[ARGUS] Filter out flows that start in the current ra-file?

Patrick Forsberg fors at chalmers.se
Thu Nov 18 06:57:19 EST 2021


Hi,

We collect argus data and store it in 5-minute files. That is a file 
contains five minutes of argus data.
This means that in the beginning of the file there will be a lot of 
flows that are continuation of something starting earlier.
Is there an easy way to filter out only those flows that start within 
the file capture time?

I can do

   ra -s+cause -r rafile.ra |grep -v Status

and get text output that omits the flows that are continuations, but I 
would much prefer if it's possible to do it "before the pipe"

Hope I'm making sense here.

/Patrick



More information about the argus mailing list