ArgusWriteOutSocket error when using rastream

[Carter Bullard]

Hey Jesse,
Sorry, seems that you’ve been a bit of a guinea pig lately.
So, when you say crash, are we talking Abort, SegFault, core
dump the whole nine yards ???

The argus that “went away”, is an important part of this,
as the sensor should handle all of this without an issue.
I’ll have fixes in 3.0.7.24 up on the server late tonight,
which may fix this problem (memory alignment issues).
Fixes for argus hopefully after that.

Carter

On Apr 9, 2014, at 2:30 PM, Jesse Bowling <jessebowling at gmail.com> wrote:

> argus_postprocess.bash removes some dsrs (writing data to a new directory/filename), then scp the file to another server...
> 
> rastream appears to be generating valid data (spot check), only one srcid (spot check), files show up on the remote server so they seem to be processing correctly...
> 
> versions:
> Argus 3.0.7.3
> # rastream --version
> Rasplit Version 3.0.7.23 ;)
> 
> I had another crash just after I restarted everything, and now it's been quiet for an hour or so...I'll keep an eye out and let you know if anything odd shows up again...
> 
> Cheers,
> 
> Jesse
> 
> 
> 
> 
> On Wed, Apr 9, 2014 at 2:01 PM, Carter Bullard <carter at qosient.com> wrote:
> So for argus to complain, it means that the rastream() stopped processing
> data.  What does the argus_postprocess.bash script do?
> Did rastream() generate any data in the /nsm/argus/data directory?
> Multiple srcid’s ??  Any of the files get processed ??
> I tend to put debug statements in the rastream() script,
> and write those to a log, so I can see what its doing...
> 
> But argus should get through that without any issues…so that is not good.
> Version numbers are always important,
> Carter
> 
> 
> On Apr 9, 2014, at 1:50 PM, Jesse Bowling <jessebowling at gmail.com> wrote:
> 
>> Hello,
>> 
>> I started using rastream today, and after an hour and six minutes encountered this error:
>> 
>> Apr  9 13:46:04 host argus[5662]: 09 Apr 14 13:46:04.269767 ArgusWriteOutSocket(0x7f7515cf5010) maximum errors exceeded 200000
>> Apr  9 13:46:04 host argus[5662]: 09 Apr 14 13:46:04.294472 stopped
>> 
>> Both the argus and the rastream process were dead. Any hints for this?
>> 
>> Started with:
>> 
>> /usr/local/sbin/argus -F /etc/argus.conf 
>> 
>> /usr/local/bin/rastream -M time 5m -B 10s -S 127.0.0.1:561 -w /nsm/argus/data/\$srcid/%Y/%m/%d/argus.%Y.%m.%d.%H.%M.%S -f /root/bin/argus_postprocess.bash -d
>> 
>> Cheers,
>> 
>> Jesse
>> 
>> -- 
>> Jesse Bowling
>> 
> 
> 
> 
> 
> -- 
> Jesse Bowling
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20140409/52ccb006/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 455 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20140409/52ccb006/attachment.sig>