new clients rc.62 on the server - description of rastream()

Terry Burton tez at terryburton.co.uk
Fri Nov 2 14:03:30 EDT 2007


On Nov 2, 2007 2:33 PM, Carter Bullard <carter at qosient.com> wrote:
> Well, the tool of choice for this situation is rasplit(), and
> to have an independent cron job process the files an
> hour or so after the fact.  rasplit() is rastream() but without
> the buffering or task spawning.
<...splice...>
> Give rasplit() a try, you shouldn't have any memory leak
> problems with it, as it doesn't have any memory
> requirements.

Hi Carter,

Yes, I'm am now successfully using rasplit + cron which works exactly
as I need. rasplit does not have support for running as a daemon using
the "-d" command line argument - is it trivial to add this before the
final release? It certainly helps when you use the right tool for the
job :-)

> rastream() is really trying to bring this stuff into a near
> realtime time frame, and netflow data isn't really appropriate
> for this as it is not well scheduled.
>
> I have found the bug in rastream(), and will have a new clients
> release, rc.63, up in about an hour or so.

I've tested the latest rastream and it does appear to be much better,
however it may still be leaking slowly. I will leave this running
overnight to see whether it is just the initial ramp up of memory or
whether the leak is genuine.


Thanks again,

Tez



More information about the argus mailing list