racluster segv reading argus v2 file

[Carter Bullard]

Hey Mike,
I see that you're getting records from your 2.x stream that don't have
a flow DSR in them (segfault in ArgusProcessServiceAvailability()).

That is not really suppose to happen.  Does ra() do ok with that file?

I've added the fixes from your email for the next beta release, so
hopefully this will do it.

Carter

On Mar 11, 2009, at 2:07 PM, Mike Iglesias wrote:

> Carter Bullard wrote:
>> Hey Mike,
>> Thanks for the report, this is very useful for fixing bugs!!!!
>>
>> In gdb(), at the prompt where it dies, we need to test what
>> is generating the segfault, which seems to be the value of
>> "net", which is probably zero, or something very low.  So
>> where the program dies, in gdb, type:
>>
>> (gdb) print net
>
> (gdb) print net
> $1 = (struct ArgusNetworkStruct *) 0x0
>
>>
>> A few things.  Your racluster.conf file is really a rarc file.
>> You are using it correctly by specifying using the '-F' option,
>> but this is not an aggregation configuration.  An example of
>> that is in ./support/Config/racluster.conf, and its feed to
>> racluster using the '-f' option.
>
> I probably should have named the racluster.conf file something like
> ragator.conf to avoid confusion.  I'm not going to use any of the  
> racluster
> filtering stuff that goes in racluster.conf, assuming the default  
> for -m stays
> the 5-tuple.
>
>>
>> The -A option is not a useful option for racluster().
>
> And -A is causing the seg fault.!  When I run racluster without it,  
> it runs
> ok.  With it, it segfaults.
>
>>
>>
>> This fix for this is really simple.  Insert these lines in the  
>> routine
>> ArgusProcessTCPAvailability() in the file, ./common/argus_client.c,
>> just after the variable declarations:
>>
>>   if (net == NULL)
>>      return retn;
>
> I did that, and using -A caused another seg fault in
> ArgusProcessServiceAvailability because flow is null.  I fixed that  
> one in a
> similar way, although I wasn't sure if it should go before or after  
> this line
>
>   argus->status &= ~(RA_SVCPASSED | RA_SVCFAILED);
>
> so I put it after that line.
>
>
> -- 
> Mike Iglesias                          Email:       iglesias at uci.edu
> University of California, Irvine       phone:       949-824-6926
> Network & Academic Computing Services  FAX:         949-824-2270
>
>

Carter Bullard
CEO/President
QoSient, LLC
150 E 57th Street Suite 12D
New York, New York  10022

+1 212 588-9133 Phone
+1 212 588-9134 Fax