Excluding the 'record' field when using with rasqlinsert

David Edelman dedelman at iname.com
Sat Jun 22 00:18:17 EDT 2013


The magic incantation is   -M norec 

This works fine for me:

/usr/local/bin/rasqlinsert -M time 1d -M cache  -S localhost:9603 -w
mysql://argus@localhost/argus/testmatrix_%Y_%m_%d   -m srcid matrix proto -M
norec -s ltime dur srcid saddr daddr smac dmac proto bytes

--Dave

-----Original Message-----
From: argus-info-bounces+dedelman=iname.com at lists.andrew.cmu.edu
[mailto:argus-info-bounces+dedelman=iname.com at lists.andrew.cmu.edu] On
Behalf Of Matt Brown
Sent: Friday, June 21, 2013 5:05 PM
To: argus-info at lists.andrew.cmu.edu
Subject: [ARGUS] Excluding the 'record' field when using with rasqlinsert

Hello,

I'd like to not have rasqlinsert add the record blob.  When I attempt
to use '-record' I get a variety of interesting errors.

This is with client 3.0.7.10 (with or without the latest patched
version of argus_util.c).

How do I exclude the 'record' field when using rasqlinsert?


Thanks,

Matt




More information about the argus mailing list