rasqlinsert 3.0.7.28 not inserting additional data fields?
David Edelman
dedelman at iname.com
Wed May 21 05:59:48 EDT 2014
There is a problem when rasqlinsert reads from a file try removing the -r <filename> and prepend ra -r <filename> -w - | rasqlinsert ... It still doesn't work but the fields are filled in for the records that it creates. BTW you might want to add a -X as the first parameter to each client so that you are sure there isn't a config file problem
--Dave
Dave Edelman
> On May 21, 2014, at 2:29, Jason <dn1nj4 at gmail.com> wrote:
>
> Hi Carter,
>
> Appreciate all the help as I try to learn rasqlinsert. With this command:
>
> rasqlinsert -M cache -m saddr proto sport dport -r <myfile> -w mysql://argdb:<password>@
> localhost/argus/tempTable -L0 -Z s -u -s stime saddr proto sport dport sbytes runtime dbytes trans state -D3 -M mysql_engine=MyISAM
>
> In both both 3.0.6.2 and 3.0.7.28, data is inserted into "tempTable". However in 3.0.7.28, only the fields specified in "-m" have any data (saddr, proto, sport and dport). Most of the remaining fields are empty or zeroed out in 3.0.7.28 (stime, sbytes, runtime, dbytes and trans). state is either INT (tcp) or RSP (udp/arp). I see this in the debug insert statements.
>
> Any idea what would cause this?
>
> Jason
More information about the argus
mailing list