Racluster discarding packet loss data

[Bart Roos]

Hi Carter,

I was already using the 3.0.2 server and client when I reported the bug, 
so it is definitely still present in the current release. If you could 
fix it in the upcoming release, that would be great.

Thanks,
Bart

On 1/28/10 6:46 PM, Carter Bullard wrote:
> Hey Bart,
> Thanks for reminding me!!!   Yes I believe that it is fixed in the argus-clients-3.0.2
> that is the official release.  Its on the server, you can grab it from:
>     http://qosient.com/argus
>
>   If you try it out, and its not working, holler.  I'll fix it in
> argus-clients-3.0.3.1, which I will upload early next week.
>
> Carter
>
> On Jan 28, 2010, at 11:51 AM, Bart Roos wrote:
>
>> Hi Carter,
>>
>> Did you already manage to fix this particular bug?
>>
>> Thanks,
>> Bart
>>
>> -----Original Message-----
>> From: argus-info-bounces+roos=fox-it.com at lists.andrew.cmu.edu [mailto:argus-info-bounces+roos=fox-it.com at lists.andrew.cmu.edu] On Behalf Of Carter Bullard
>> Sent: maandag 14 december 2009 16:12
>> To: Bart Roos
>> Cc: argus-info at lists.andrew.cmu.edu
>> Subject: Re: [ARGUS] Racluster discarding packet loss data
>>
>> Hey Bart,
>> Looks like we've got a bug and I don't have a fix yet, but I do have a
>> potential work around for you.
>>
>> If you run racluster() using default parameters before running
>> racluster()
>> with the flow key modificatons, you'll get loss back (at least for
>> this file).
>>
>>     racluster -w -  -r argus.log* | racluster -s +loss -m proto saddr
>>
>> There are 3 types of TCP DSR's, and it maybe that the bug is in dealing
>> with the loss stats when merging with a TCP matching flow that uses
>> a different TCP DSR (that doesn't have loss stats).
>>
>> Try this work around, and I'll look for a fix later today,
>>
>> Carter
>>
>> On Dec 13, 2009, at 8:04 AM, Bart Roos wrote:
>>
>>> Hello everyone,
>>>
>>> I am trying to collect packet loss data for a particular host in a LAN
>>> segment using the following racluster command:
>>>
>>> $ racluster -r argus.log -m saddr -s loss - tcp and src host
>>> 10.10.0.12
>>>         0
>>>
>>> The racluster output does not report any packet loss, but counting the
>>> packet loss from individual argus records does show some loss:
>>>
>>> $ ra -r argus.log -s loss - tcp and src host 10.10.0.12 | \
>>> awk '{c+=$1;} END {print c;}'
>>> 217
>>>
>>> Why is racluster discarding the packet loss data? Is this a bug, or
>>> am I
>>> doing something wrong? I'm running the 3.0.2 server and clients.
>>>
>>> Thanks,
>>> Bart
>>>
>>
>>
>
> Carter Bullard
> CEO/President
> QoSient, LLC
> 150 E 57th Street Suite 12D
> New York, New York  10022
>
> +1 212 588-9133 Phone
> +1 212 588-9134 Fax
>
>
>