Radium and output files

Carter Bullard carter at qosient.com
Tue Apr 12 14:13:55 EDT 2011


Hey Mike,
No, its suppose to do something that is useful.  The detection that the file
has been removed is on a timer, and it should be checked every second.
When it realizes the file doesn't exist, it flushes and closes the file.
Then it creates a new file and starts writing.

Is the new file growing in size?  is the old one growing?

Carter


On Apr 12, 2011, at 1:11 PM, Mike Iglesias wrote:

> I have a copy of radium running that is receiving netflow records from our
> routers and writing them to a file.  When I rename the output file, radium
> creates a new one but keeps the old one open, so when the file is gzip'd the
> space used is not reclaimed.  Is radium supposed to work like argus in that
> when the output file is renamed, it will close it and open a new one, or do I
> have to restart radium when I rename the file?
> 
> Here's some output from lsof showing what radium did:
> 
> radium  12671 root    0u   CHR  136,1         0t0       4 /dev/pts/1 (deleted)
> radium  12671 root    1u   CHR  136,1         0t0       4 /dev/pts/1 (deleted)
> radium  12671 root    2u   CHR  136,1         0t0       4 /dev/pts/1 (deleted)
> radium  12671 root    3w   REG    9,0  2010741524 3932172 /log/argus/argus.out
> radium  12671 root    4w   REG    9,0 13282553300 3932171
> /log/argus/argus.out.20110411 (deleted)
> 
> argus.out.20110411 is yesterday's file, which was renamed shortly after
> midnight by a cron script.  The script gzip'd the file after it renamed it, so
> that's why lsof is saying the file has been deleted.
> 
> 
> -- 
> Mike Iglesias                          Email:       iglesias at uci.edu
> University of California, Irvine       phone:       949-824-6926
> Office of Information Technology       FAX:         949-824-2270
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3815 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20110412/a0f365ad/attachment.bin>


More information about the argus mailing list