problem with to read rasplit -w

jean-marc pouchoulon jeanmarc.pouchoulon at gmail.com
Wed Aug 26 21:09:25 EDT 2009


> Hey Jean-Marc,
hello Carter,
> Hmmmm, I see what the problem is and I have a patch, but I don't see
> how it could happen, yet.  The tag that tells us what version of argus 
> we're reading is not in network order, its in host order.  The rest of the
> file is fine.   The patch below should allow you to read any
> files in your archive that are corrupt.   Send mail after you try it.
Ok now I can read the corrupt files :-)
>
> So just a few questions.
>
> Is it an arbitrary hourly file in the directory that is unreadable, or 
> always
> the second one, or every other one?
>
It seems to be every other one , for e.g I've got two days with 
contiguous unreadable files , but it is reversible
> The way that most people would generate this archive is to have radium()
> read the netflow records, and then have rasplit() attach to the radium.
Ok radium works fine thanks
> Did you try that at any time and get different results?  If not, don't 
> worry,

The only thing I can reproduce :
without your patch ra -C IP_SERVER:5661  -w ./testrad.dump produces an 
unreadable testrad.dump file by "unpatched" ra

with your patch the command produces a readable file

with radium all is working fine with and without patch

HTH

thanks a lot Carter for your help






More information about the argus mailing list