rabins zero option

[Carter Bullard]

Hey David,
A big bug in zero bin reporting, actually, just sloppy translation from
the main thread of code development.  I went from representing some
internal timestamps as (float), to (long long) to avoid rounding errors
when we have very small bin sizes.   Here is a patch that should
fix things for you, and I'll have it in the downloadable codebase this
afternoon.

Carter

==== //depot/argus/clients/clients/rabins.c#38 - /home/carter/argus/ 
clients/clients/rabins.c ====
524c524
<                   if (RaBinProcess->nadp.zero && ((i >= RaBinProcess- 
 >index) && ((((i - RaBinProcess->index) * 1.0) * RaBinProcess->size)  
< RaBinProcess->scalesecs))) {
---
 >                   if (RaBinProcess->nadp.zero && ((i >=  
RaBinProcess->index) && ((((i - RaBinProcess->index) * 1.0) *  
RaBinProcess->size) < (RaBinProcess->scalesecs * 1000000LL)))) {
530,531c530,531
<                      ttime.tv_sec  = tval;
<                      ttime.tv_usec = round((tval - ttime.tv_sec) *  
1000000.0);
---
 >                      ttime.tv_sec  = tval/1000000;
 >                      ttime.tv_usec = tval - (ttime.tv_sec *  
1000000.0);
538,539c538,539
<                      ttime.tv_sec  = tval;
<                      ttime.tv_usec = round((tval - ttime.tv_sec) *  
1000000.0);
---
 >                      ttime.tv_sec  = tval/1000000;
 >                      ttime.tv_usec = tval - (ttime.tv_sec *  
1000000.0);


On May 5, 2009, at 10:41 AM, David wrote:

> Perhaps I'm not interpreting the zero option correctly but it does  
> not appear to work correctly for me in the following case.  All data  
> is sorted by stime already and I am trying to get hourly/daily byte  
> counts as suggested in a previous thread.
>
> I run:
>
> $ rabins -M zero time 1h -R ./data/ - port 22
>
> I have tried passing a specific timerange with -t but I do not get  
> zero records.  Running in debug mode does not show any of the  
> messages which would suggest a zero record had been created.  I have  
> also tried both hard and soft options.  I'm definitely not trying to  
> filter on src/dst, which I assume might cause problems if used as  
> above.
>
> I'm using the 3.0.2-beta6 clients, should it be possible to get zero  
> records as above?  That would greatly help with graphing, as the  
> "time" axis would be constant (zeros instead of missing records) no  
> matter what port filter I use.
>
> If only Excel wasn't so poor at handling mixed date/time columns  
> (OpenOffice manages fine, fortunately).
>
> Thanks again.
>
> David
>




-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3815 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20090507/71095646/attachment.bin>