NAME

       rarc - ra client resource file.

SYNOPSIS

       rarc

DESCRIPTION

       Ra*  clients will open this file if its in the users $HOME directory, or in the $ARGUSHOME directory, and
       parse it to set common configuration options.  All of these values will be overriden by  options  set  on
       the command line, or in the file specified using the '-F conffile' option.

       Values  can  be quoted to make string denotation easier, however, the parser does not require that string
       values be quoted.  To support this, the parse will remove " (double quote) characters from input strings,
       so do not use this character in strings themselves.

       Values specified as "" will be treated as a NULL string, and the parser will ignore the variable setting.

RA_ARGUS_SERVER

       All ra* clients can attach to a remote server, and collect argus data in real time.  This variable can be
       a name or a dot notation IP address.  Optionally you can specify a port  number  using  a  ':'  and  then
       providing the port number desired.

       RA_ARGUS_SERVER=localhost:561

RA_SOURCE_PORT

       You  can  change the default source port value that will be used on remote TCP and UDP connections, using
       this variable.  When you specify the remote server using the -S option, when you  don't  specify  a  port
       number, this is the port number it will use.

       The default port number is 561.

       RA_SOURCE_PORT=561

PID FILE SUPPORT

       Any  ra*  program  can generate a pid file, which can be used to control the number of instances that the
       system can support.

       Creating a system pid file may require priviledges that may not  be  inappropriate  for  all  cases.   By
       specifying  RA_PID_PATH, you can create personal pid files that will enforce your own policy for your own
       use of the ra* programs.

       When configured to generate a pid file for a ra* program, if a file called ra*.pid (where ra* is the name
       of  the  program  in  question) exists in the RA_PID_PATH directory, and a program exists with a pid that
       matches the one contained in the file, then the program will not start.  If the pid does not exist,  then
       the  ra*  program  replaces the value in the file, with its own pid.   If a pid file does not exist, then
       the ra* program will create it in the RA_PID_PATH directory, if it can.   The  end  result  is  that  the
       system will support only one instanace of the program, based on name, running at a time.

       The default value is to not generate a pid.  The default path for the pid file, is /var/run.

       No Commandline equivalent

       RA_SET_PID="no"
       RA_PID_PATH="/var/run"

RA_OUTPUT_FILE

       All  ra*  clients can support writing output as Argus Records into a file or stdout.  Stdout is specified
       as '-'.

       RA_OUTPUT_FILE="filename"

RA_TIMERANGE

       All ra* clients can support input filtering on a time range. The format is:
            timeSpecification[-timeSpecification]

       where the format of a timeSpecification can be:
            [[[yy/]mm/]dd.]hh[:mm[:ss]]
            [yy/]mm/dd

       RA_TIMERANGE="55/12/04.00:00:01-55/12/04.23:59:59"
       RA_TIMERANGE="12/04-12/05"

RA_RUN_TIME

       All ra* clients can support running for a number of seconds, while attached to a remote source  of  argus
       data.  This is a type of polling.  The default is zero (0), which means run indefinately.

       RA_RUN_TIME=0

RA_PRINT_MAN_RECORDS

       Specify  if  ra*  clients  should  print  management records by default.  This does not affect management
       record processing, nor down stream management record propagation.

       Commandline equivalents: -M [no]man

       RA_PRINT_MAN_RECORDS=no RA_PRINT_EVENT_RECORDS=no

RA_PRINT_LABELS

       Most ra* clients are designed to print argus records out in ASCII, with each client  supporting  its  own
       output formats.  For ra() like clients, this variable will generate column headers as labels.  The number
       is the number of lines between repeated header labeling.  Setting this value to zero (0) will  cause  the
       labels  to be printed once.  If you don't want labels,  comment this line out, delete it or set the value
       to -1.

       RA_PRINT_LABELS=0

RA_FIELD_DELIMITER

       Most ra* clients are designed to print argus records out in ASCII, with each client  supporting  its  own
       output  formats.  For ra() like clients, this variable can overide the default field delimiter, which are
       variable spans of space (' '), to be any character.  The most common are expected to be '' for tabs,  and
       ',' for comma separated fields.

