Corrupt flow record in argus data file locks up any ra- command

The Branches branchbunch at gmail.com
Wed Jun 8 14:05:39 EDT 2011


Carter,

I'm running argus 3.0.4 and argus-clients 3.0.4.1 on several 64bit 
CentOS 5.6 hosts at different sites, on each one inspecting multiple 
local sniffing interfaces.  On each sensor host, I store the local argus 
data to a native file system repository as hourly files for each 
sniffing interface.  Many times one of these hourly files appears to end 
up with a corrupt record, at which point any ra- command used against 
that file goes into an endless loop that eats up as much cpu time as it 
can get until I notice the system dragging and kill off the stuck ra- 
command.  The pair of argus commands I use for handling a single 
sniffing interface are like this:

argus -i dmz -F /opt/nids/sensor/etc/argus.conf -P 564
rasplit -X -S 127.0.0.1:564 -M time 1h -w /argus/%m/%d/dmz-%H.arg -d

...and my argus.conf looks like this

ARGUS_FLOW_TYPE="Bidirectional"
ARGUS_FLOW_KEY="CLASSIC_5_TUPLE"
ARGUS_DAEMON=yes
ARGUS_BIND_IP="127.0.0.1"
ARGUS_GO_PROMISCUOUS=yes
ARGUS_COLLECTOR=yes
ARGUS_FLOW_STATUS_INTERVAL=300
ARGUS_MAR_STATUS_INTERVAL=300
ARGUS_DEBUG_LEVEL=0
ARGUS_GENERATE_RESPONSE_TIME_DATA=no
ARGUS_GENERATE_PACKET_SIZE=no
ARGUS_GENERATE_JITTER_DATA=no
ARGUS_GENERATE_MAC_DATA=yes
ARGUS_GENERATE_APPBYTE_METRIC=no
ARGUS_GENERATE_TCP_PERF_METRIC=no
ARGUS_GENERATE_BIDIRECTIONAL_TIMESTAMPS=no
ARGUS_CAPTURE_DATA_LEN=0
ARGUS_FILTER_OPTIMIZER=no
ARGUS_SET_PID=yes
ARGUS_PID_PATH="/var/run"

I can provide a sample argus data file that any ra, racount, or 
racluster instance will lock up on if you'd have a chance to look into 
what is behind the freezing up.

If you have any suggestion on a better way to collect and split out 
local argus data over hourly files, I'm all ears. For example would 
introducing radium between argus and rasplit help or just make things 
more complicated?  If you have any diagnostic steps for me to try, I'm 
eager to get to the bottom of this issue.

Thanks in advance for your assistance,
Kevin Branch




More information about the argus mailing list