Argus 3.0 / 32-bit overflow / backward compatibility

Ilija Baniski ilija.baniski at
Thu Sep 22 13:52:08 EDT 2011

Hello all,

I am doing some testing prior to upgrading to 3.0. 64-bit byte counters 
are an important reason for the upgrade, while the ability of the 3.0 
clients to read argus 2.0 data make the switch that much sweeter. 
However, I haven't been able to get either of these two features to 
work. I have the latest argus-3.0.4 and argus-clients- built. I 
know these two are not very closely related, but I'll ask both questions 

I read that these two features should be supported here:

To test the 4GB byte overflow I performed a ~5GB file transfer twice: 
once with STATUS_INTERVAL=60 and then with STATUS_INTERVAL=600. These 
were the results:

# ./ra -Xnr /opt/data/argus/var/log/argus.out - host
    11:45:51.241371  e d       tcp     ->       674666  691670398   CON
    11:46:51.241496  e d       tcp     ->       728665  746638654   CON
    11:47:51.241563  e d       tcp     ->       729780  748390504   CON
    11:48:51.241597  e d       tcp     ->       733293  752190798   CON
    11:49:51.241631  e d       tcp     ->       733537  752519850   CON
    11:50:51.241659  e d       tcp     ->       734255  752514878   CON
    11:51:51.241729  e d       tcp     ->       732836  751412980   CON
    11:52:51.241770  e d       tcp     ->       374739  384106534   FIN
# ./racluster -Xnr /opt/data/argus/var/log/argus.out - port 49460
    11:45:51.241371  e d       tcp     ->      5441771 5579444596   FIN

Which shows the transfer of the ~5GB file. Now with only a single 
interval for the transfer:

# ./ra -Xnr /opt/data/argus/var/log/argus.out - host
    11:33:23.249123  e d       tcp     ->      5443943 1284774452   FIN
# ./racluster -Xnr /opt/data/argus/var/log/argus.out - port 47119
    11:33:23.249123  e d       tcp     ->      5443943 1284774452   FIN

Which shows that the byte count has wrapped after 4GB (1284774452 + 
4x1024x1024x1024 = 5579741748).

So I guess the question is, what am I doing wrong? Do I need to compile 
argus in a certain way or configure it differently? Or perhaps this is 
related to the clients (unlikely since racluster seems to have no 
problem showing the 5GB if the data is there).

To check the backward compatibility I used the ra tool from the 
argus-clients- to try and read a file written by argus 2.0. Here 
are some output snippets of me trying to read the file with both, an old 
client and new one:

The old:
# ra -h
Ra Version 2.0.6.fixes.1
# ra -r argus.2011-09-13-07-00-01.gz | head -2
09-07-11 11:18:07.535387           man            
v2.0                                     1 0          0        0         
0            0           STA
09-13-11 02:49:01.914562           tcp                   ->             
3        6         384          435         CON

and the new:
# ./ra -Xh
Ra Version
# ./ra -Xr argus.2011-09-13-07-00-01.gz
<no output at all>

So back to the same questions: what am I doing wrong/how can I use the 
new clients to read the old data? In my random attempts to make this 
happen I did try to unzip the file first, but that made no difference.

Thanks for any help,

More information about the argus mailing list