Time specification bug with rasql
Carter Bullard
carter at qosient.com
Mon Sep 9 17:28:42 EDT 2013
Hey Jesse,
Give this patch a try...should fix your time filter problem.
osiris:common carter$ p4 diff ...
==== //depot/argus/clients/common/argus_util.c#340 - /Users/carter/argus/clients/common/argus_util.c ====
22350c22350
< if ((value > 1900) && (value < (tm->tm_year + 1900))) {
---
> if ((value > 1900) && (value <= (tm->tm_year + 1900))) {
Carter
On Sep 8, 2013, at 10:28 PM, Jesse Bowling <jessebowling at gmail.com> wrote:
> Forgot to include version:
>
> # rasqlinsert --version
> RaCurses Version 3.0.7.15
>
>
> On Sun, Sep 8, 2013 at 10:10 PM, Jesse Bowling <jessebowling at gmail.com> wrote:
> Hi,
>
> I noticed that while using a table created with:
>
> rasqlinsert -m saddr -s "saddr stime ltime" -S localhost -w mysql://argus@localhost/argusip/aip_%Y_%m_%d -M time 1d drop rmon -d
>
> I can successfully query for a particular address on a particular day:
>
> # rasql -M time 1d sql="saddr='10.10.10.2'" -r mysql://argus@localhost/argusip/aip_%Y_%m_%d -t 2013/09/08
> SrcAddr StartTime LastTime
> 10.10.10.2 09/08/13 22:03:35.896662 09/08/13 22:03:35.896662
>
> also for a particular month:
>
> # rasql -M time 1d sql="saddr='10.10.10.2'" -r mysql://argus@localhost/argusip/aip_%Y_%m_%d -t 2013/09
> SrcAddr StartTime LastTime
> 10.10.10.2 09/08/13 22:03:35.896662 09/08/13 22:03:35.896662
>
> However, when I query for the year, I get no results:
>
> # rasql -M time 1d sql="saddr='10.10.10.2'" -r mysql://argus@localhost/argusip/aip_%Y_%m_%d -t 2013
> #
>
> Running with debug mode, it appears that it's looking for my IP in 1970...
>
> rasql[28545.c0f750b02a7f0000]: 09/08/13 22:08:10.298650 SQL Query SELECT record from aip_1970_01_01 WHERE saddr='10.10.10.2'
>
> Seems like a bug...
>
> Cheers,
>
> Jesse
>
> --
> Jesse Bowling
>
>
>
>
> --
> Jesse Bowling
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130909/c725eb70/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6837 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130909/c725eb70/attachment.bin>
More information about the argus
mailing list