radium core dump, 3.0.5.32

[Mark E. Mallett]

On Fri, Feb 17, 2012 at 02:39:33PM -0500, Carter Bullard wrote:
> Hey Mark,

> I'm looking into this.  One thing thats a bit incorrect.  You're putting
> radium on port 561, but then you're collecting from localhost:561.  So
> are you collecting from yourself, which is not good, or is radium and
> argus? using the same port?

They are different IP addresses. The radium.conf has

RADIUM_BIND_IP=myhostname
  and myhostname does not resolve to 127.0.0.1 (if it matters, it
  resolves to an RFC1918 address, 192.168.2.3)
  and the argus collector is running on 127.0.0.1 , so radium.conf has
RADIUM_ARGUS_SERVER=127.0.0.1:561
  to collect from the argus server which is on 127.1 .  so radium
  is serving on 192.168.2.3:561 and argus on 127.1:561

Does that make it clearer?  I don't think there's a conflict
although maybe it's bad stylistically.



> The RADIUM_CISCONETFLOW_PORT is obsolete now.  you should configure
> a RADIUM_ARGUS_SERVER to collect cisco records:
> 
>    RADIUM_ARGUS_SERVER=cisco://ciscohost:9699
> 
> The RADIUM_CISCONETFLOW_PORT does work, but it will be phased out for
> the other method.

At first glance that looks like it's polling a cisco router rather than
having the cisco push to the collector. If that's wrong you don't have
to respond in detail, I'll try to grok it a bit better in the meantime.


> OK, to fix the bug, can you apply this change to your ./common/argus_util.c file?
> 
> ==== //depot/argus/clients/common/argus_code.c#68 - /Volumes/Users/carter/argus/clients/common/argus_code.c ====
> 95c95
> < //efine ARGUSFORKFILTER   1
> ---
> > #define ARGUSFORKFILTER   1

Yes indeed, that seems to have made it better, thanks much!

-mm-