ArgusReadSocketStream error

[Peter Van Epp]

On Thu, Jan 14, 2010 at 10:54:09AM +0000, Niall Murphy wrote:
> Hello all,
> 
> First of all, apologies for mailing a support related question to the development list, but i have searched for the following error message which appears at the end of my Argus log, and cannot find references to it anywhere, even searching koders.com.
> 
> "ArgusReadSocketStream: malformed argus record len 0"
> 
> I'm running...
> 
> ii  argus-client                      2.0.6.fixes.1-3          IP network transaction auditing tool
> ii  argus-server                      1:2.0.6.fixes.1-16       IP network transaction auditing tool
> 
> ...on debian stable.
> 
> If anyone could email me to let me know the possible triggers, impact, and workaround for this it would be greatly appreciated.
> 
> If you need any more information please let me know.
> 
> Thanks.
> 
> -- 
> Niall

	This list serves as both the development and support list. 2.0.6 fixes1
is a very old version (but a goodie, I ran it in production for many years).
The error is likely a protocol it doesn't recognize which means the packet 
won't be processed and possibly the rest of that file won't be processed 
(although it should just continue with the next packet I don't think it always
did). Your best bet (if its possible) would be to upgrade to the just released 
3.0.2 version of argus since its unlikely that we will try and fix 2.0.6 :-).
While there are some changes to options and new and changed cllents  ra is 
still mostly the same (default options have changed though) and it will still
read and process 2.0.6 data.

Peter Van Epp