raservices crashes when processing

[Matt Brown]

Hello all,



I took a day's worth of argus data and, as suggested on
http://thread.gmane.org/gmane.network.argus/6228/focus=6234, I analyzed it
with rauserdata as follows:



#racluster -r * -w day.cache

#rauserdata -r day.cache > /tmp/raservices.conf





I then inspected /tmp/raservices.conf and it's messy (lots of single lines
with arbirary ports, likely sport maybe rpc?), but I figured why not give
raservices a shot:



#racluster -r * -w - | raservices -f raservices.conf



I receive the following error:

raservices[21315]: 16:51:00.727719 RaCreateSrvEntry: format error Service:
http





I straced the process, and I see no occurances of "http" in the output
(other than the writev()); the data appears to be read correctly until a
blank line is read [read(3, "", 4096)                       = 0]:



read(3, "\"  \n\nService: 48956             "..., 4096) = 4096

read(3, "...xxxxxx"  dst ="..., 4096) = 4096

read(3, "xxxx"..., 4096) = 689

read(3, "", 4096)                       = 0

close(3)                                = 0

munmap(0xb766e000, 4096)                = 0

gettimeofday({1368651683, 272271}, NULL) = 0

time(NULL)                              = 1368651683

writev(2, [{"raservices[21523]: 17:01:23.2722"..., 79}, {"\n", 1}],
2raservices[21523]: 17:01:23.272271 RaCreateSrvEntry: format error Service:
http

) = 80





Any idea on why this would be?  Is my data processing flow incorrect?





Both clients are 3.0.7.8.





Thanks,



Matt
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130515/1e4c4d02/attachment.html>