pid files...

[Phillip Deneault]

Hmmm, which is best?  Probably just a philosophical question, but...

I do something similar, except I use multiple rasplits to connect to a
single radium instance and break the stream into different timeframes
and then do my analysis on each as work requires.

So run two collectors?  Or one collector and multiple client tools?

Carter, is there a difference?

Thanks,
Phil

On 6/29/2011 8:19 PM, Russell Fulton wrote:
> I'll certainly look at this stuff -- looks like it may simplify things!
> 
> I am actually running two argi on a single interface -- one that collects 'the 
> standard stuff';) and one that collects some content for port 80.
> 
> In cases where I am doing things on different interfaces I will generally have 
> different directories for the pid files.
> 
> My work around of getting the script that starts the argi to record the pid 
> actually turns out to work well so this is no longer critical for me.
> 
> R (who crawls back under his rock for another year or two ;)
> 
> 
> 
> On 28/06/2011, at 1:53 PM, Carter Bullard wrote:
> 
>> Russell,
>> Use only one argus to process both interfaces.
>> Look at the new argus.conf file, in argus-3.0.4 or argus-3.0.5.4,
>> and have one argus open both interfaces "ind"ependantly.
>> Give them different srcid's like this:
>>
>> ARGUS_INTERFACE=ind:en0/192.168.0.39,en1/192.168.1.39
>>
>> or use two declarations
>> ARGUS_INTERFACE=en0/192.168.0.39
>> ARGUS_INTERFACE=en1/192.168.1.39
>>
>> Carter
>>
>> On Jun 27, 2011, at 9:40 PM, Russell Fulton wrote:
>>
>>>
>>> On 28/06/2011, at 1:13 PM, Russell Fulton wrote:
>>>
>>>> Wow, long time no posts :) Yes I'm still doing things with argus -- just 
>>>> totally snowed under :(
>>>>
>>>> I am currently reworking the management of my sensors and using puppet to do 
>>>> all the heavy lifting and I have got the to the point that I really want to 
>>>> be able to specify the name of the pid file as well as the path. I could 
>>>> make separate directories for the various argus processors but I would much 
>>>> rather not.
>>>>
>>>> Currently I am running multiple argus processes on one interface but I am 
>>>> only getting one pid file argus.eth1.0.pid
>>>>
>>>> The two processes are spawned very close together and I suspect there is a 
>>>> race condition where the files are being overwritten.
>>>>
>>>> Google turns up a reference to a config option ARGUS-PID-FILENAME but it 
>>>> does not appear to be current.
>>>>
>>>> Have I missed something?
>>>>
>>>> Russell
>>>>
>>>> PS. running 3.0.2 if it matters....
>>>
>>> I tried putting a two second sleep in the script that spawns the process but 
>>> it did not make any difference, the second process seems to overwrite:
>>>
>>> 19911 ? Ss 0:01 /usr/sbin/argus -F /home/sensors/dmzo/conf/argus-std.conf
>>> 19913 ? Ss 0:01 /usr/sbin/argus -F /home/sensors/dmzo/conf/argus-user-data.conf
>>> [sensors at mon263550 ~]$ ls dmzo/run/
>>> argus.eth1.0.pid
>>> [sensors at mon263550 ~]$ cat dmzo/run/argus.eth1.0.pid
>>> 19913
>>>
>>> Even putting a 10 sec delay made no difference I still got just one pid file.
>>>
>>> Russell
>>>
>>>
>>>
>>
>