-t Option in Racluster

[Carter Bullard]

Hey Barry,
The way that I do this is to use rasplit() to put data as it comes in,  
into a data
archive that is based on year/month/day, and then use cron to fire up  
a report
generator on the first day of the month.

    rasplit -S argusSource -M time 5m -w /archivePath/%Y/%m/%d/argus. 
%Y.%m.%d.%H.%M.%S

The data from my argus source would be written into this file, right  
now,
as /path/2008/06/30/argus.2008.06.30.09.55.00 and starting at 10am it  
would start
writing data into /path/200806/30argus.2008.06.30.10.00.00.

When its time to generate a report, you can just run a program like  
ra() to feed data
into your report generator (assuming it likes ascii input):

    ra -R /path/2008/06 | reportScript

This is not the most efficient way, but it highlights how you can  
build a repository that
fits your reporting strategy and how ra* programs can work off of  
whole repositories
at a time.

Racluster will have some problems processing a whole months worth of  
data at a time
if you are a university, but for a small workgroup, a month is usually  
no problem.
However, you can usually generate daily intermediate reports, and if  
you do it right,
racluster only needs to process the daily intermediates to generate  
weekly and monthly
report data.

But to get to your specific question,  the time filter can be  
specific, wildcarded etc..... in
a lot of ways.

If you want to go back to the beginning of the previous month (because  
-1M goes to the
beginning of the current month):
    racluster -t -2M+1M

Its the same algorithm as
    racluster -t -2d+1d

Wildcards like this maybe more useful:
    racluster -t 2008/06

which should match any records that fall into June, of 2008.

I didn't put in 'w'eeks, as that seems confusing for some people  
(which week?),
but filters like "-21w+10s" are useful in that they give you the first  
10 seconds
of some week, (hard to know which one).  But its easy to put it in.

Carter

On Jun 27, 2008, at 11:36 PM, Barry Kolts wrote:

> Hi,
>
> Using Racluster I would like to specify last month for the -t  
> option. I have tried -t -1M but that gives me the current month.  
> Since my data is less than a month old it is difficult for me to  
> play around with -t. I wouldn't know if I got it right because I  
> don't have data that old. My goal is to produce reports on the first  
> of the month for the previous month automatically. Something like -t  
> -1M would make life simple but if it isn't possible I can build the  
> command from a script.
>
> Thanks in advance for any help,
> Barry

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20080630/fb692273/attachment.html>