Re: [Nfdump-discuss] nfdump's "hidden" option -T

[Peter H. <ph...@us...>]

Hi Luis,

On 24/2/11 2:14 PM, Luis Servin wrote:
> Hi Peter (and the rest of the list),
> 
> by looking at the code, I realized that there seems to be a "hidden"
> option in nfdump. main() is able to work with "-T" and sets a "int
> do_tag" variable to 1. Else the value of this variable is always 0. This
> seems to be needed by at least one of the print_X functions. The rest
> just ignore it. They all refer to a define that sets tag to '^A'
> (beginnig of line at the console).
> 
> I wasn't able to make sense out of it. In usage() it's not documented.
> Have you got any idea what it is there for? What exactly gets tagged in
> the output and how?
> 

The -T option tags those values in the output, which need be be converted into a link within NfSen in the details page.
As output formats can be very different and can also be user defined, it's the easiest way to ear mark those fields.
This makes the resulting parser ways easier. ^A was selected, as this has no effect on a command line, if users
copy/paste the command into a shell.
As it's used NfSen internally only it was not documented so far. Maybe I should really add a few lines in nfdump(1) ...

Hope this helps.

	- Peter

> Greetings,
> 
> Luis
> 
> 
> 
> ------------------------------------------------------------------------------
> Free Software Download: Index, Search & Analyze Logs and other IT data in 
> Real-Time with Splunk. Collect, index and harness all the fast moving IT data 
> generated by your applications, servers and devices whether physical, virtual
> or in the cloud. Deliver compliance at lower cost and gain new business 
> insights. http://p.sf.net/sfu/splunk-dev2dev 
> 
> 
> 
> _______________________________________________
> Nfdump-discuss mailing list
> Nfd...@li...
> https://lists.sourceforge.net/lists/listinfo/nfdump-discuss

-- 
Be nice to your netflow data. Use NfSen and nfdump :)