rasqlinsert 3.0.7.28 not inserting additional data fields?

Carter Bullard carter at qosient.com
Wed May 21 10:14:36 EDT 2014


Hey Jason,
it maybe the single 's' that is in your commandline after the 'Z' ??
Not sure what that does if it doesn't generate an error.
Carter


> On May 21, 2014, at 2:29 AM, Jason <dn1nj4 at gmail.com> wrote:
> 
> Hi Carter,
> 
> Appreciate all the help as I try to learn rasqlinsert.  With this command: 
> 
> rasqlinsert -M cache -m saddr proto sport dport -r <myfile> -w mysql://argdb:<password>@
> localhost/argus/tempTable -L0 -Z s -u -s stime saddr proto sport dport sbytes runtime dbytes trans state -D3 -M mysql_engine=MyISAM
> 
> In both both 3.0.6.2 and 3.0.7.28, data is inserted into "tempTable". However in 3.0.7.28, only the fields specified in "-m" have any data (saddr, proto, sport and dport).  Most of the remaining fields are empty or zeroed out in 3.0.7.28 (stime, sbytes, runtime, dbytes and trans).  state is either INT (tcp) or RSP (udp/arp).  I see this in the debug insert statements. 
> 
> Any idea what would cause this?
> 
> Jason



More information about the argus mailing list