artsagg(l)

NAME
artsagg - utility to aggregate ARTS objects in time domain

SYNOPSIS
artsagg [-v] [-i ifIndexList] [-I ifIndexList] [-l numTopPorts]
        [-s portlist] [-T objectTypes] [-h hours] [-o] [-q]
        outfile infile(s)

DESCRIPTION
artsagg is a utility that reads ARTS objects from ARTS files (infile(s)) and aggregates them in the time domain, placing the resulting object(s) into an output file (outfile). For example, you may use artsagg to aggregate 5-minute ARTS data to 1-hour ARTS data. artsagg aggregates the following ARTS data types:
  protocol table
  interface matrix
  IP nexthop table
  AS matrix
  net matrix
  port matrix
  TOS table

OPTIONS

-v  The -v option causes artsagg to print version information and exit immediately.

-T objectTypes
    The -T option may be used to specify the types of data to be aggregated. objectTypes is a comma-separated list of keywords for particular data types. You may use the following keywords:
      proto         - protocol table
      asm           - AS matrix
      netm          - net matrix
      portm         - port matrix
      tos           - TOS table
      nexthop       - IP nexthop table
      intfm         - interface matrix

-i ifIndexList
    The -i ifIndexList option may be used to select only data which contains an interface index attribute in ifIndexList. In other words, the -i ifIndexList option lets you select data from particular interfaces or sets of interfaces. ifIndexList may contain hyphens (indicating an inclusive range) and commas. For example, -i 1,2,5-8 would select data with an interface index attribute of 1, 2, 5, 6, 7 or 8.

-I ifIndexList
    The -I ifIndexList option may be used to combine data which contains an interface index attribute in ifIndexList. In other words, the -I ifIndexList option lets you combine data across a set of interfaces. ifIndexList may contain hyphens (indicating an inclusive range) and commas. For example, -I 1,2,5-8 would combine all data with an interface index attribute of 1, 2, 5, 6, 7 or 8. The resulting aggregate objects will contain an interface index attribute of 0.

-l numTopPorts
    The -l numTopPorts option may be used to select the top numTopPorts (by bytes of traffic) to be placed in selected port table objects in the output file. In other words, instead of writing port matrix objects, we write selected port table objects where the selection criteria is the bytes of traffic for each port. All data for ports that are not one of the top numTopPorts by bytes of traffic are lumped into the counters for port 0 in the output selected port objects.

-h hours
    The -h hours option may be used to specify the period of aggregation, in hours. The hours argument accepts a decimal value to permit aggregation by fractional hour values. When the -h hours option is not used, artsagg will write a single ARTS object for each ARTS data type for each interface. These objects will be aggregates for the entire time interval seen in infile(s).

-s portlist
    The -s portlist option is used to select a set of ports to be placed in ArtsSelectedPortTable objects in the output file. In other words, instead of writing port matrix objects, we write selected port table objects. A selected port table object does not retain the source to destination port information, but instead lumps traffic into the lower of the source or destination port for ports in portlist and lumps those that aren't in portlist into the input counters for port 0. portlist may contain hyphens (indicating an inclusive range) or commas. For example, -s 1-1024,6000,7070 would select ports 1 through 1024 (inclusive), port 6000 and port 7070. All traffic for ports outside of these values would be lumped into counters for port 0.

-o  By default, artsagg appends to the output file, so you may accumlate aggregate objects in a single file over multiple invocations of artsagg. You may override this behavior with the -o option. This will cause artsagg to overwrite the output file instead of appending to it.

-q  By default, artsagg prints a '.' for each object it reads and prints a '+' for each object it writes. You may suppress this behavior using the -q (quiet) option.

EXAMPLES

artsagg -h 1.0 /tmp/artsagg1hr.19980821 arts.19980821

NOTES

SEE ALSO
artsasagg(l), artsases(l), artsnetagg(l), artsnets(l), artsportmagg(l), artsportms(l), artsports(l), artsprotoagg(l), artsprotos(l), artsnexthopagg(l), artsnexthops(l), artsintfmagg(l), artsintfms(l), artstos(l), artsdump(l), artstoc(l)

ACKNOWLEDGEMENTS
artsagg and documentation written by Daniel W. McRobb
CAIDA, August 1998