[flow-tools] What to do with flow-capture's orphan tmp files?

[Mark Fullmer]

The tmp files may have incomplete records if compression is enabled.

If cat tmp-xxx | flow-cat does not generate an error they can be renamed
and used.

mark

On Thu, Jun 06, 2002 at 02:19:41PM -0400, Ed Ravin wrote:
> I've been messing around with my flow-capture setup, including
> moving directories around and restarting flow-capture afterwards.
> There seem to be a few orphan tmp-* files left behind:
> 
> # find . -type f -name "tmp*" -print | xargs ls -s
>  208 ./router1/2002/2002-06/2002-06-06/tmp-v05.2002-06-06.140000-0400
>  576 ./router2/2002/2002-05/2002-05-31/tmp-v05.2002-05-31.133000-0400
>  176 ./router2/2002/2002-06/2002-06-02/tmp-v05.2002-06-02.214500-0400
>  528 ./router2/2002/2002-06/2002-06-02/tmp-v05.2002-06-02.223000-0400
> 1104 ./router2/2002/2002-06/2002-06-06/tmp-v05.2002-06-06.134500-0400
>  304 ./router2/2002/2002-06/2002-06-06/tmp-v05.2002-06-06.140000-0400
> 
> The first and last files in the list above are the active ones -
> that leaves four temp files with a good chunk of data that are in "limbo".
> 
> I see from the man page that I should be using SIGQUIT to stop flow-capture
> rather than SIGTERM to close out the tmp file properly.  That doesn't
> quite make sense to me, but easy enough to fix by changing my rc.d script
> to do that in the future.
> 
> In the mean time, what should I do with these files?  I know I can
> include them in statistics collection with the "-a" option to flow-cat,
> but is there any way to get them converted to "normal" data?
> 
> _______________________________________________
> flow-tools@splintered.net
> http://www.splintered.net/sw/flow-tools