racluster exits

[Carter Bullard]

Hey Torbjörn,
I have made a number of changes to fix your racluster() problem,
and did find a bug,  so we may have a reasonable solution.
Fixes to correction, and idle time calculation.

I will hopefully have the new code up tonight or early tomorrow.

Hope all is well,

Carter





On Dec 28, 2007, at 8:36 AM, Torbjorn.Wictorin at its.uu.se wrote:

> Hi Cartel et al,
>
> I have a configuration with a number of argus:es (half-duplex sensors,
> multiple paths) connected together via radium.
> Output from radium is piped(|) to racluster:
>
> radium -w - -S 127.0.0.1:561 ... -e 1000 -T yes | racluster -w  
> argus.log
>
> racluster.conf:
> RACLUSTER_AUTO_CORRECTION=yes
> filter="" model="saddr sport daddr dport proto" status=0 idle=900
>
> The problem is that racluster exits after some time, after eating up  
> memory, not writing anything to argus.log before it decides to exit.
>
> Looks like racluster needs some flush-trigger. Have I misunderstood  
> something?
>
> latest clients: 3.0.0.rc.66
>
> Torbjörn Wictorin,
> Uppsala Univ