Time specification bug with rasql

Carter Bullard carter at qosient.com
Mon Sep 9 17:28:42 EDT 2013


Hey Jesse,
Give this patch a try...should fix your time filter problem.

osiris:common carter$ p4 diff ...
==== //depot/argus/clients/common/argus_util.c#340 - /Users/carter/argus/clients/common/argus_util.c ====
22350c22350
<                if ((value > 1900) && (value < (tm->tm_year + 1900))) {
---
>                if ((value > 1900) && (value <= (tm->tm_year + 1900))) {

Carter

On Sep 8, 2013, at 10:28 PM, Jesse Bowling <jessebowling at gmail.com> wrote:

> Forgot to include version:
> 
> # rasqlinsert --version
> RaCurses Version 3.0.7.15
> 
> 
> On Sun, Sep 8, 2013 at 10:10 PM, Jesse Bowling <jessebowling at gmail.com> wrote:
> Hi,
> 
> I noticed that while using a table created with:
> 
> rasqlinsert -m saddr -s "saddr stime ltime" -S localhost -w mysql://argus@localhost/argusip/aip_%Y_%m_%d -M time 1d drop rmon -d
> 
> I can successfully query for a particular address on a particular day:
> 
> # rasql -M time 1d sql="saddr='10.10.10.2'" -r mysql://argus@localhost/argusip/aip_%Y_%m_%d -t 2013/09/08
>            SrcAddr                StartTime                 LastTime 
>         10.10.10.2 09/08/13 22:03:35.896662 09/08/13 22:03:35.896662
> 
> also for a particular month:
> 
> # rasql -M time 1d sql="saddr='10.10.10.2'" -r mysql://argus@localhost/argusip/aip_%Y_%m_%d -t 2013/09
>            SrcAddr                StartTime                 LastTime 
>         10.10.10.2 09/08/13 22:03:35.896662 09/08/13 22:03:35.896662
> 
> However, when I query for the year, I get no results:
> 
> # rasql -M time 1d sql="saddr='10.10.10.2'" -r mysql://argus@localhost/argusip/aip_%Y_%m_%d -t 2013
> #
> 
> Running with debug mode, it appears that it's looking for my IP in 1970...
> 
> rasql[28545.c0f750b02a7f0000]: 09/08/13 22:08:10.298650 SQL Query SELECT record from aip_1970_01_01 WHERE saddr='10.10.10.2'
> 
> Seems like a bug...
> 
> Cheers,
> 
> Jesse
> 
> -- 
> Jesse Bowling
> 
> 
> 
> 
> -- 
> Jesse Bowling
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130909/c725eb70/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6837 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130909/c725eb70/attachment.bin>


More information about the argus mailing list