Time Filters

[Rafael Barbosa]

Hi Carter,

I did not do extensive testing, but the newest argus clients are at least
returning some flow records.
In case I find inconsistencies I will do the '-D2' testing.

Thanks,
Rafael Barbosa
http://www.ewi.utwente.nl/~barbosarr/



On Wed, Mar 7, 2012 at 5:20 PM, Carter Bullard <carter at qosient.com> wrote:

> Hey Rafael,
> There have been some bug fixes in this area.  I'll be uploading
> argus-clients-3.0.5.35
> later today, so please grab that to see if there are any improvements.
>
> For debugging, I have found that it is useful to run ra.1 with the -D2
> option, as this
> will print out the time range ra.1 will use for the filter.   The bugs
> caused a filter of:
>    " -t 2010/10/20 "
>
> to look at only the one second range:
>    " -t 2010/10/20.00:00:00-00:00:01"
>
> Also timezone modifications in the .rarc were not being applied uniformly
> to
> all timestamps comparisons, so that also should be fixed now.
> I'll grab your data files and make sure that the new code at least finds
> some records.
>
> Carter
>
> On Mar 7, 2012, at 11:08 AM, Rafael Barbosa wrote:
>
> Hi Carter,
>
> I am having problems with time filters. I can't even make a simple query
> for a specific day in my dump file:
>
> $> ra -t 2010/10/20 -r anon.argus
>  $> ra -t 2010/10/20+10h -r anon.argus
> $> ra -t 2010/10/20.10 -r anon.argus
> $> ra -t ****/**/20 -r anon.argus
>
> All return nothing, while the dump file definitely has some date in the
> range:
>
> $> ra -r anon.argus -F time.conf | grep 20101020 | wc
> 120
>
> time.conf has a single line: RA_TIME_FORMAT="%Y%m%d"
>
> Am I missing something or is this a bug?
>
> I am using Ra() Version 3.0.5.26, and I sent the dump file to the ftp.
>
> Best regards,
> Rafael Barbosa
> http://www.ewi.utwente.nl/~barbosarr/
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20120308/2b1188fa/attachment.html>