Time specification bug with rasql
Jesse Bowling
jessebowling at gmail.com
Sun Sep 8 22:10:39 EDT 2013
Hi,
I noticed that while using a table created with:
rasqlinsert -m saddr -s "saddr stime ltime" -S localhost -w
mysql://argus@localhost/argusip/aip_%Y_%m_%d -M time 1d drop rmon -d
I can successfully query for a particular address on a particular day:
# rasql -M time 1d sql="saddr='10.10.10.2'" -r
mysql://argus@localhost/argusip/aip_%Y_%m_%d
-t 2013/09/08
SrcAddr StartTime LastTime
10.10.10.2 09/08/13 22:03:35.896662 09/08/13 22:03:35.896662
also for a particular month:
# rasql -M time 1d sql="saddr='10.10.10.2'" -r
mysql://argus@localhost/argusip/aip_%Y_%m_%d
-t 2013/09
SrcAddr StartTime LastTime
10.10.10.2 09/08/13 22:03:35.896662 09/08/13 22:03:35.896662
However, when I query for the year, I get no results:
# rasql -M time 1d sql="saddr='10.10.10.2'" -r
mysql://argus@localhost/argusip/aip_%Y_%m_%d
-t 2013
#
Running with debug mode, it appears that it's looking for my IP in 1970...
rasql[28545.c0f750b02a7f0000]: 09/08/13 22:08:10.298650 SQL Query SELECT
record from aip_1970_01_01 WHERE saddr='10.10.10.2'
Seems like a bug...
Cheers,
Jesse
--
Jesse Bowling
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130908/dbfa97b0/attachment.html>
More information about the argus
mailing list