artsagg






artsagg − utility to aggregate ARTS objects in time domain


artsagg [‐v] [‐i ifIndexList] [‐I ifIndexList] [‐l numTopPorts]
        [‐s portlist] [‐T objectTypes] [‐h hours] [‐o] [‐q]
        outfile infile(s)

artsagg is a utility that reads ARTS objects from ARTS files
(infile(s)) and aggregates them in the time domain, placing
the resulting object(s) into an output file (outfile).  For
example, you may use artsagg to aggregate 5‐minute ARTS data
to 1‐hour ARTS data.  artsagg aggregates the following ARTS
data types:

  protocol table
  interface matrix
  IP nexthop table
  AS matrix
  net matrix
  port matrix
  TOS table





‐v   The ‐v option causes artsagg to print version
     information and exit immediately.

‐T objectTypes
     The ‐T option may be used to specify the types of data
     to be aggregated.  objectTypes is a comma‐separated
     list of keywords for particular data types.  You may
     use the following keywords:

       proto         ‐ protocol table
       asm           ‐ AS matrix
       netm          ‐ net matrix
       portm         ‐ port matrix
       tos           ‐ TOS table
       nexthop       ‐ IP nexthop table
       intfm         ‐ interface matrix

‐i ifIndexList
     The ‐i ifIndexList option may be used to select only
     data which contains an interface index attribute in
     ifIndexList.  In other words, the ‐i ifIndexList option
     lets you select data from particular interfaces or sets
     of interfaces.  ifIndexList may contain hyphens
     (indicating an inclusive range) and commas.  For
     example, ‐i 1,2,5‐8 would select data with an interface
     index attribute of 1, 2, 5, 6, 7 or 8.











                             ‐2‐


‐I ifIndexList
     The ‐I ifIndexList option may be used to combine data
     which contains an interface index attribute in
     ifIndexList.  In other words, the ‐I ifIndexList option
     lets you combine data across a set of interfaces.
     ifIndexList may contain hyphens (indicating an
     inclusive range) and commas.  For example, ‐I 1,2,5‐8
     would combine all data with an interface index
     attribute of 1, 2, 5, 6, 7 or 8.  The resulting
     aggregate objects will contain an interface index
     attribute of 0.

‐l numTopPorts
     The ‐l numTopPorts option may be used to select the top
     numTopPorts (by bytes of traffic) to be placed in
     selected port table objects in the output file.  In
     other words, instead of writing port matrix objects, we
     write selected port table objects where the selection
     criteria is the bytes of traffic for each port.  All
     data for ports that are not one of the top numTopPorts
     by bytes of traffic are lumped into the counters for
     port 0 in the output selected port objects.

‐h hours
     The ‐h hours option may be used to specify the period
     of aggregation, in hours.  The hours argument accepts a
     decimal value to permit aggregation by fractional hour
     values.  When the ‐h hours option is not used, artsagg
     will write a single ARTS object for each ARTS data type
     for each interface.  These objects will be aggregates
     for the entire time interval seen in infile(s).

‐s portlist
     The ‐s portlist option is used to select a set of ports
     to be placed in ArtsSelectedPortTable objects in the
     output file.  In other words, instead of writing port
     matrix objects, we write selected port table objects.
     A selected port table object does not retain the source
     to destination port information, but instead lumps
     traffic into the lower of the source or destination
     port for ports in portlist and lumps those that aren’t
     in portlist into the input counters for port 0.

     portlist may contain hyphens (indicating an inclusive
     range) or commas.  For example, ‐s 1‐1024,6000,7070
     would select ports 1 through 1024 (inclusive), port
     6000 and port 7070.  All traffic for ports outside of
     these values would be lumped into counters for port 0.

‐o   By default, artsagg appends to the output file, so you
     may accumlate aggregate objects in a single file over
     multiple invocations of artsagg.  You may override this
     behavior with the ‐o option.  This will cause artsagg
     to overwrite the output file instead of appending to









                             ‐3‐


     it.

‐q   By default, artsagg prints a ’.’ for each object it
     reads and prints a ’+’ for each object it writes.  You
     may suppress this behavior using the ‐q (quiet) option.



artsagg ‐h 1.0 /tmp/artsagg1hr.19980821 arts.19980821



artsasagg(l), artsases(l), artsnetagg(l), artsnets(l),
artsportmagg(l), artsportms(l), artsports(l),
artsprotoagg(l), artsprotos(l), artsnexthopagg(l),
artsnexthops(l), artsintfmagg(l), artsintfms(l), artstos(l),
artsdump(l), artstoc(l)

artsagg and documentation written by Daniel W. McRobb
CAIDA, August 1998