raxml help

[tbh]

Thanks for the quick reply! Doh! Not sure why I missed the -M xml
option! I'll play with that a bit and see how it works.

As for the best way to present the data, I'm certainly open to
suggestions. Perhaps a simpler solution is to output the data to csv
and import it into Excel/Access. Currently, (and I'll reiterate my
newbie status) I'm using rasplit to break my output file into multiple
files based on 1 hour increments (it seems to improve the performance
when I pull data instead of using the -t time option). To pull
toptalkers, I use:

racluster -r /usr/local/argus/argus-eth0<time value> -M norep -w - --
ip | rasort -m bytes -w - | ra -nn  -N 25 -s bytes:20 daddr dport
dbytes:20 trans:10 saddr sport sbytes:20

The output gives me the top 25 talkers. If I were to include -F
excel.rc in the ra command, that should output the data as a csv.
Something like:

racluster -r /usr/local/argus/argus-eth0<time value> -M norep -w - --
ip | rasort -m bytes -w - | ra -F excel.rc -nn  -N 25 -s bytes:20
daddr dport dbytes:20 trans:10 saddr sport sbytes:20 > top25.csv

Out of curiousity (and sort of thinking out loud) is there a -s ALL
option? Or would I need to add each field separately?

Anyways, I should then be able to pull the top25.csv file into Excel
and massage the data into charts/graphs. Or, is there a better
(simpler) way?

Thanks again!
tbh

On 1/23/08, Carter Bullard <carter at qosient.com> wrote:
> Hey Tbh,
> The xml support is embedded in all the ra* programs now.
> The "-M xml" option will generate xml output, but ......
> the support is not yet complete.  raxml() would print out
> the entire argus record content, the new scheme is designed
> to use the "-s field ..." option to specify what data would
> be printed.  Because of these changes,  the schema needs
> to be updated.  If you are interested in the xml data output,
> please give it a try and send comments on what is missing
> or how we could do it better.
>
> I don't think xml will provide you any better support than
> just a report or table output, like ratop() provides, if you're
> problem is communicating network concepts like top talkers,
> service utilization, etc...   You will need to think about graphing,
> and viz methods for showing some data types, but xml on its
> own, will not do anything for you.
>
> Please keep this dialog up on the list if you're interested in
> finding the best way to present certain types of data.  I
> think the discussion will help me and the argus community
> a great deal.
>
> For TopN talkers,  isn't a table with the talker id,, in some
> order of topness, and the metrics of interest a good start?
>
>
> Carter
>
> tbh wrote:
> > I'm relatively new to argus, having been using it for about a month
> > now. I've got it up and running fine and am able to pull data with the
> > ra clients just fine. However, I've seen references in the docs and
> > list to raxml. Yet, I can't seem to find it in the latest (rc.67 or
> > rc.66) versions of the ra clients. Has it been removed?
> >
> > What I'm ultimately looking for is a way to present various aspects of
> > the flow data (ie top-talkers, service utilization, etc.) to
> > management. I assume XML is the best path to start down.
> >
> > Thanks in advance!
> >
> > tbh
> >
> >
>
>