Making rasplit apply interface-name prefixes to output files when reading from a radium instance that is hosting multiple argus sources
The Branches
branchbunch at gmail.com
Thu Jun 9 16:48:33 EDT 2011
Carter,
On a specific sensor host, I've been running multiple argus instances
(one per sniffing interface) and then attaching a separate rasplit
instance to each one to store hourly files on the local file system on a
per-interface/per-hour basis (like /argus/06/12/eth3-10 for the June
12th 10am file for the eth3 interface). Due to some sporadic argus data
file corruption issues I've been dealing with when attaching rasplit
directly to an argus instance, I'm starting to wonder if it would be
better to run a single argus instance that a single instance of radium
attaches to, and then have a single rasplit instance attach to radium.
I've figured out how to get one argus instance to monitor multiple
interfaces and it doesn't look hard to get radium to attach to it. The
part I can't work out so far is how to get a single rasplit instance to
prefix output filenames with the interface names. I can see how to
include the source identifier in the output filename by using \$srcid in
the -w parameter of rasplit, but it appears that the source id is
fundamentally an IP address and can't contain arbitrary text like "eth5".
What I'd like to do is something like this, where \$interface would
expand to the interface name that argus collects each record on. I'm
not sure interface name data is actually stored in the argus record, though.
rasplit -S 127.0.0.1:561 -M time 1h -w
/argus/%m/%d/\$interface-%H-%M.arg
Or perhaps I could specify multiple filter and -w pairs, kind of like this
rasplit -S 127.0.0.1:561 -M time 1h - "srcid 1.1.1.1" -w
/argus/%m/%d/eth1-%H-%M.arg - "srcid 2.2.2.2" -w
/argus/%m/%d/eth2-%H-%M.arg - "srcid 3.3.3.3" -w
/argus/%m/%d/eth3-%H-%M.arg
but that gives me a syntax error.
If what I am trying to do is not realistic or advisable to do with a
single rasplit instance, I can certainly run one rasplit instance per
interface, but I thought I'd ask first. My primary goal is to eliminate
argus data file corruption, and after that to keep things as simple as
possible.
Kevin Branch
More information about the argus
mailing list