1RARC(1) General Commands Manual RARC(1)
2
6 rarc - ra client resource file.
7
9 rarc
10
12 Copyright (c) 2000-2002 QoSient. All rights reserved.
13
15 Ra* clients will open this file if its in the users $HOME directory, or
16 in the $ARGUSHOME directory, and parse it to set common configuration
17 options. All of these values will be overriden by options set on the
18 command line, or in the file specified using the '-F conffile' option.
19 Values can be quoted to make string denotation easier, however, the
21 parser does not require that string values be quoted. To support this,
22 the parse will remove " (double quote) characters from input strings,
23 so do not use this character in strings themselves.
24 Values specified as "" will be treated as a NULL string, and the parser
26 will ignore the variable setting.
27
30 All ra* clients can attach to a remote server, and collect argus data
31 in real time. This variable can be a name or a dot notation IP
32 address. Optionally you can specify a port number using a ':' and then
33 providing the port number desired.
34 RA_ARGUS_SERVER=localhost:561
36
39 All ra* clients can read Cisco Netflow records directly from Cisco
40 routers. Specifying this value will alert the ra* client to open a UDP
41 based socket listening for Cisco Netflow data on the port number speci‐
42 fied.
43 RA_CISCONETFLOW_PORT=
45
49 All ra* clients can support writing output as Argus Records into a file
50 or stdout. Stdout is specified as '-'.
51 RA_OUTPUT_FILE="filename"
53
56 All ra* clients can support input filtering on a time range. The format
57 is:
58 timeSpecification[-timeSpecification]
59 where the format of a timeSpecification can be:
61 [[[yy/]mm/]dd.]hh[:mm[:ss]]
62 [yy/]mm/dd
63 RA_TIMERANGE="55/12/04.00:00:01-55/12/04.23:59:59"
65 RA_TIMERANGE="12/04-12/05"
66
70 All ra* clients can support running for a number of seconds, while
71 attached to a remote source of argus data. This is a type of polling.
72 The default is zero (0), which means run indefinately.
73 RA_RUN_TIME=0
75
79 Most ra* clients are designed to print argus records out in ASCII, with
80 each client supporting its own output formats. For ra() like clients,
81 this variable will generate column headers as labels. The number is
82 the number of lines between repeated header labeling. Setting this
83 value to zero (0) will cause the labels to be printed once. If you
84 don't want labels, comment this line out, delete it or set the value
85 to -1.
86 RA_PRINT_LABELS=0
88
92 Most ra* clients are designed to print argus records out in ASCII, with
93 each client supporting its own output formats. For ra() like clients,
94 this variable can overide the default field delimiter, which are vari‐
95 able spans of space (' '), to be any character. The most common are
96 expected to be '' for tabs, and ',' for comma separated fields.
97 RA_FIELD_DELIMITER=','
99
103 For ra() like clients, this variable will printout summary data for the
104 client session, at the termination of the program.
105 RA_PRINT_SUMMARY=no
107
110 For ra() like clients, this variable will printout the Argus ID that
111 generated the flow record.
112 RA_PRINT_ARGUSID=no
114
117 For ra() like clients, this variable will printout the MAC addresses
118 involved in the flow record, if the MAC address information is avail‐
119 able.
120 RA_PRINT_MACADDRS=no
122
126 For ra() like clients, this variable will print the extended state and
127 protocol indicators.
128 RA_PRINT_INDICATORS=yes
130
133 For ra(1) like clients, this variable will suppress resolving host‐
134 names, and print the dot notation IP address, or ':' notation ethernet
135 address. There is a huge performance impact with name lookup, so the
136 default is to not resolve hostnames.
137 RA_PRINT_HOSTNAMES=no
139 When you intend to print hostnames and port service names rather than
141 the numbers, these variables will help to avoid truncating of host‐
142 names, and provide pretty printing with tools such as ra(1), ragator(1)
143 and rasort(1).
144 These values are simple suggestions.
146 RA_HOST_FIELD_LENGTH=28
147 RA_PORT_FIELD_LENGTH=10
148
151 For ra() like clients, this variable will include the packet and byte
152 counts in the output format.
153 RA_PRINT_COUNTS=yes
155
158 For ra() like clients, this variable will include the response data
159 that is provided by Argus. This is protocol and state specific.
160 RA_PRINT_RESPONSE_DATA=no
162
165 For ra() like clients, this variable will force the timestamp to be in
166 Unix time format, which is an integer representing the number of
167 elapsed seconds since the epoch.
168 RA_PRINT_UNIX_TIME=no
170
173 For ra() like clients, this variable is used to override the time for‐
174 mat of the timestamp. This string must conform to the format specified
175 in strftime(). Malformed strings can generate fatal errors, so be
176 careful with this one.
177 RA_TIME_FORMAT="%y-%m-%d %T"
179
182 For ra() like clients, this variable is used to override the time for‐
183 mat of the timestamp. This determines if the transaction start time
184 will be displayed or not.
185 RA_PRINT_STARTIME=yes
187
190 For ra() like clients, this variable is used to override the time for‐
191 mat of the timestamp. This determines if the transaction last time
192 will be displayed or not.
193 RA_PRINT_LASTIME=no
195
198 For ra() like clients, this variable is used to override the time for‐
199 mat of the timestamp. This variable determines if the transaction
200 duration time will be printed or not.
201 RA_PRINT_DURATION=yes
203
206 For ra() like clients, this variable is used to override the time for‐
207 mat of the timestamp. This variable specifies the number of decimal
208 places that will be printed as the fractional part of the time. Argus
209 collects usec precision, and so a maximum value of 6 is supported. To
210 not print the fractional part, specify the value zero (0).
211 RA_USEC_PRECISION=6
213
217 Argus can capture user data. When printing out the user data contents,
218 using tools such as raxml(), the type of encoding can be specified
219 here. Supported values are "Ascii", or "Encode64".
220 RA_USERDATA_ENCODE=Ascii
222
225 If compiled to support this option, ra* clients are capable of generat‐
226 ing a lot of use [full | less | whatever] debug information. The
227 default value is zero (0).
228 RA_DEBUG_LEVEL=0
230
233 You can provide a filter expression here, if you like. It should be
234 limited to 2K in length. The default is to not filter. See ra(1) for
235 the format of the filter expression.
236 RA_FILTER=""
238
241 When argus is compiled with SASL support, ra* clients may be required
242 to authenticate to the argus server before the argus will accept the
243 connection. This variable will allow one to set the user and autho‐
244 rization id's, if needed. Although not recommended you can provide a
245 password through the RA_AUTH_PASS variable. The format for this vari‐
246 able is:
247 RA_USER_AUTH="user_id/authorization_id"
249 RA_AUTH_PASS="password"
250
253 ra(1)
254 07 November 2000 RARC(1)