[PATCH] rasqlinsert is creating the record field even when -M norec is supplied

Carter Bullard carter at qosient.com
Fri Sep 6 09:45:27 EDT 2013


Hey Terry,
Cool...I will add a more specific example in the man page, and put something
in the " rasqlinsert -h " usage output .  Seems that " -s -record " is kinda buried in
the middle of a paragraph, so not the most helpful.

Carter 

On Sep 6, 2013, at 9:10 AM, Terry Burton <tez at terryburton.co.uk> wrote:

> On 6 September 2013 14:02, Carter Bullard <carter at qosient.com> wrote:
>> Hey Terry,
>> The " -M norec " has been deprecated.  The rasqlinsert.1 man page sez:
>> 
>>       Rasqlinsert by default, includes the actual binary argus 'record' in the schema, and inserts
>>       and updates the binary record when needed.  This enables a large number of  fucnctions  that
>>       extend  beyond simple RDBMS schema's that are useful.  Adding the 'record' is expensive, and
>>       some will elect to not use this feature.  This  can  be  controlled  using  the  option  '-s
>>       -record'  as  a  print  field  option  in the standard ra.1 command line.  When the 'record'
>>       attribute is present, rasql.1 can read the records directly from the  database,  to  provide
>>       additional processing on the database table contents.
> 
> Hey Carter,
> 
> That's great! Sorry I didn't spot that before chirping.
> 
>> We don't error out on bad modes, so this won't tell you that "-M norec" isn't a mode option.
>> Do we need to put it back in?
> 
> I'm happy to supply -s with "-record" so it's no problem for me either way.
> 
> 
> Many thanks!
> 
> Terry
> 
> 
>> On Sep 6, 2013, at 8:35 AM, Terry Burton <tez at terryburton.co.uk> wrote:
>> 
>>> Hi Carter,
>>> 
>>> The latest rasqlinsert attempts to create tables with the record field
>>> even when -M norec is specified.
>>> 
>>> Invoking as:
>>> 
>>> rasqlinsert -S ... -s saddr,pkts,bytes,trans,proto,dport,srcid -M
>>> mysql_engine=MEMORY -M norec -M drop -m saddr proto dport srcid -w
>>> mysql://...
>>> 
>>> This is a problem for me as I'm using MEMORY tables for real-time
>>> statistics gathering which do not support the BLOB data type.
>>> 
>>> Looks like setting of ArgusSOptionRecord this was omitted from the
>>> option parser when the ramysql clients were re-factored:
>>> 
>>> --- a/raclient.c
>>> +++ b/raclient.c
>>> @@ -712,6 +712,9 @@
>>>                        parser->ArgusAggregator->correct = NULL;
>>>                     }
>>>                  } else
>>> +                  if (!(strncasecmp (mode->mode, "norec", 5))) {
>>> +                     ArgusSOptionRecord = 0;
>>> +                  } else
>>>                  if (!(strncasecmp (mode->mode, "nomerge", 7))) {
>>>                     parser->RaCumulativeMerge = 0;
>>>                  } else
>>> 
>>> 
>>> All the best,
>>> 
>>> Terry
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6837 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130906/fbbb8f2c/attachment.bin>


More information about the argus mailing list