rasqlinsert only filling in about 1500 rows?

[Chance Carroll]

I didn't reply to the mailing list last time, so I'm sending it again......
Also, I'm running freeBSD 7.2

On Thu, Oct 15, 2009 at 8:39 AM, Chance Carroll <carroll.chance at gmail.com>wrote:

> I'm not purposely using any cache options, here is the command I'm running:
> rasqlinsert -S localhost:561 -w mysql://root@localhost/argusData/argusTable
> -s "srcid proto saddr sport smac sbytes daddr dport dmac dbytes bytes stime
> dur record" -d
>
> I'll be trying the auto ID option as well, for whatever reason when I
> installed from the source it did not install the man pages, so this is being
> a little tricky, I graped the html docs from the source, but there was not a
> rasqlinsert man page...
>
> Thanks for the help!
> Chance
>
>
>
> On Wed, Oct 14, 2009 at 5:31 PM, Carter Bullard <carter at qosient.com>wrote:
>
>> Hey Chance,
>> What are the command-line arguments that you are using?
>>
>> Sounds like you are running rasqlinsert() in a mode where the database
>> table is sync'd with the internal cache state of rasqlinsert().  Means
>> that when
>> rasqlinsert() timesout a flow and deletes its internal cache entry, it
>> DELETES
>> the entry in the database table as well.
>>
>> Are you using the "-M cache" option?
>> Keys are specified using the "-m option".
>> You can have rasqlinsert() generate an autoid field in the schema by
>> specifying
>> it with a "-s +autoid" like command line option.
>>
>> Carter
>>
>>
>> On Oct 14, 2009, at 3:54 PM, Chance Carroll wrote:
>>
>>  I have Argus and radium setup and happily logging away our traffic, but
>>> I'm having problems with rasqlinsert, when trying to capture live data it
>>> starts replacing rows, the total row rarely rises above 1700, and can
>>> decrease down to 1100. Also, the table does not show a primary key, could
>>> that be part of the problem? Is it possible to set an auto-incrementing key
>>> through rasqlinsert?
>>>
>>>
>>> Thanks,
>>> Chance
>>>
>>
>>
>>
>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20091015/235d3cea/attachment.html>