem is with specific records, or the *amount* of data to work on. But i am not sure.

For example. Today I tried this and got a segmentation fault:

/usr/local/bin/racluster -V -m saddr daddr proto sport dport -r /var/log/argus/archive/2007/06/30/argus.2007.06.30.00.00.01.gz
Segmentation fault

This is data collected between 00:00 and 00:59AM. File size is 23 megs., and if I try the whole day it segsfault as well (350 MB.)

But if I run the next hour (from 01:00 to 01:59), it works:

/usr/local/bin/racluster -V -m saddr daddr proto sport dport -r /var/log/argus/archive/2007/06/30/argus.2007.06.30.01.00.01.gz

   23:59:30.657676  e          udp        10.6.104.17.netbio    ->          10.0.10.3.netbio     1290        0
      141900            0   INT
etc...

Is there any way I can upload the crashing file via FTP, so you can look at it ? SMTP won't allow me to send anything over 20 megs uncompressed, and the file causing the seg. fault is 23 megs.

Thanks again,

Real.


____________________________
Réal Melançon