[PATCH] rasqlinsert is creating the record field even when -M norec is supplied
Terry Burton
tez at terryburton.co.uk
Fri Sep 6 09:10:58 EDT 2013
On 6 September 2013 14:02, Carter Bullard <carter at qosient.com> wrote:
> Hey Terry,
> The " -M norec " has been deprecated. The rasqlinsert.1 man page sez:
>
> Rasqlinsert by default, includes the actual binary argus 'record' in the schema, and inserts
> and updates the binary record when needed. This enables a large number of fucnctions that
> extend beyond simple RDBMS schema's that are useful. Adding the 'record' is expensive, and
> some will elect to not use this feature. This can be controlled using the option '-s
> -record' as a print field option in the standard ra.1 command line. When the 'record'
> attribute is present, rasql.1 can read the records directly from the database, to provide
> additional processing on the database table contents.
Hey Carter,
That's great! Sorry I didn't spot that before chirping.
> We don't error out on bad modes, so this won't tell you that "-M norec" isn't a mode option.
> Do we need to put it back in?
I'm happy to supply -s with "-record" so it's no problem for me either way.
Many thanks!
Terry
> On Sep 6, 2013, at 8:35 AM, Terry Burton <tez at terryburton.co.uk> wrote:
>
>> Hi Carter,
>>
>> The latest rasqlinsert attempts to create tables with the record field
>> even when -M norec is specified.
>>
>> Invoking as:
>>
>> rasqlinsert -S ... -s saddr,pkts,bytes,trans,proto,dport,srcid -M
>> mysql_engine=MEMORY -M norec -M drop -m saddr proto dport srcid -w
>> mysql://...
>>
>> This is a problem for me as I'm using MEMORY tables for real-time
>> statistics gathering which do not support the BLOB data type.
>>
>> Looks like setting of ArgusSOptionRecord this was omitted from the
>> option parser when the ramysql clients were re-factored:
>>
>> --- a/raclient.c
>> +++ b/raclient.c
>> @@ -712,6 +712,9 @@
>> parser->ArgusAggregator->correct = NULL;
>> }
>> } else
>> + if (!(strncasecmp (mode->mode, "norec", 5))) {
>> + ArgusSOptionRecord = 0;
>> + } else
>> if (!(strncasecmp (mode->mode, "nomerge", 7))) {
>> parser->RaCumulativeMerge = 0;
>> } else
>>
>>
>> All the best,
>>
>> Terry
More information about the argus
mailing list