       RA_FIELD_DELIMITER=','

RA_PRINT_NAMES

       For  ra(1)  like clients, this variable will control the translation of various numbers to names, such as
       address hostnames, port service names and/or protocol names.  There can be a huge performance impact with
       name lookup, so the default is to not resolve hostnames.

       RA_PRINT_NAMES=port

       Other  valid options are none to print no names, proto to translate the protocol names, port to translate
       port names, and all to translate all the fields.  An invalid option will default to port, silently.

RA_CIDR_ADDRESS_FORMAT

       Use this variable to specify whether ra() clients, when printing numeric IP addresses, will print them as
       CIDR addresses, or not.  CIDR notation is constructed from the IP address and the prefix size, the latter
       being the number of leading 1 bits of the routing prefix. The IP address is expressed  according  to  the
       standards  of IPv4 or IPv6. It is followed by a separator character, the forward slash (/) character, and
       the prefix size expressed as a decimal number.

       Argus IPv4 data contains the CIDR mask length, when its less than 32, and ra* programs  will  by  default
       provides the "/masklen" suffix when the mask is less than 32.

       This  maybe  confusing  for some data processors, which would rather not see the "/masklen" never, or all
       the time.  Use this option to specify changes in the default printing stratgy.

       Accepatable values for this variable are:
           "no"     -  do not provide the CIDR mask length (legacy mode) [default]
           "yes"    -  print CIDR mask length when less than 32
           "strict" -  always print CIDR mask length

       RA_CIDR_ADDRESS_FORMAT="no"

RA_ASN_PRINT_FORMAT

       All ra() clients can print and process AS Numbers that have been added to the  records  through  metadata
       labeling, or were a part of the original Netflow to argus conversion process..

       RFC  5396 specifies 3 formats for representing AS Numbers, and all 3 are acceptable formats. These format
       are:
           "asplain" - 2 and 4-byte ASNs are printed as decimal integers.
           "asdot+"  - 2 and 4-byte ASNs are printed using a dot notation.
           "asdot"   - 2 byte ASNs are printed as decimal, and 4-byte ASNs
                       are printed using a dotted notation..

       The default is 'asplain'.

       No Commandline equivalent

       RA_ASN_PRINT_FORMAT="asplain"

RA_PRINT_RESPONSE_DATA

       For ra() like clients, this variable will include the response data that is provided by Argus.   This  is
       protocol and state specific.

       RA_PRINT_RESPONSE_DATA=no

RA_PRINT_UNIX_TIME

       For  ra()  like  clients,  this  variable will force the timestamp to be in Unix time format, which is an
       integer representing the number of elapsed seconds since the epoch.

       RA_PRINT_UNIX_TIME=no

RA_TIME_FORMAT

       For ra() like clients, the format that is used to print timestamps, is based on  the  strftime()  library
       call, with an extension to print fractions of a sec using "%f".  The default is "%T.%f".  You can overide
       this default time format by setting this variable.  This string must conform to the format  specified  in
       strftime().   Malformed  strings  can  generate  interesting output, so be aware with this one, and don't
       forget the '.' when doing fractions of a second.

       RA_TIME_FORMAT="%T.%f"

RA_TZ

       The timezone used for timestamps is specified by the tzset() library routines, and is normally  specified
       by  factors  such  as  the  TZ  environment  variable  found  on  most machines.  You can override the TZ
       environment variable by specifying a time zone using this variable.   The  format  of  this  string  must
       conform to the format specified by tzset(3).

       RA_TZ="EST5EDT4,M3.2.0/02,M11.1.0/02"
       RA_TZ="PST8PDT"

RA_USEC_PRECISION

       For ra() like clients, this variable is used to override the time format of the timestamp.  This variable
       specifies the number of decimal places that will be printed as the fractional part of  the  time.   Argus
       collects  usec  precision,  and  so a maximum value of 6 is supported.  To not print the fractional part,
       specify the value zero (0).

       RA_USEC_PRECISION=6

RA_USERDATA_ENCODE

       Argus can capture user data, and the argus clients can print, merge, filter, and  strip  user  data  from
       argus  records.  When printing out the user data contents, using tools such as ra.1, the type of encoding
       used to print the buffers can be specified here. This is available because many user data buffers are not
       printable text, and other representations may be more appropriate.

