argus/radium problem

CS Lee geek00l at gmail.com
Thu Jun 7 10:45:45 EDT 2012


hi Carter,

When I restart argus, I must make sure to restart radium too. Otherwise
when radium reconnects to argus, argus client can't connect to argus, and
if I run argus client to connect to radium, it also won't get anything.

Just now I stop radium, only try it with argus and ra, and ra also stops
working and show same idle connection message after a while.

However one thing I find really weird is, when I check on bivio box, argus
is still running, I can check with nrsp running argus, then I connect to of
the cpu, and run ra locally and attach to argus, it can retrieve data from
argus. So everything looks fine if you are running everything in bivio box,
but remote system will have problem connecting to argus and shows something
like this -

ra[12297]: 19:30:03.045011 ArgusReadStream 10.0.0.1: idle stream: closing

It doesn't matter which argus client I use to connect to argus on bivio, it
will get this after a while. Seriously I can't confirm if this is related
to bivio system design(they use apc), because I never have such problem
with other linux systems.

On Thu, Jun 7, 2012 at 10:11 PM, Carter Bullard <carter at qosient.com> wrote:

> And when you restart argus, and radium reattaches, and the existing client
> doesn't receive data, if you connect to the new argus, directly with ra,
> does it get data ( argus working, radium broken ). And when existing client
> is not working, after argus restarted and radium reconnects, does a new ra,
> connected to radium get data ( new argus working, existing radium working,
> radium's previously existing client connection broken )
>
> Carter
>
> On Jun 7, 2012, at 8:43 AM, CS Lee <geek00l at gmail.com> wrote:
>
> hi Carter,
>
> Did you state that correctly ?  Once the problem manifests, if you
> completely restart argus,
> radium will successfully reconnect, but the existing client, connected to
> radium, doesn't
> get any data?
> Yes, it happens that way. and when I try to use argus client such as ra,
> it doesn't get any data as well.
>
> If I restart argus and doesn't restart radium, radium will reconnect to
> argus, however argus client can't get anything from radium as well. So to
> get everything working properly. I need to restart radium on linux box,
> argus on bivio box. Then argus client can connect again.
>
> The version I'm using is argus-3.0.6 on bivio(bivio team sends me rpm
> file), and argus client 3.0.6.1 on linux box.
>
>
>
>
>
> On Thu, Jun 7, 2012 at 7:50 PM, Carter Bullard <carter at qosient.com> wrote:
>
>> Hey CS Lee,
>> Did you state that correctly ?  Once the problem manifests, if you
>> completely restart argus,
>> radium will successfully reconnect, but the existing client, connected to
>> radium, doesn't
>> get any data?
>>
>> There maybe two problems here.  When this fails, without doing anything
>> to recover,
>> does connecting to argus directly using ra() generate any data?  When you
>> restart argus,
>> without restarting radium, and radium reconnects, but fails to pass data
>> to an existing
>> client, will a new connection to argus produce data?  Will a new
>> connection to radium,
>> while the existing client is still silent, produce data?
>>
>> Radium and argus share the same output processor, so it could be the same
>> bug
>> happening at the same time in the two programs.
>>
>> Are you generating ArgusEvents from your Bivio argus?
>> What versions of software are your running ?  Are they all 3.0.6 patched?
>>
>> Carter
>>
>> On Jun 7, 2012, at 7:32 AM, CS Lee wrote:
>>
>> hi Carter,
>>
>> I'm still discussing with bivio team to run argus in foreground on their
>> apc so that I can run it in debug mode to see more stuffs. I don't have
>> many argus clients connecting to the argus(on bivio), only one radium on
>> linux server, and the bivio box and the linux server is direct fiber
>> connection.
>>
>> The odd issue is after I restart argus, radium can reconnect to argus,
>> but argus client doesn't receive any data once connecting to radium, stay
>> silence. So to have everything working again, I need to restart argus on
>> bivio, and restart radium on linux box.
>>
>>
>>
>> On Thu, Jun 7, 2012 at 7:26 PM, Carter Bullard <carter at qosient.com>wrote:
>>
