Removing possibly unused metadata?

Jason Carr jcarr at
Fri Oct 28 17:06:59 EDT 2011

We write argus data into five minute chunked files.  We typically have +1G
files for those 5 minutes.  Is there any metadata that we might be able to
purge to decrease the size significantly?

I normally only care about StartTime, flags, pro to, src/dst
{mac,ip,port}, direction, packets, bytes, state, and user data in either

I already gzip compress the files, I tried using bzip2 on a few test files
and got a 1.1G file down to 500M instead of 539M, but I'm looking for a
larger compression and/or size difference.



More information about the argus mailing list