       Supported values are "Ascii", "Obfuscate", "Hex", "Encode32" or "Encode64".  The default is "Ascii".

       Obfuscate  is  an  extension  to  the  Ascii  print,  that  attempts  to over-write plain text passwords,
       encountered in the user data, with 'x's.

       Commandline equivalent: -M printer=<printer>

       RA_USERDATA_ENCODE=Ascii

RA_FILTER

       You can provide a filter expression here, if you like.  It should  be  limited  to  2K  in  length.   The
       default is to not filter.  See ra(1) for the format of the filter expression.

       RA_FILTER=""

RA_FILTER_TIMEOUT

       The filter is compiled in a separate process, and all ra* programs need to wait a reasonable time for the
       filter compiler to finish, or time out and return an error, in the case of a fatal  error  in  compiling.
       Many  systems  are very busy, and could benefit from a prolonged wait period, however, this timeout value
       could generate a significant startup wait state for programs that have poor filter specifications, if the
       timer is too long.

       The current default is 1.5 seconds, but you can set this to any amount of time.

       No Commandline equivalent

       RA_FILTER_TIMEOUT=1.5

SASL SUPPPORT

       When argus is compiled with SASL support, ra* clients may be required to authenticate to the argus server
       before the argus will accept the  connection.   This  variable  will  allow  one  to  set  the  user  and
       authorization  id's,  if  needed.  Although not the best practice, you can provide a password through the
       RA_AUTH_PASS variable.  If you do this, you should protect the contents of this  file.   The  format  for
       this variable is:

       RA_USER_AUTH="user_id/authorization_id"
       RA_AUTH_PASS="password"

       The  clients  can  specify  a  part  of  the  negotiation of the security policy that argus uses. This is
       controlled through the use of a minimum and maximum allowable  protection  strength  values.   Set  these
       variable to control this policy.

       RA_MIN_SSF=0
       RA_MAX_SSF=128

RA_DEBUG_LEVEL

       If  compiled  to  support  this option, ra* clients are capable of generating a lot of use [full | less |
       whatever] debug information.  The default value is zero (0).

       RA_DEBUG_LEVEL=0

RA_CONNECT_TIME

       Some ra style clients use a non-blocking method to connect to remote data sources, so the user many  need
       to control how long to wait if a remote source doesn't respond.  This variable sets the number of seconds
       to wait.  This number should be set to a reasonable value (5 < value < 60).   The  default  value  is  10
       seconds.

       RA_CONNECT_TIME=10

RA_SORT_ALGORITHMS

       Many  ra*  programs sort records as a part of their function.  Programs like rasort.1, providing explicit
       command-line options to specify the sort algorithms and their order, using the  ´-m  field  [field  ...]'
       option.

       Use  this  configuration  directive to specify the default sorting algorithm table for your ra* programs.
       The default sort algorithm is record start time "stime".

       RA_SORT_ALGORITHMS="stime "

RA_TIMEOUT_INTERVAL

       Some ra* clients have a timeout based function.  Ratop, as an example, times out flows and  removes  them
       from  screen at a fixed interval.  This variable can be set using the RA_TIMEOUT_INTERVAL variable, which
       is a float in seconds. 60.0 seconds is the default.

       RA_TIMEOUT_INTERVAL=60.0

RA_UPDATE_INTERVAL

       Some ra* clients have an interval based function.  Ratop, as an example, can  refresh  the  screen  at  a
       fixed  interval.   This  variable  can  be set using the RA_UPDATE_INTERVAL variable, which is a float in
       seconds.  0.5 seconds is the default.

       RA_UPDATE_INTERVAL=0.5

RA_PRINT_ETHERNET_VENDORS

       All ra* clients have the ability to print vendor names for the vendor part of ethernet addresses that are
       in  flow  records.   ra* programs get its strings for the ethernet vendors using Wireshark 'manuf' files.
       One is provided with the distribution, and installed into /usr/local/argus.

       No Commandline equivalent

       RA_PRINT_ETHERNET_VENDORS="no"
       RA_ETHERNET_VENDORS="/usr/local/argus/wireshark.manuf.txt"

RA_DELEGATED_IP

       All ra* clients have the ability to print country codes for the IP addresses that are in a  flow  record.
       Country  codes  are  generated from the ARIN delegated address space files.  Specify the location of your
       DELEGATED_IP file here.