>>> I would guess that Argus is having the problem.  radium and rasqlinsert
>>> look to be reacting
>>> to a source that appears to have " died ";  disconnecting and then
>>> reconnecting to try
>>> to get the stream going again.
>>>
>>> Does argus have any log entries at the time that radium closes the
>>> connection?
>>> Do you have many clients connecting to this argus?  Are there transient
>>> clients,
>>> connecting and disconnecting, or is it just the single radium that reads
>>> data from
>>> this argus ?
>>>
>>> Carter
>>>
>>>
>>> On Jun 7, 2012, at 7:11 AM, CS Lee wrote:
>>>
>>> hi Carter,
>>>
>>> I'm running the latest version of argus and radium on gigabits network,
>>> however from time to time I get this -
>>>
>>> radium[8125.00e7ee8be17f0000]: 17:16:48.094029 ArgusOutputProcess()
>>> received mar 0x87a161a0 totals 1630827 count 0 remaining 0
>>> *radium[8125]: 17:22:15.093870 ArgusReadStream 10.0.0.1: idle stream:
>>> closing*
>>> radium[8125.2077bf8ce17f0000]: 17:22:15.093963
>>> ArgusCloseInput(0x8ca51010) closing
>>>  radium[8125.2077bf8ce17f0000]: 17:22:15.094055
>>> ArgusWriteConnection(0x8ca51010, 0x4be331, 6) returning 6
>>> radium[8125.2077bf8ce17f0000]: 17:22:15.094165
>>> ArgusCloseInput(0x8ca51010) done
>>> radium[8125.0077ec89e17f0000]: 17:22:15.816200
>>> ArgusConnectRemote(0x7fe18ca51010) starting
>>> radium[8125.0077ec89e17f0000]: 17:22:15.816259 Trying 10.0.0.1 port 561
>>> Expecting Argus records
>>> radium[8125.0077ec89e17f0000]: 17:22:15.816537 connected
>>> radium[8125.0077ec89e17f0000]: 17:22:15.816571 ArgusGetServerSocket
>>> (0x7fe18ca51010) returning 6
>>>
>>> On the other hand, I also get this, once I restart argus, radium will
>>> keep connecting again, however once radium is connected to argus, data
>>> supposes come in, however argus client can't connect to radium, and in the
>>> output below radium doesn't see anything tries to connect to it -
>>>
>>> radium[8125.00676c89e17f0000]: 17:26:28.848227 Trying 127.0.0.1 port 561
>>> Expecting Argus records
>>> radium[8125.00676c89e17f0000]: 17:26:28.848522 connected
>>> radium[8125.00676c89e17f0000]: 17:26:28.848585 ArgusGetServerSocket
>>> (0x7fe18ca51010) returning 6
>>> radium[8125.00676c89e17f0000]: 17:26:28.885456 ArgusReadConnection()
>>> read 16 bytes
>>> radium[8125.00676c89e17f0000]: 17:26:28.886308 ArgusParseInit(0x8cab3010
>>> 0x8ca51010
>>> radium[8125.00676c89e17f0000]: 17:26:28.886376
>>> ArgusWriteConnection(0x8ca51010, 0x89685c40, 7) returning 7
>>> radium[8125.00676c89e17f0000]: 17:26:28.886413
>>> ArgusReadConnection(0x8ca51010, 2) returning 1
>>> radium[8125.00676c89e17f0000]: 17:26:28.886431
>>> ArgusConnectRemote(0x7fe18ca51010) connected to 10.0.0.1
>>> radium[8125.00676c89e17f0000]: 17:26:28.886457 ArgusConnectRemote() done!
>>>
>>> In the rasqlinsert in debug mode, I got this -
>>>
>>> rasqlinsert[8324.20b74b83eb7f0000]: 17:22:57.186429 ArgusClientTimeout
>>> ArgusTotalSearches 342322 ArgusTotalSQLUpdates 918745 written 976091089
>>> bytes
>>> rasqlinsert[8324.20b74b83eb7f0000]: 17:22:57.202556 ArgusShutDown (0)
>>> rasqlinsert[8324.20b74b83eb7f0000]: 17:22:57.202594
>>> ArgusCloseInput(0x83315010) closing
>>> rasqlinsert[8324.20b74b83eb7f0000]: 17:22:57.202641
>>> ArgusWriteConnection(0x83315010, 0x4d5ab1, 6) returning 6
>>> rasqlinsert[8324.20b74b83eb7f0000]: 17:22:57.202786
>>> ArgusCloseInput(0x83315010) done
>>> rasqlinsert[8324.20b74b83eb7f0000]: 17:22:57.202852
>>> RaParseComplete(caught signal 0)
>>>
>>> The tricky part is argus is still running in the box(bivio), so what I
>>> need to do is I need to restart argus, restart radium, then everything back
>>> to normal again. Currently can't seem to find workaround.
>>>
>>> --
>>> Best Regards,
>>>
>>> CS Lee<geek00L[at]gmail.com>
>>>
>>> http://geek00l.blogspot.com
>>> http://defcraft.net
>>>
>>>
>>>
>>
>>
>> --
>> Best Regards,
>>
>> CS Lee<geek00L[at]gmail.com>
>>
>> http://geek00l.blogspot.com
>> http://defcraft.net
>>
>>
>>
>
>
> --
> Best Regards,
>
> CS Lee<geek00L[at]gmail.com>
>
> http://geek00l.blogspot.com
> http://defcraft.net
>
>


-- 
Best Regards,

CS Lee<geek00L[at]gmail.com>

http://geek00l.blogspot.com
http://defcraft.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20120607/897b80ec/attachment.html>


More information about the argus mailing list