Provided by: argus-client_2.0.6.fixes.1-3_i386 bug

NAME

       rarc - ra client resource file.

SYNOPSIS

       rarc

COPYRIGHT

       Copyright (c) 2000-2002 QoSient. All rights reserved.

DESCRIPTION

       Ra* clients will open this file if its in the users $HOME directory, or
       in the $ARGUSHOME directory, and parse it to set  common  configuration
       options.   All  of these values will be overriden by options set on the
       command line, or in the file specified using the '-F conffile' option.

       Values can be quoted to make string  denotation  easier,  however,  the
       parser does not require that string values be quoted.  To support this,
       the parse will remove " (double quote) characters from  input  strings,
       so do not use this character in strings themselves.

       Values specified as "" will be treated as a NULL string, and the parser
       will ignore the variable setting.

RA_ARGUS_SERVER

       All ra* clients can attach to a remote server, and collect  argus  data
       in  real  time.   This  variable  can  be  a  name or a dot notation IP
       address.  Optionally you can specify a port number using a ':' and then
       providing the port number desired.

       RA_ARGUS_SERVER=localhost:561

RA_CISCONETFLOW_PORT

       All  ra*  clients  can  read  Cisco Netflow records directly from Cisco
       routers.  Specifying this value will alert the ra* client to open a UDP
       based  socket  listening  for  Cisco  Netflow  data  on the port number
       specified.

       RA_CISCONETFLOW_PORT=

RA_OUTPUT_FILE

       All ra* clients can support writing output as Argus Records into a file
       or stdout.  Stdout is specified as '-'.

       RA_OUTPUT_FILE="filename"

RA_TIMERANGE

       All ra* clients can support input filtering on a time range. The format
       is:
            timeSpecification[-timeSpecification]

       where the format of a timeSpecification can be:
            [[[yy/]mm/]dd.]hh[:mm[:ss]]
            [yy/]mm/dd

       RA_TIMERANGE="55/12/04.00:00:01-55/12/04.23:59:59"
       RA_TIMERANGE="12/04-12/05"

RA_RUN_TIME

       All ra* clients can support running for  a  number  of  seconds,  while
       attached  to a remote source of argus data.  This is a type of polling.
       The default is zero (0), which means run indefinately.

       RA_RUN_TIME=0

RA_PRINT_LABELS

       Most ra* clients are designed to print argus records out in ASCII, with
       each  client supporting its own output formats.  For ra() like clients,
       this variable will generate column headers as labels.   The  number  is
       the  number  of  lines  between repeated header labeling.  Setting this
       value to zero (0) will cause the labels to be  printed  once.   If  you
       don't  want  labels,  comment this line out, delete it or set the value
       to -1.

       RA_PRINT_LABELS=0

RA_FIELD_DELIMITER

       Most ra* clients are designed to print argus records out in ASCII, with
       each  client supporting its own output formats.  For ra() like clients,
       this variable can  overide  the  default  field  delimiter,  which  are
       variable  spans  of  space (' '), to be any character.  The most common
       are expected to be '' for tabs, and ',' for comma separated fields.

       RA_FIELD_DELIMITER=','

RA_PRINT_SUMMARY

       For ra() like clients, this variable will printout summary data for the
       client session, at the termination of the program.

       RA_PRINT_SUMMARY=no

RA_PRINT_ARGUSID

       For  ra()  like  clients, this variable will printout the Argus ID that
       generated the flow record.

       RA_PRINT_ARGUSID=no

RA_PRINT_MACADDR

       For ra() like clients, this variable will printout  the  MAC  addresses
       involved  in  the  flow  record,  if  the  MAC  address  information is
       available.

       RA_PRINT_MACADDRS=no

RA_PRINT_INDICATORS

       For ra() like clients, this variable will print the extended state  and
       protocol indicators.