       No Commandline equivalent

       RA_DELEGATED_IP="/usr/local/argus/delegated-ipv4-latest"

RA_RELIABLE_CONNECT

       All ra* clients can reliably connect to remote data sources.  This causes  the  ra*  program  to  try  to
       reconnect  to lost remote sources every 5 seconds, indefinately. This causes ra* program to not terminate
       but retry connection attempts when they fail.

       This feature is implemented using threads, and so threads support must be compiled in.

       No Commandline equivalent

       RA_RELIABLE_CONNECT=no

MYSQL SUPPORT

       Many ra* clients can connect and use a MySQL database, either reading  for  writing.   This  may  require
       references to remotes database hosts, databases, tables, and mysql account names and passwords.

       Default values for these variables can be set here.  support must be compiled in.

       Commandline equivalents:
         -r mysql://[username[:password]@]hostname[:port]/database/tablename
         -w mysql://[username[:password]@]hostname[:port]/database/tablename
         -u username:password

       RA_DATABASE="argus"
       RA_DB_TABLE="table"
       RA_DB_USER="carter"
       RA_DB_PASS="whatever"

       Those  ra* clients that can create database tables may need to specify a table type or rather, a database
       engine other than the defaul, MyISAM.

       Commandline equivalents:
         -M mysql_engine=tableType
            Current tableTypes are
               MyISAM
               InnoDB
               Merge
               Memory
               Archive
               NDB
               Federated
               CSV

       MYSQL_DB_ENGINE="MyISAM"

COLOR SUPPORT

       For ra* programs that use curses, these variables defined color schemes and color assignments.

       Argus uses a sixteen color palette, with 8 monotone  and  8  accent  colors,  plus  16  colors  of  gray.
       Currently  these color values are hard coded.  New versions should allow you to provide color definitions
       for all internal values using a 256 Xterm color wheel, to assign foreground and  background  colors.  But
       we're not there yet

       RA_COLOR_SUPPORT="yes"
       RA_COLOR_CONFIG="/usr/carter/.racolor.conf"

DIRECTION SUPPORT

       Many  ra*  clients  process  flow  records based on source and destination properties.  TCP and UDP ports
       values can be used to assign direction, and are best used for well-known ports (< 1024), values that  are
       in the /etc/services defintions, and the reserved ports (> 1023, < 49151).

       The syntax is:
           RA_PORT_DIRECTION="services"
           RA_PORT_DIRECTION="services,wellknown"
           RA_PORT_DIRECTION="services,wellknown,registered"

       We  recommend  the  wellknown  and services options, as they are a bit more discriminating.  If there are
       ports that you know are services that are in the registered port range, we suggest that you add  them  to
       your  /etc/services file rather than include the registered port range; only because the registered range
       is so large. However, this option is applied only to flow in which the direction  is  ambiguous,  and  as
       such, corrections based on the logic should have minimum effect on analytics.

       RA_PORT_DIRECTION="services,wellknown"

       Sites  use  locality  for  a number of features, such as  access control, and this support is intended to
       support visualization, and analytics.

       Currently, you can identify a collection of IP addresses that represent RA_LOCAL, and are specified using
       an iana-address-file formatted file.  (See ralabel.conf)

       RA_LOCAL="/usr/local/argus/local.addrs"

       When  locality  information is available, programs like ra(), and as the assignement of source when there
       is ambiguity in the flow record as to who is the actual initiator or receiver of the flow.

       When locality information is available, programs like ra(), and ratop() can use that information to  make
       display decisions, such

       RA_LOCAL_DIRECTION  provides  the logic for using the locality information to assign flow direction.  You
       can force the local address to be either the source (src) or the destination (dst).

       The syntax is:
           RA_LOCAL_DIRECTION="local:src"
           RA_LOCAL_DIRECTION="local:dst"

       RA_LOCAL_DIRECTION="suggest:src"
       RA_LOCAL_DIRECTION="force:src

COPYRIGHT

       Copyright (c) 2000-2016 QoSient. All rights reserved.

SEE ALSO

       ra(1)