Re: racluster 3.0.8.2 segfaults with -M dsrs option

Hey Markku P,
You should be running argus-clients-3.0.8.2, as that is the current version.  If you can, please make that upgrade.  The modifications I have included below belong to that version, so if needed … upgrade and then update with the included files below.

The file that you sent is corrupted (as you probably suspected).  It has a partial argus record at byte offset 1863448 (about 22% into the data file), which doesn’t have any time values. This is an illegal record, and so we stop processing.  Your corrupted file did expose a bug that I’ve fixed.

Now, argus clients can recover from corrupted flow records, by skipping 4 byte chunks until it finds legitimate records in the file, and your file does have legitimate data starting at byte count 1866640.  But there are a few records that are really munged.  Any possibility that you had 2 processes writing into the file for some time ????

The corrupted file tickled a few bugs, as the corruption generated pseudo Netflow records, and pseudo Argus event records.  I’ve fixed it to the point that we can read your file, but it involves multiple changes to ./common/argus_client.c and ./common/argus_util.c.  If you could, replace your copies of the files I’ve included, and test it out on your data that would be cool.

Thanks !!!!

Carter