Time parsing starting 25 seconds early

Nick Diel nick at engineerity.com
Thu Apr 17 12:12:05 EDT 2008


Carter,

Thanks for the clarification, you were right.  When would a record have 4
time stamps?

Also congrats on the 3.0 release.

Nick

On Wed, Apr 16, 2008 at 7:19 PM, Carter Bullard <carter at qosient.com> wrote:

> Hey Nick
> This maybe correct behavior.  Each argus record has 2 timestamps, and as
> many
> as 4 timestamps.  When you specify a timerange, the records that match are
> based on the time comparison method.  The default is "i", intersects.  So
> if the
> argus "stime - ltime" range intersects the timerange filter, then the
> filter
> matches.
>
> Be sure and print the "ltime" to see if it falls in the time filter range.
>
> Carter
>
>
> On Apr 16, 2008, at 1:33 PM, Nick Diel wrote:
>
>  Hi all,
> >
> > After experimenting a little bit with the -t option, I noticed it is
> > parsing things 25 seconds before the beginning of the filter.  It doesn't
> > matter what format I enter the time in, the debug output always shows the
> > correct time range.  I am using the latest non RC release of the RA clients.
> >  Below is an example.
> >
> > ra -D 5 -t 1194484413+10s
> > ra[9467.c05af2b7]: 11:07:56.162683 ArgusParseTime (0xb7ee3008,
> > 0xb7ee3078, 0xc8b2e0,1194484413,  ) retn 4: 1194484413
> > ra[9467.c05af2b7]: 11:07:56.162803 ArgusParseTime (0xb7ee3008,
> > 0xb7ee30a4, 0xb7ee3078,, +) retn 6: 1194484423
> > ra[9467.c05af2b7]: 11:07:56.162842 ArgusCheckTimeFormat (0xc8b2e0,
> > 1194484413+10s) retn 0: 1194484413-1194484423
> > ra[9467.c05af2b7]: 11:07:56.162869 ArgusParseTimeArg (1194484413+10s, 5,
> > 0xc8b2e0)
> > ra[9467.c05af2b7]: 11:07:56.162923 ArgusAddFileList (0xb7ee3008, -, 1,
> > -1, -1) returning -1
> >
> >
> > ra -u -r argus.out -t 1194484413+10s -s stime
> >  1194484388.511230
> >  1194484391.625182
> >  1194484394.969372
> >  1194484409.153790
> >  1194484410.247562
> >  1194484410.643394
> >  1194484410.660781
> >  1194484412.992860
> >  1194484413.362803
> >  1194484413.479038
> >  1194484413.540712
> >  1194484413.685124
> >  1194484413.906601
> >  1194484415.421830
> >  1194484416.511667
> >  1194484416.966878
> >  1194484418.731882
> >  1194484419.734540
> >
> > Nick
> >
>
> Carter Bullard
> CEO/President
> QoSient, LLC
> 150 E. 57th Street Suite 12D
> New York, New York 10022
>
> +1 212 588-9133 Phone
> +1 212 588-9134 Fax
>
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20080417/f6a08c6c/attachment.html>


More information about the argus mailing list