[PATCH] rasqlinsert is creating the record field even when -M norec is supplied

Terry Burton tez at terryburton.co.uk
Fri Sep 6 09:10:58 EDT 2013


On 6 September 2013 14:02, Carter Bullard <carter at qosient.com> wrote:
> Hey Terry,
> The " -M norec " has been deprecated.  The rasqlinsert.1 man page sez:
>
>        Rasqlinsert by default, includes the actual binary argus 'record' in the schema, and inserts
>        and updates the binary record when needed.  This enables a large number of  fucnctions  that
>        extend  beyond simple RDBMS schema's that are useful.  Adding the 'record' is expensive, and
>        some will elect to not use this feature.  This  can  be  controlled  using  the  option  '-s
>        -record'  as  a  print  field  option  in the standard ra.1 command line.  When the 'record'
>        attribute is present, rasql.1 can read the records directly from the  database,  to  provide
>        additional processing on the database table contents.

Hey Carter,

That's great! Sorry I didn't spot that before chirping.

> We don't error out on bad modes, so this won't tell you that "-M norec" isn't a mode option.
> Do we need to put it back in?

I'm happy to supply -s with "-record" so it's no problem for me either way.


Many thanks!

Terry


> On Sep 6, 2013, at 8:35 AM, Terry Burton <tez at terryburton.co.uk> wrote:
>
>> Hi Carter,
>>
>> The latest rasqlinsert attempts to create tables with the record field
>> even when -M norec is specified.
>>
>> Invoking as:
>>
>> rasqlinsert -S ... -s saddr,pkts,bytes,trans,proto,dport,srcid -M
>> mysql_engine=MEMORY -M norec -M drop -m saddr proto dport srcid -w
>> mysql://...
>>
>> This is a problem for me as I'm using MEMORY tables for real-time
>> statistics gathering which do not support the BLOB data type.
>>
>> Looks like setting of ArgusSOptionRecord this was omitted from the
>> option parser when the ramysql clients were re-factored:
>>
>> --- a/raclient.c
>> +++ b/raclient.c
>> @@ -712,6 +712,9 @@
>>                         parser->ArgusAggregator->correct = NULL;
>>                      }
>>                   } else
>> +                  if (!(strncasecmp (mode->mode, "norec", 5))) {
>> +                     ArgusSOptionRecord = 0;
>> +                  } else
>>                   if (!(strncasecmp (mode->mode, "nomerge", 7))) {
>>                      parser->RaCumulativeMerge = 0;
>>                   } else
>>
>>
>> All the best,
>>
>> Terry



More information about the argus mailing list