psloss and pdloss not showing up in results

Craig Merchant cmerchant at responsys.com
Fri Feb 22 20:34:03 EST 2013


Carter,

I have the following search:

/usr/local/bin/racluster -S 10.10.10.10:561 -T 300 -p 3 -u -Z b -w - | /usr/local/bin/ralabel -r - -f /usr/local/argus/ralabel.conf -c "," -M dsrs=+metric,+agr,+psize,+cocode -n -p 3 -u -s "+0ltime,+1stime,+trans,+dur,+runtime,+mean,+stddev,+sum,+sco,+dco,+pkts,+spkts,+dpkts,+bytes,+sbytes,+dbytes,+load,+sload,+dload,+loss,+sloss,+dloss,+ploss,+psloss,+pdloss,+rate,+srate,+drate,+appbytes,+sappbytes,+dappbytes,+label:200" > /ssd/argus/splunk/racluster.csv

When I look at the racluster.csv file, the pLoss field is there, but I don't see any for psloss and pdloss.  I see the following fields:

Argus Field

DAppBytes

Dir

Dport

DstAddr

DstBytes

DstLoad

DstLoss

DstPkts

DstRate

Dur

Flgs

Label

LastTime

Load

Loss

Mean

Proto

Rate

RunTime

SAppBytes

Sport

SrcAddr

SrcBytes

SrcLoad

SrcLoss

SrcPkts

SrcRate

StartTime

State

StdDev

Sum

TotAppByte

TotBytes

TotPkts

Trans

dCo

pLoss

sCo


Thx.

Craig
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130223/9707b971/attachment.html>


More information about the argus mailing list