How Can I inert mac with rasqlinsert?

Carter Bullard carter at qosient.com
Sun Aug 1 10:50:07 EDT 2010


Whenever you insert data using rasqlinsert() the whole argus record is inserted as binary data in each row.
So the mac's are there, and you can print them using rasql().

   rasql -r mysql://argus@localhost/argusData/argusTable_2010_08_01 -s +smac +dmac

but to have them as mysql table attributes, you just need to indicate you want it as a printed field.
In your example, you aren't specifying any fields using the "-s field ..." option, so you are using the defaults,
or the fields defined in your ~/.rarc.  Try this

   rasqlinsert -S localhost:561 -m none -d -M time 1s -w mysql://user@host/db/table -s +smac +dmac

or add "smac dmac"  to your RA_FIELD_SPECIFIER in your ~/.rarc

This will add smac and dmac to your database schema, which you can verify using the mysql
command, 'desc table'.

   % mysql
   mysql> use argusData;
   mysql> desc argusTable_2010_08_01;

Adding this and running it may cause rasqlinsert() to try to insert the fields into an existing table that
doesn't have these fields in it, and it will fail, so be sure and drop any tables that cause problems.
mysql() will allow you to add attributes to existing tables, so if its really important, you can make
a legacy table usable.

Remember the more fields you "expose" in mysql() the more cycles it will take to insert a record,
so expose them in mysql if you will have queries that use the fields.  If not, use rasql() to grab
the fields when you need them.

Carter



On Aug 1, 2010, at 8:00 AM, modversion wrote:

> Hi list:
> How Can I inert mac with rasqlinsert? I’ve set ARGUS_GENERATE_MAC_DATA=yes to collect the mac address,but I can not store the smac and dmac in the mysql database via the command “/usr/local/bin/rasqlinsert -S localhost:561 -m none -d -M time 1d -w mysql://argus@localhost/argusData/argusTable_%Y_%m_%d”.
>  
> Anybody could be kind enough to do me a favor and tell me how can I get the mac into mysql database,thank you very much!
>  

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20100801/0c89e0bf/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3681 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20100801/0c89e0bf/attachment.bin>


More information about the argus mailing list