Content-type: text/html
Manpage of RACLUSTER
RACLUSTER
Section: User Commands (1)
Updated: 07 October 2003
Index
Return to Main Contents
NAME
racluster - aggregate argus(8) data files.
SYNOPSIS
racluster
[-f conf] [-m agr(s)] [-M mode(s)] [raoptions]
DESCRIPTION
Racluster
reads
argus
data from an argus-data source, and clusters/merges the records
based on the flow key criteria specified either on the command line, or
in a racluster configuration file, and outputs a valid argus-stream.
This tool is primarily used for data mining, data management and report
generation.
The default action is to merge status records from the same flow and
argus probe, providing in some cases huge data reduction with
limited loss of flow information. Racluster provides the ability to
modify the flow model key, either using the "-m" option, or in the
racluster.conf file, allowing records to be clustered based on any
number of attributes. This supports the development of important
reports, such as MPLS LSP usage statistics, DiffServe flow marking
policy verification, VLAN group behavior, IP distance related
measurements, routing loop detection, traceroute path data recovery,
and complex availability/reachability reports, to name just a few
useful applications.
Please see racluster.5 for detailed information regarding racluster
configuration.
OPTIONS
Racluster, like all ra based clients, supports a number of
ra options including filtering of input argus
records through a terminating filter expression, and the ability
to specify the output style, format and contents for printing
data. See ra(1) for a complete description of ra options.
racluster(1) specific options are:
- -m aggregation object
-
Supported aggregation objects are:
-
- none
-
use a null flow key.
- srcid
-
argus source identifier.
- smac
-
source mac(ether) addr.
- dmac
-
destination mac(ether) addr.
- smpls
-
source mpls label.
- dmpls
-
destination label addr.
- svlan
-
source vlan label.
- dvlan
-
destination vlan addr.
- saddr/[l|m]
-
source IP addr/[cidr len | m.a.s.k].
- daddr/[l|m]
-
destination IP addr/[cidr len | m.a.s.k].
- matrix/l
-
sorted src and dst IP addr/cidr len.
- proto
-
transaction protocol.
- sport
-
source port number.
- dport
-
destination port number.
- stos
-
source TOS byte value.
- dtos
-
destination TOS byte value.
- sttl
-
src -> dst TTL value.
- dttl
-
dst -> src TTL value.
- stcpb
-
src -> dst TCP base sequence number.
- dtcpb
-
dst -> src TCP base sequence number.
- inode
-
intermediate node, source of ICMP mapped events.
- -M modes
-
Supported modes are:
-
- norep
-
Do not generate an aggregate statistic for each flow. This is used
primarily when the output represents a single object. Primarily used
when merging status records to generate single flows that represent
single transactions.
- rmon
-
Generate data suitable for producing RMON types of metrics.
- ind
-
Process each input file independantly, so that after the end of
each inputfile, racluster flushes its output.
- replace
-
Replace each inputfile contents, with the aggregated output.
- -V
-
Verbose operation, printing a line of output for each input file processed.
Very useful when using the ra() -R option.
INVOCATION
A sample invocation of racluster(1). This call reads argus(8) data
from inputfile and aggregates the IP protocol based argus(8) data,
based on the source and destination address matrix and the destination port
used by tcp flows, and report the metrics as a percent of the total. For
most services, this provides service specific metrics on a client/server basis.
- racluster -% -r inputfile -m saddr daddr dport - \
tcp and syn and synack
This call reads argus(8) data from inputfile and generates the
path information that traceroute use would generate (assuming that traceroute
was run during the observation period).
- racluster -r inputfile -m saddr daddr sttl inode -w - - icmpmap | \
rasort -m sttl -s saddr dir daddr inode avgdur spkts
COPYRIGHT
Copyright (c) 2000-2007 QoSient. All rights reserved.
SEE ALSO
racluster(5),
ra(1),
rarc(5),
argus(8),
FILES
AUTHORS
Carter Bullard (carter@qosient.com).
BUGS
Index
- NAME
-
- SYNOPSIS
-
- DESCRIPTION
-
- OPTIONS
-
- INVOCATION
-
- COPYRIGHT
-
- SEE ALSO
-
- FILES
-
- AUTHORS
-
- BUGS
-
This document was created by
man2html,
using the manual pages.
Time: 13:20:15 GMT, May 16, 2007