rasqlinsert

[Carter Bullard]

Hey Sean,
There a number of dials that are useful, but the real question is what are you trying to do?
If you think that there are a lot of flow records, (> 1000 flow records per second) then you will
want to pay attention to the database schema and whether you want keys or not.

Not all of this is completely baked, but there is enough for you to do most of what people want
to do, so if you run into trouble, send email to the list, and we'll try to get you started.

Inserting primitive data is straight forward (no keys), the only thing you need to decide on is what
fields (attributes) do you want to be "exposed" in the database, and whether you want the original
binary argus record inserted into the database.  Without specifing a "-s fields" option
on the command line, rasqlinsert() will use the default fields, or those specified in the
.rarc file, plus the "record" field.  The insertion will be more expensive, depending on the
number of fields that are specified, so check out the .rarc file, and the "-s fields" option, so
get the schema that you want..

There are advantages to having the record itself, as it contains potentially 100's of metrics/attributes.
But you do pay a price in space and in cycles, when you include it.  I always insert the record, if I can.
You use rasql() to read the records, when they are present.

If you want to store a processed/aggregated view of the data, then there are knobs to set, like
the update rate for the database insertions, aggregation model, etc.....  Use rasqlinsert() with
the "-M curses" option, to see what the data looks like, and to tune the update times, timeout
values etc....  It runs just like ratop(), but what you see on the screen is maintained in a sql
table.  When you see the values change, the database insertion/modify was scheduled (not
committed).  Run it for awhile and when you're happy, then run rasqlinsert() as a daemon (-d option)
with the appropriate values set, either on  the command line, or in the .rarc file for the tweaks to
applied.

You'll want to play with it, and see if there is a performance problem.  If so, then you'll want to
really think about what you want in the database, and what you don't need.

Hopefully that helps, and if not, keep sending email.

Carter

On Nov 18, 2010, at 5:30 PM, Sean Malone wrote:

> Hello everybody,
>  I want to use rasqlinsert on a high traffic network is there any tweaks I could make that will allow me to use Argus + rasqlinsert + mysql effectivly? Thanks.
> 
> Sean
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20101119/82d5936b/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3815 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20101119/82d5936b/attachment.bin>