Provided by: argus-client_2.0.6.fixes.1-2_i386 bug

NAME

       rarc - ra client resource file.

SYNOPSIS

       rarc

COPYRIGHT

       Copyright (c) 2000-2002 QoSient. All rights reserved.

DESCRIPTION

       Ra* clients will open this file if its in the users $HOME directory, or
       in the $ARGUSHOME directory, and parse it to set  common  configuration
       options.   All  of these values will be overriden by options set on the
       command line, or in the file specified using the ’-F conffile’  option.

       Values  can  be  quoted  to make string denotation easier, however, the
       parser does not require that string values be quoted.  To support this,
       the  parse  will remove " (double quote) characters from input strings,
       so do not use this character in strings themselves.

       Values specified as "" will be treated as a NULL string, and the parser
       will ignore the variable setting.

RA_ARGUS_SERVER

       All  ra*  clients can attach to a remote server, and collect argus data
       in real time.  This variable can  be  a  name  or  a  dot  notation  IP
       address.  Optionally you can specify a port number using a ’:’ and then
       providing the port number desired.

       RA_ARGUS_SERVER=localhost:561

RA_CISCONETFLOW_PORT

       All ra* clients can read Cisco  Netflow  records  directly  from  Cisco
       routers.  Specifying this value will alert the ra* client to open a UDP
       based socket listening for  Cisco  Netflow  data  on  the  port  number
       specified.

       RA_CISCONETFLOW_PORT=

RA_OUTPUT_FILE

       All ra* clients can support writing output as Argus Records into a file
       or stdout.  Stdout is specified as ’-’.

       RA_OUTPUT_FILE="filename"

RA_TIMERANGE

       All ra* clients can support input filtering on a time range. The format
       is:
            timeSpecification[-timeSpecification]

       where the format of a timeSpecification can be:
            [[[yy/]mm/]dd.]hh[:mm[:ss]]
            [yy/]mm/dd

       RA_TIMERANGE="55/12/04.00:00:01-55/12/04.23:59:59"
       RA_TIMERANGE="12/04-12/05"

RA_RUN_TIME

       All  ra*  clients  can  support  running for a number of seconds, while
       attached to a remote source of argus data.  This is a type of  polling.
       The default is zero (0), which means run indefinately.

       RA_RUN_TIME=0

RA_PRINT_LABELS

       Most ra* clients are designed to print argus records out in ASCII, with
       each client supporting its own output formats.  For ra() like  clients,
       this  variable  will  generate column headers as labels.  The number is
       the number of lines between repeated  header  labeling.   Setting  this
       value  to  zero  (0)  will cause the labels to be printed once.  If you
       don’t want labels,  comment this line out, delete it or set  the  value
       to -1.

       RA_PRINT_LABELS=0

RA_FIELD_DELIMITER

       Most ra* clients are designed to print argus records out in ASCII, with
       each client supporting its own output formats.  For ra() like  clients,
       this  variable  can  overide  the  default  field  delimiter, which are
       variable spans of space (’ ’), to be any character.   The  most  common
       are expected to be ’’ for tabs, and ’,’ for comma separated fields.

       RA_FIELD_DELIMITER=’,’

RA_PRINT_SUMMARY

       For ra() like clients, this variable will printout summary data for the
       client session, at the termination of the program.

       RA_PRINT_SUMMARY=no

RA_PRINT_ARGUSID

       For ra() like clients, this variable will printout the  Argus  ID  that
       generated the flow record.

       RA_PRINT_ARGUSID=no

RA_PRINT_MACADDR

       For  ra()  like  clients, this variable will printout the MAC addresses
       involved in  the  flow  record,  if  the  MAC  address  information  is
       available.

       RA_PRINT_MACADDRS=no

RA_PRINT_INDICATORS

       For  ra() like clients, this variable will print the extended state and
       protocol indicators.

