Additional rasqlinsert information

[Carter Bullard]

Hey Dave,
Yes, any data that was generated through RMON aggregation that had a non-default
aggregation model, that included the " proto " field, would have expressed the problem.

Popped up in argus-clients-3.0.7.5, I believe, but should be fine now.

Also in this release, you can do filtering and sorting based on the ABR metric.
We discovered that floating point parsing in the compiler was broken, but that
is now fixed, so a filter like:

   ra - abr -0.0

now works.  We also found out that some getopt() implementations, have moved
to using " -- " as the end of options indicator, so if you use a negative token in
the filter, and you get a syntax error, it maybe that you need to add another dash
to the end of your options.  As a result, in the above example, you may have to do this.

   ra -- abr -0.0

Holler if you find anything that looks unexpected,

Carter

On May 14, 2013, at 9:57 AM, "Dave Edelman" <dedelman at iname.com> wrote:

> Carter,
> 
> Thanks, this is looking much better. I did have to drop the tables that had
> the problem data and then everything started to work well.
> 
> --Dave
> 
>> -----Original Message-----
>> From: Carter Bullard [mailto:carter at qosient.com]
>> Sent: Tuesday, May 14, 2013 7:58 AM
>> To: Dave Edelman; Jesse Bowling
>> Cc: Argus
>> Subject: Re: [ARGUS] Additional rasqlinsert information
>> 
>> Hey Dave,
>> I believe that the fixes in argus-clients-3.0.7.9, which I'm putting up
> right
>> now,
>> address this problem.  The issue is that I turned FLOW_CORRECTION on by
>> default, and the aggregation routines, including rasqlinsert(), were doing
>> flow
>> direction correction, even when the aggregation model was not the default
>> 5-tuple flow definition.  This would generate unexpected CIDR addresses,
>> 0.0.0.0 entries, etc, when the proto field was a part of the model.
>> 
>> This release also fixes a number of issues with using floating point in
> the
>> filter, to support the new " abr " metrics.
>> 
>> Grab these clients, and please give it a try.
>> 
>>   http://qosient.com/argus/dev/argus-clients-3.0.7.9.tar.gz
>> 
>> Carter
>> 
>> 
>> On May 14, 2013, at 7:08 AM, "Dave Edelman" <dedelman at iname.com>
>> wrote:
>> 
>>> Carter,
>>> 
>>> It looks like changing the CIDR notation parameter may be masking the
>>> problem rather than fixing it. I found a bunch of MySQL error messages
> in
>>> the system message log so I restarted rasqlinsert with -D 3.
>>> 
>>> For some reason redirection of STDERR prevented the program from
>> running so
>>> I just used cut and paste into a file.
>>> 
>>> 
>>> 
>>> --Dave
>>> <rasqlinsert.txt>
> 
> 
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6837 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130514/4bcb8e2d/attachment.bin>