Time filters
Carter Bullard
carter at qosient.com
Mon Jul 12 11:25:20 EDT 2010
Hey Rafael,
Yes, that would appear to be the problem, and
thanks, that's what I needed to start debugging !!!
Carter
On Jul 12, 2010, at 11:08 AM, Rafael Barbosa wrote:
> Ok. Let me try answer all questions:
>
> When I convert your range for Jan 22, 2009, using
> "date -r 1232492400" and "date -r 1232578800", I get the range:
>
> Tue Jan 20 18:00:00 EST 2009 - Wed Jan 21 18:00:00 EST 2009
>
> Do you get similar results on your system?
>
> I get a different range, by the way, I am using a MacOS X 10.6.4:
> $ date -r 1232492400
> Wed Jan 21 00:00:00 CET 2009
> $ date -r 1232578800
> Thu Jan 22 00:00:00 CET 2009
>
> Does this mean ra is checking the day 21 instead of 22 in my system?
>
> Where are you located and what timezone is your system using?
>
> Enschede, NL - Central European Timezone (CET)
>
> Are you using the RA_TZ variable in your raTime.conf file? What string are you using there?
> No.
> $ cat raTime.conf
> RA_TIME_FORMAT="%F_%H:%M"
>
> What range does your client show when you use the times that do work?
> ra -D5 -t 2009/01/22.00-2009/01/22.23
> ra[9394.20cc2670ff7f0000]: 16:47:54.678576 ArgusCheckTimeFormat (0x7026e960, 2009/01/22.00-2009/01/22.23) retn 0: 1232492400-1232661600
>
> And how does your system interpret those time ranges?
> Wed Jan 21 00:00:00 CET 2009 - Thu Jan 22 23:00:00 CET 2009
>
> My understanding is that the filter "2009/01/22" is checking day 21 in my system while "2009/01/22.00-2009/01/22.23" include all flows from day 21 until 23h at day 22. Is that correct?
>
> Best regards,
> Rafael
>
> ps.: In my timezone is 5pm now, so I probably can only reply to a follow up message tomorrow...
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20100712/46735caf/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3815 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20100712/46735caf/attachment.bin>
More information about the argus
mailing list