       RA_PRINT_INDICATORS=yes

RA_PRINT_HOSTNAMES

       For  ra(1)  like  clients,  this  variable  will   suppress   resolving
       hostnames,  and  print  the  dot  notation  IP address, or ’:’ notation
       ethernet address.  There is a huge performance impact with name lookup,
       so the default is to not resolve hostnames.

       RA_PRINT_HOSTNAMES=no

       When  you  intend to print hostnames and port service names rather than
       the  numbers,  these  variables  will  help  to  avoid  truncating   of
       hostnames,  and  provide  pretty  printing  with  tools  such as ra(1),
       ragator(1) and rasort(1).

       These values are simple suggestions.
       RA_HOST_FIELD_LENGTH=28
       RA_PORT_FIELD_LENGTH=10

RA_PRINT_COUNTS

       For ra() like clients, this variable will include the packet  and  byte
       counts in the output format.

       RA_PRINT_COUNTS=yes

RA_PRINT_RESPONSE_DATA

       For  ra()  like  clients,  this variable will include the response data
       that is provided by Argus.  This is protocol and state specific.

       RA_PRINT_RESPONSE_DATA=no

RA_PRINT_UNIX_TIME

       For ra() like clients, this variable will force the timestamp to be  in
       Unix  time  format,  which  is  an  integer  representing the number of
       elapsed seconds since the epoch.

       RA_PRINT_UNIX_TIME=no

RA_TIME_FORMAT

       For ra() like clients, this variable  is  used  to  override  the  time
       format  of  the  timestamp.   This  string  must  conform to the format
       specified in strftime().  Malformed strings can generate fatal  errors,
       so be careful with this one.

       RA_TIME_FORMAT="%y-%m-%d %T"

RA_PRINT_STARTIME

       For  ra()  like  clients,  this  variable  is used to override the time
       format of the timestamp.  This determines if the transaction start time
       will be displayed or not.

       RA_PRINT_STARTIME=yes

RA_PRINT_LASTIME

       For  ra()  like  clients,  this  variable  is used to override the time
       format of the timestamp.  This determines if the transaction last  time
       will be displayed or not.

       RA_PRINT_LASTIME=no

RA_PRINT_DURATION

       For  ra()  like  clients,  this  variable  is used to override the time
       format of the timestamp.  This variable determines if  the  transaction
       duration time will be printed or not.

       RA_PRINT_DURATION=yes

RA_USEC_PRECISION

       For  ra()  like  clients,  this  variable  is used to override the time
       format of the timestamp.  This variable specifies the number of decimal
       places  that will be printed as the fractional part of the time.  Argus
       collects usec precision, and so a maximum value of 6 is supported.   To
       not print the fractional part, specify the value zero (0).

       RA_USEC_PRECISION=6

RA_USERDATA_ENCODE

       Argus can capture user data.  When printing out the user data contents,
       using tools such as raxml(), the type  of  encoding  can  be  specified
       here. Supported values are "Ascii", or "Encode64".

       RA_USERDATA_ENCODE=Ascii

RA_DEBUG_LEVEL

       If  compiled  to  support  this  option,  ra*  clients  are  capable of
       generating a lot of use [full | less  |  whatever]  debug  information.
       The default value is zero (0).

       RA_DEBUG_LEVEL=0

RA_FILTER

       You  can  provide  a filter expression here, if you like.  It should be
       limited to 2K in length.  The default is to not filter.  See ra(1)  for
       the format of the filter expression.

       RA_FILTER=""

SASL SUPPPORT

       When  argus  is compiled with SASL support, ra* clients may be required
       to authenticate to the argus server before the argus  will  accept  the
       connection.   This  variable  will  allow  one  to  set  the  user  and
       authorization id’s,  if  needed.   Although  not  recommended  you  can
       provide  a  password through the RA_AUTH_PASS variable.  The format for
       this variable is:

       RA_USER_AUTH="user_id/authorization_id"
       RA_AUTH_PASS="password"

SEE ALSO

       ra(1)

                               07 November 2000                        RARC(5)