Racluster discarding packet loss data

Bart Roos mail at bartroos.com
Sun Dec 13 08:04:37 EST 2009

Hello everyone,

I am trying to collect packet loss data for a particular host in a LAN
segment using the following racluster command:

$ racluster -r argus.log -m saddr -s loss - tcp and src host

The racluster output does not report any packet loss, but counting the
packet loss from individual argus records does show some loss:

$ ra -r argus.log -s loss - tcp and src host | \
  awk '{c+=$1;} END {print c;}'

Why is racluster discarding the packet loss data? Is this a bug, or am I
doing something wrong? I'm running the 3.0.2 server and clients.


More information about the argus mailing list