NAME

       radium - argus record multiplexor

SYNOPSIS

       radium [ options ] [ raoptions ]

DESCRIPTION

       Radium  is  a  real-time Argus Record multiplexor that processes Argus records and Netflow
       records and outputs them to any  number  of  client  programs  and  files.   Radium  is  a
       combination  of  the  features  of ra.1 and argus.8, supporting access for upto 128 client
       programs to argus records originating from remote data sources and/or local managed  argus
       data  files.   Using radium you can construct complex distribution networks for collecting
       and processing argus data, and providing a single point of access to archived argus data.

       Designed to run as a daemon, radium generally reads argus records directly from  a  remote
       argus,  and  writes  the  transaction  status  information  to  a  log file or open socket
       connected to an argus client (such as  ra(1)).   Radium  provides  the  same  data  access
       controls  as  argus.8,  including  remote  filtering, source address based access control,
       indivual oriented strong authentication and confidentiality protection for the distributed
       data, using SASL and tcp_wrapper technology.  Please refer to the INSTALL and README files
       for each distribution for a complete description.

       Radium is normally configured from a system /etc/radium.conf configuration file, or from a
       configuration file either in the $RADIUMHOME directory, or specified on the command line.

RADIUM SPECIFIC OPTIONS

       Radium,  like  all ra based clients, supports a number of ra options including remote data
       access, reading from multiple files  and  filtering  of  input  argus  records  through  a
       terminating filter expression.  radium(8) specific options are:

OPTIONS

       -B <addr>
            Specify  the  bind  interface  address  for  remote access.  Acceptable values are IP
            version 4 addresses.  The default is to bind to INADDR_ANY address.

       -d   Run radium as a daemon.  This will cause radium to do the things that Unix daemons do
            and return, if there were no errors, with radium running as a detached process.

       -e <value>
            Specify  the  source  identifier  for  this  radium.   Acceptable values are numbers,
            hostnames or ip address.

       -f <radium.conf>
            Use radium.conf as a source of configuration information.  Options set in  this  file
            override any other specification, and so this is the last word on option values. This
            file is read after the system /etc/radium.conf file is processed.  See  radium.conf.5
            for the configuration file format.

       -O   Turn off Berkeley Packet Filter optimizer.  No reason to do this unless you think the
            optimizer generates bad code.

       -p   Override the persistent  connection  facility.   Radium  provides  a  fault  tolerant
            feature  for  its remote argus data access facility.  If the remote argus data source
            closes, radium will maintain its client connections, and attempt to  reestablish  its
            connection  with  remote source.  This option overrides this behavior, causing radium
            to terminate if any of its remote sources closes.

       -P <portnum>
            Specifies the <portnum> for remote client connection.  The default is to not  support
            remote access.  Setting the value to zero (0) will forceably turn off the facility.

       -S   <host[:port][//full/path/to/argus.data.file]>  Attach  to  a  specific remote host to
            receive argus records. Append an optional port specifier to attach to  a  port  value
            other  than  the  default  561.   Without  the  optional  full  pathname, radium will
            continuously transmit a stream of real-time flow records as they are received.   With
            the  optional filename, radium will open the argus datafile specified, and stream the
            contents, closing the connection with the file EOF.

       -T threshold[smh] (secs)
            Indicate that radium should correct the timestamps of received argus records, if they
            are  out  of  sync  by  threshold  secconds.   Threshold  can  be  specified with the
            extensions s, m, or h for seconds,  minutes  or  hours.   -X  Clear  existing  radium
            configuration.  This removes any initialization done prior to encountering this flag.
            Allows you to eliminate the effects of the /etc/radium.conf file, or any  radium.conf
            files that may have been loaded.

SIGNALS

       Radium  catches  a  number  of  signal(3)  events.   The three signals SIGHUP, SIGINT, and
       SIGTERM cause radium to exit, writing TIMEDOUT status records  for  all  currently  active
       transactions.   The  signal  SIGUSR1  will turn on debug reporting, and subsequent SIGUSR1
       signals, will increment the debug-level. The signal SIGUSR2 will cause radium to turn  off
       all debug reporting.

ENVIRONMENT

       $RADIUMHOME - Radium Root directory
       $RADIUMPATH - Radium.conf search path (/etc:$RADIUMHOME:$HOME)

FILES

       /etc/radium.conf         - radium daemon configuration file
       /var/run/radium.#.#.pid  - PID file

EXAMPLES

       Run  radium  as  a daemon, reading records from a remote host, using port 561, and writing
       all its transaction status reports to output-file.  This is a typical mode.
              radium -S remotehost:561 -d -e `hostname` -w output-file

       Collect records from multiple argi, using port 561 on one and port 430 on the  other,  and
       make all of these records available to other programs on port 562.
              radium -S host1:561 -S host2:430 -de `hostname` -P 562

       Collect  records from multiple Cisco Netflow sources, using the default port, and make the
       resulting argus records available on port 562.
              radium -C -S host1 -S host2 -de `hostname` -P 562

       Radium supports both input filtering and output filtering, and  radium  supports  multiple
       output streams, each with their own independant filters.

       If  you are interested in distributing IP traffic only (input filter) and want to separate
       traffic into differing files based on traffic type, this  simple  example  separates  ICMP
       traffic from other traffic.
              radium -w file1 "icmp" -w file2 "not icmp" - ip

       Audit the network activity that is flowing between the two gateway routers, whose ethernet
       addresses are 00:08:03:2D:42:01 and 00:00:0C:18:29:F1.  Make records  available  to  other
       programs through port 430/tcp.
              radium -S source -P 430 - ether host (0:8:3:2d:42:1 and 0:0:c:18:29:f1) &

       Process  argus records from a remote source only between 9am and 5pm every day and provide
       access to this stream on port 562.
              radium -S remotehost -t 9-17 -P 562

COPYRIGHT

       Copyright (c) 2000-2016 QoSient, LLC   All rights reserved.

AUTHORS

       Carter Bullard (carter@qosient.com)

SEE ALSO

       radium.conf(5), argus(8), hosts_access(5), hosts_options(5), tcpd(8), tcpdump(1)