       RA_PRINT_INDICATORS=yes

RA_PRINT_HOSTNAMES

       For   ra(1)   like  clients,  this  variable  will  suppress  resolving
       hostnames, and print the dot  notation  IP  address,  or  ':'  notation
       ethernet address.  There is a huge performance impact with name lookup,
       so the default is to not resolve hostnames.

       RA_PRINT_HOSTNAMES=no

       When you intend to print hostnames and port service names  rather  than
       the   numbers,  these  variables  will  help  to  avoid  truncating  of
       hostnames, and provide  pretty  printing  with  tools  such  as  ra(1),
       ragator(1) and rasort(1).

       These values are simple suggestions.
       RA_HOST_FIELD_LENGTH=28
       RA_PORT_FIELD_LENGTH=10

RA_PRINT_COUNTS

       For  ra()  like clients, this variable will include the packet and byte
       counts in the output format.

       RA_PRINT_COUNTS=yes

RA_PRINT_RESPONSE_DATA

       For ra() like clients, this variable will  include  the  response  data
       that is provided by Argus.  This is protocol and state specific.

       RA_PRINT_RESPONSE_DATA=no

RA_PRINT_UNIX_TIME

       For  ra() like clients, this variable will force the timestamp to be in
       Unix time format, which  is  an  integer  representing  the  number  of
       elapsed seconds since the epoch.

       RA_PRINT_UNIX_TIME=no

RA_TIME_FORMAT

       For  ra()  like  clients,  this  variable  is used to override the time
       format of the timestamp.   This  string  must  conform  to  the  format
       specified  in strftime().  Malformed strings can generate fatal errors,
       so be careful with this one.

       RA_TIME_FORMAT="%y-%m-%d %T"

RA_PRINT_STARTIME

       For ra() like clients, this variable  is  used  to  override  the  time
       format of the timestamp.  This determines if the transaction start time
       will be displayed or not.

       RA_PRINT_STARTIME=yes

RA_PRINT_LASTIME

       For ra() like clients, this variable  is  used  to  override  the  time
       format  of the timestamp.  This determines if the transaction last time
       will be displayed or not.

       RA_PRINT_LASTIME=no

RA_PRINT_DURATION

       For ra() like clients, this variable  is  used  to  override  the  time
       format  of  the timestamp.  This variable determines if the transaction
       duration time will be printed or not.

       RA_PRINT_DURATION=yes

RA_USEC_PRECISION

       For ra() like clients, this variable  is  used  to  override  the  time
       format of the timestamp.  This variable specifies the number of decimal
       places that will be printed as the fractional part of the time.   Argus
       collects  usec precision, and so a maximum value of 6 is supported.  To
       not print the fractional part, specify the value zero (0).

       RA_USEC_PRECISION=6

RA_USERDATA_ENCODE

       Argus can capture user data.  When printing out the user data contents,
       using  tools  such  as  raxml(),  the type of encoding can be specified
       here. Supported values are "Ascii", or "Encode64".

       RA_USERDATA_ENCODE=Ascii

RA_DEBUG_LEVEL

       If compiled  to  support  this  option,  ra*  clients  are  capable  of
       generating  a  lot  of  use [full | less | whatever] debug information.
       The default value is zero (0).

       RA_DEBUG_LEVEL=0

RA_FILTER

       You can provide a filter expression here, if you like.   It  should  be
       limited  to 2K in length.  The default is to not filter.  See ra(1) for
       the format of the filter expression.

       RA_FILTER=""

SASL SUPPPORT

       When argus is compiled with SASL support, ra* clients may  be  required
       to  authenticate  to  the argus server before the argus will accept the
       connection.   This  variable  will  allow  one  to  set  the  user  and
       authorization  id's,  if  needed.   Although  not  recommended  you can
       provide a password through the RA_AUTH_PASS variable.  The  format  for
       this variable is:

       RA_USER_AUTH="user_id/authorization_id"
       RA_AUTH_PASS="password"

SEE ALSO

       ra(1)

                               07 November 2000                        RARC(5)