# 
#  Argus Software
#  Copyright (c) 2000-2007 QoSient, LLC
#  All rights reserved.
# 
#  This program is free software; you can redistribute it and/or modify
#  it under the terms of the GNU General Public License as published by
#  the Free Software Foundation; either version 2, or (at your option)
#  any later version.
#
#  This program is distributed in the hope that it will be useful,
#  but WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#  GNU General Public License for more details.
#
#  You should have received a copy of the GNU General Public License
#  along with this program; if not, write to the Free Software
#  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
#
# Racluster Aggregation Policy Configuration
#
# Carter Bullard
# QoSient, LLC
#
#   This configuration is a racluster(1) flow model configuration file.
#
#   The concept is to bind a traditional ra* filter with an
#   aggregation model.  Records are tested against the filter
#   specifications in "fall down" order, when they match, the
#   aggregation model is used to merge records together.  The model
#   supports hold and idle timers in order to control the holding
#   merging strategies.  If reading from a file, the times are
#   determined from timestamps in the input stream.  The system
#   works best if the input stream is somewhat sorted in time.
#
#   Here is a valid and simple configuration file.   It doesn't do
#   anything in particular, but it is one that is used at some sites.
#

#RACLUSTER_MODEL_NAME=Test Configuration
#RACLUSTER_PRESERVE_FIELDS=yes
#RACLUSTER_REPORT_AGGREGATION=no
#RACLUSTER_AUTO_CORRECTION=yes

filter="icmp"
filter="arp"           model="proto saddr"
filter="tcp or udp"    model="saddr daddr proto dport"  status=120 idle=3600  cont
filter="host 1.2.3.4"  model="saddr daddr proto"        status=0   idle=3600  
filter="dst port http" model="saddr daddr proto dport"  status=0   idle=3600  
filter=""              model="saddr daddr proto"        status=0   idle=3600