problem with to read rasplit -w

[Carter Bullard]

Hey Jean-Marc,
That is exactly what I needed to know.  The every other file is the  
key!!!
Thanks!!!!!!

Carter

On Aug 26, 2009, at 9:09 PM, jean-marc pouchoulon wrote:

>> Hey Jean-Marc,
> hello Carter,
>> Hmmmm, I see what the problem is and I have a patch, but I don't see
>> how it could happen, yet.  The tag that tells us what version of  
>> argus we're reading is not in network order, its in host order.   
>> The rest of the
>> file is fine.   The patch below should allow you to read any
>> files in your archive that are corrupt.   Send mail after you try it.
> Ok now I can read the corrupt files :-)
>>
>> So just a few questions.
>>
>> Is it an arbitrary hourly file in the directory that is unreadable,  
>> or always
>> the second one, or every other one?
>>
> It seems to be every other one , for e.g I've got two days with  
> contiguous unreadable files , but it is reversible
>> The way that most people would generate this archive is to have  
>> radium()
>> read the netflow records, and then have rasplit() attach to the  
>> radium.
> Ok radium works fine thanks
>> Did you try that at any time and get different results?  If not,  
>> don't worry,
>
> The only thing I can reproduce :
> without your patch ra -C IP_SERVER:5661  -w ./testrad.dump produces  
> an unreadable testrad.dump file by "unpatched" ra
>
> with your patch the command produces a readable file
>
> with radium all is working fine with and without patch
>
> HTH
>
> thanks a lot Carter for your help
>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20090826/a764cf0a/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3815 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20090826/a764cf0a/attachment.bin>