Duration sum bug

[Carter Bullard]

If you were to print out the 'mean', you should get the value you expect.
The 'mean', 'max', 'min', and 'stddev' default to track the duration metric.

Carter


On Mar 21, 2011, at 10:34 AM, Digital Ninja wrote:

> I ran across something with racluster v3.0.2 & v3.0.4 that I can't
> quite explain and need some help.  I have 9 different argus files.  I
> am running racluster with the following options:
> 
> racluster -M rmon -nn -c "," -m saddr proto sport -r <file> -L0 -s
> saddr proto sport sbytes dur dbytes - not arp
> 
> When I run this command on the 9 files separately, for a single IP I
> get something like this:
> 
> 1.2.3.4,17,53,289,0.47648,213
> 1.2.3.4,17,53,133,0.015667,117
> 1.2.3.4,17,53,133,0.014637,117
> 1.2.3.4,17,53,133,0.014608,117
> 1.2.3.4,17,53,133,0.015812,117
> 1.2.3.4,17,53,133,0.015056,117
> 1.2.3.4,17,53,133,0.015539,117
> 1.2.3.4,17,53,133,0.015089,117
> 1.2.3.4,17,53,133,0.015287,96
> 
> Summing the bytes and duration columns up, I would expect the totals to be:
> 1.2.3.4,17,53,1376,0.169343,1128
> 
> However, when I run racluster on all 9 files simultaneously (-r <file>
> <file> <file>...etc) I get the following results for the above data:
> 1.2.3.4,17,53,1376,79215.023438,1128
> 
> What's going on with the duration field??
> 
> Thanks in advance.
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3815 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20110321/3a9b8968/attachment.bin>