Argus seems to stop writing data that ra can read.

[elof2 at sentor.se]

Late response:

Very agreeable!

/Elof


On Tue, 8 Apr 2014, Carter Bullard wrote:

> Hey Scott,
> OK, sorry for the delay on this….  So we have in the clients a sanity check
> for bogus metric values as we’re reading argus records from the input,
> and these records that argus-3.0.7.5 is generating that have errant
> packet and byte counts are causing us to reject the stream, and stop
> processing.
>
> I have a fix in the clients to realize the error, zero the errant
> data and mark the flow record cause as ARGUS_ERROR, which puts an
> “ERR” for the flow status.  I don’t like the reason we’re doing this,
> argus generating bogus data, but it allows us to continue to process
> the stream without propagating the corrupted record.
>
> So if this is agreeable,  I’ll have this up on the server later today.
>
> Sorry for the inconvenience.
>
> Carter
>
> On Mar 27, 2014, at 1:57 PM, Unknown <s.a.mcintyre at gmail.com> wrote:
>
>> Hi Carter,
>>
>>
>> On 27 Mar 2014, at 22:47, Carter Bullard wrote:
>>
>>> Hey Scott,
>>> This reads like a corrupt output file.   Any chance you could be running 2 argi, or same argus writing to the same output file twice ???
>>
>> Nope, double verified that, definitely only one process writing, and as you probably noticed from my follow-up, using an older client version reads the server output file just fine.  I've gone ahead and stuck with the older client version for now.
>>
>>
>>>
>>> Can you share one of the files that exhibits the problem??  Does the client just spin or does eventually terminate / die ???
>>
>> Running a simple ra -n -r argus.out terminates fine, doesn't spin, just doesn't show the full contents.  Using the old ra() version shows the full contents.
>>
>> I can get you a sample file, sure, let me know if you still want one or if the clue about different versions of the client was enough.
>>
>> Cheers,
>> Scott
>>
>>
>>
>
>