argus suggestions please

[Peter Van Epp]

On Fri, Oct 05, 2007 at 11:48:36AM -0700, Michael Hornung wrote:
> Thanks Carter, this is what I was hoping to hear!  You guessed my setup 
> exactly, though I've got a problem with what you sent, and I suspect it 
> may be related to the amount of data.  The box I'm using to do processing 
> is x86 linux (RHEL5) with 2 x dual core 2ghz CPUs and 4GB of RAM.
> 
> % du -hs archive/2007/10/04
> 20G     archive/2007/10/04
> 
> % racluster -R archive/2007/10/04 -M norep -w foo -- ip
> Segmentation fault
> 
<snip>

	My solution in versions past is to use perl and post process to 
intermediate files during the day then combine those intermediate files 
(sometimes still running out of memory) once a day in to a daily report. 
	The scripts are available at ftp.sfu.ca in 

/pub/unix/argus/argus.traffic.perl.tar.gz
	
but at present that is for argus.2.0.6. I have the slight changes needed for
it to work on 3.0 but I haven't put them up yet. Doing it this way you can 
if required spill intermediate data to files to control memory use (although
that can get exciting to do). 

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada