Time parsing starting 25 seconds early

[Carter Bullard]

Hey Nick,
Well, in bi_directional flows you can have start and end times for both directions.  You select the tracking of that is the argus.conf file.

Carter


Carter Bullard
QoSient LLC
150 E. 57th Street Suite 12D
New York, New York 10022
+1 212 588-9133 Phone
+1 212 588-9134 Fax

-----Original Message-----
From: "Nick Diel" <nick at engineerity.com>

Date: Thu, 17 Apr 2008 10:12:05 
To:"Carter Bullard" <carter at qosient.com>
Cc:argus-info at lists.andrew.cmu.edu
Subject: Re: [ARGUS] Time parsing starting 25 seconds early


Carter,

Thanks for the clarification, you were right.  When would a record have 4 time stamps?

Also congrats on the 3.0 release.

Nick


On Wed, Apr 16, 2008 at 7:19 PM, Carter Bullard <carter at qosient.com <mailto:carter at qosient.com> > wrote:
 Hey Nick
 This maybe correct behavior.  Each argus record has 2 timestamps, and as many
 as 4 timestamps.  When you specify a timerange, the records that match are
 based on the time comparison method.  The default is "i", intersects.  So if the
 argus "stime - ltime" range intersects the timerange filter, then the filter
 matches.
 
 Be sure and print the "ltime" to see if it falls in the time filter range.
 
 Carter



 
 On Apr 16, 2008, at 1:33 PM, Nick Diel wrote:
 
 Hi all,
 
 After experimenting a little bit with the -t option, I noticed it is parsing things 25 seconds before the beginning of the filter.  It doesn't matter what format I enter the time in, the debug output always shows the correct time range.  I am using the latest non RC release of the RA clients.  Below is an example.
 
 ra -D 5 -t 1194484413+10s
 ra[9467.c05af2b7]: 11:07:56.162683 ArgusParseTime (0xb7ee3008, 0xb7ee3078, 0xc8b2e0,1194484413,  ) retn 4: 1194484413
 ra[9467.c05af2b7]: 11:07:56.162803 ArgusParseTime (0xb7ee3008, 0xb7ee30a4, 0xb7ee3078,, +) retn 6: 1194484423
 ra[9467.c05af2b7]: 11:07:56.162842 ArgusCheckTimeFormat (0xc8b2e0, 1194484413+10s) retn 0: 1194484413-1194484423
 ra[9467.c05af2b7]: 11:07:56.162869 ArgusParseTimeArg (1194484413+10s, 5, 0xc8b2e0)
 ra[9467.c05af2b7]: 11:07:56.162923 ArgusAddFileList (0xb7ee3008, -, 1, -1, -1) returning -1
 
 
 ra -u -r argus.out -t 1194484413+10s -s stime
  1194484388.511230
  1194484391.625182
  1194484394.969372
  1194484409.153790
  1194484410.247562
  1194484410.643394
  1194484410.660781
  1194484412.992860
  1194484413.362803
  1194484413.479038
  1194484413.540712
  1194484413.685124
  1194484413.906601
  1194484415.421830
  1194484416.511667
  1194484416.966878
  1194484418.731882
  1194484419.734540
 
 Nick
 
 Carter Bullard
 CEO/President
 QoSient, LLC
 150 E. 57th Street Suite 12D
 New York, New York 10022
 
 +1 212 588-9133 Phone
 +1 212 588-9134 Fax