rasqlinsert

[CS Lee]

hi Carter,

Here's my database schema -

echo "desc argusFlows_2009_09_11" | mysql -u root argusdb
Field    Type    Null    Key    Default    Extra
stime    double(18,6) unsigned    NO        NULL
flgs    varchar(32)    YES        NULL
proto    varchar(16)    NO        NULL
saddr    varchar(64)    NO        NULL
sport    varchar(10)    NO        NULL
dir    varchar(3)    YES        NULL
daddr    varchar(64)    NO        NULL
dport    varchar(10)    NO        NULL
pkts    bigint(20)    YES        NULL
bytes    bigint(20)    YES        NULL
state    varchar(32)    YES        NULL
record    blob    YES        NULL

Yeah, i think i shouldn't use -M rmon in this case, unless I want to store
singular object info.

I just bump in the .rasqlinsertrc following your example, I think i need to
tune this in my case -

RA_TIMEOUT_INTERVAL=86400
RA_UPDATE_INTERVAL=1.0

Thanks for the clue.

On Sat, Sep 12, 2009 at 2:17 AM, Carter Bullard <carter at qosient.com> wrote:

> Hmmm,  well one thing.   You don't want the "-M rmon" option.  That simply
> duplicates the records, andreverses the flow key identifiers, so don't do
> that.
>
> So, how many records per second do you expect to see?  You should probably
> be able to handle maybe
> 500 flows/sec with this strategy.
>
> What is in your .rasqlinsertrc?
> What does the database schema look like?
>    % echo "desc argusFlows_2009_09_11" | mysql -u root
>
> Carter
>
>
> On Sep 11, 2009, at 1:27 PM, CS Lee wrote:
>
> hey carter,
>
> I'm using rasqlinsert to insert data to mysql db, and this erro appears and
> rasqlinsert doesn't seem to insert any data even though it is running -
>
> rasqlinsert(35236,0xa04b7720) malloc: *** error for object 0x610dd0:
> incorrect checksum for freed object - object was probably modified after
> being freed.
>                                                    *** set a breakpoint in
> malloc_error_break to debug
>
> And the cpu consumption of rasqlinsert is quite scary -
>
>   PID COMMAND      %CPU   TIME   #TH #PRTS #MREGS RPRVT  RSHRD  RSIZE
> VSIZE
> 35236 rasqlinser  63.9%  4:22.97   2    17     44 7112K   188K  8224K
> 32M
>
> And it hits over 100% and never go below than that even though it never
> insert any dat anymore. I'm using latest argus client 3.0.2 beta 12, the
> rasqlinsert command line i use is
>
> rasqlinsert -S localhost -w
> mysql://root@localhost/argusdb/argusFlows_%Y_%m_%d -F .rasqlinsertrc -M
> rmon -m none - ip
>
> Cheers ;)
>
> --
> Best Regards,
>
> CS Lee<geek00L[at]gmail.com>
>
> http://geek00l.blogspot.com
> http://defcraft.net
>
>
>


-- 
Best Regards,

CS Lee<geek00L[at]gmail.com>

http://geek00l.blogspot.com
http://defcraft.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20090912/e19badc2/attachment.html>