finding where the file size difference is ?

[mike tancsa]

On 8/21/2014 10:45 AM, mike tancsa wrote:
> I created the new one with the command
>
> ra -nr /var/log/argus/mpls-router.arg -w
> /var/log/argus/previous/mpls-router.2014.08.21.00.00 - not dst port 561
> and not dst host 199.212.135.93 and not ether proto llc and not man
>
> I dont understand why it would be bigger ?

If I compress them, the new one is still larger, so it does not seem to 
be some zero padding issue.

Original vs new
# ra -nr mpls-router.arg - | wc
  3835150 34532989 460218001
# ra -nr mpls-router.2014.08.21.00.00 - | wc
  3428332 30871626 411399841

and if I do a straight read vs write
same deal
# ls -lh mpls-router.arg tmp.arg
-rw-r--r--  1 mdtancsa  mdtancsa  -  743M Aug 21 10:34 mpls-router.arg
-rw-r--r--  1 root      mdtancsa  -  1.0G Aug 21 10:56 tmp.arg

# ls -lh mpls-router.arg tmp.arg mpls-router.2014.08.21.00.00
-rw-r--r--  1 mdtancsa  mdtancsa  -  967M Aug 21 10:32 
mpls-router.2014.08.21.00.00
-rw-r--r--  1 mdtancsa  mdtancsa  -  743M Aug 21 10:34 mpls-router.arg
-rw-r--r--  1 root      mdtancsa  -  1.0G Aug 21 10:56 tmp.arg


The newer version of ra perhaps changes some field sizes ?

	---Mike