Time specification bug with rasql

Jesse Bowling jessebowling at gmail.com
Sun Sep 8 22:28:11 EDT 2013


Forgot to include version:

# rasqlinsert --version
RaCurses Version 3.0.7.15


On Sun, Sep 8, 2013 at 10:10 PM, Jesse Bowling <jessebowling at gmail.com>wrote:

> Hi,
>
> I noticed that while using a table created with:
>
> rasqlinsert -m saddr -s "saddr stime ltime" -S localhost -w
> mysql://argus@localhost/argusip/aip_%Y_%m_%d -M time 1d drop rmon -d
>
> I can successfully query for a particular address on a particular day:
>
> # rasql -M time 1d sql="saddr='10.10.10.2'" -r mysql://argus@localhost/argusip/aip_%Y_%m_%d
> -t 2013/09/08
>            SrcAddr                StartTime                 LastTime
>         10.10.10.2 09/08/13 22:03:35.896662 09/08/13 22:03:35.896662
>
> also for a particular month:
>
> # rasql -M time 1d sql="saddr='10.10.10.2'" -r mysql://argus@localhost/argusip/aip_%Y_%m_%d
> -t 2013/09
>            SrcAddr                StartTime                 LastTime
>         10.10.10.2 09/08/13 22:03:35.896662 09/08/13 22:03:35.896662
>
> However, when I query for the year, I get no results:
>
> # rasql -M time 1d sql="saddr='10.10.10.2'" -r mysql://argus@localhost/argusip/aip_%Y_%m_%d
> -t 2013
> #
>
> Running with debug mode, it appears that it's looking for my IP in 1970...
>
> rasql[28545.c0f750b02a7f0000]: 09/08/13 22:08:10.298650 SQL Query SELECT
> record from aip_1970_01_01 WHERE saddr='10.10.10.2'
>
> Seems like a bug...
>
> Cheers,
>
> Jesse
>
> --
> Jesse Bowling
>
>


-- 
Jesse Bowling
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130908/701e21f1/attachment.html>


More information about the argus mailing list