# # Argus Software # Copyright (c) 2000-2007 QoSient, LLC # All rights reserved. # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2, or (at your option) # any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. # # Example radium.conf # # Radium will open this radium.conf if its installed as /etc/radium.conf. # It will also search for this file as radium.conf in directories # specified in $ARGUSPATH, or $ARGUSHOME, $ARGUSHOME/lib, # or $HOME, $HOME/lib, and parse it to set common configuration # options. All values in this file can be overriden by command # line options, or other files of this format that can be read in # using the -F option. # # # Variable Syntax # # Variable assignments must be of the form: # # VARIABLE= # # with no white space between the VARIABLE and the '=' sign. # Quotes are optional for string arguements, but if you want # to embed comments, then quotes are required. # # # Variable Explanations # # Radium is capable of running as a daemon, doing all the right things # that daemons do. When this specific configuration file is used # to configure the system daemon process (/etc/radium.conf) this # variable should be set to "yes". # # The default value is to not run as a daemon. # # This example is to support the ./support/Startup/radium script # which requires that this variable be set to "yes". # # Commandline equivalent -d # RADIUM_DAEMON=yes # Radium Monitor Data is uniquely identifiable based on the source # identifier that is included in each output record. This is to # allow you to work with Radium Data from multiple monitors at the # same time. The ID is 32 bits long, and so legitimate values are # 0 - 4294967296 but radium also supports IP addresses as values. # The configuration allows for you to use host names, however, do # have some understanding how `hostname` will be resolved by the # nameserver before commiting to this strategy completely. # # Commandline equivalent -e # RADIUM_MONITOR_ID=`hostname` # If compiled to support this option, Radium is capable of # generating a lot of debug information. # # The default value is zero (0). # # Commandline equivalent -D # #RADIUM_DEBUG_LEVEL=0 # Radium will periodically report on a its own health, providing # interface status, total packet and bytes counts, packet drop # rates, and flow oriented statistics. # # These records can be used as "keep alives" for periods when # there is no network traffic to be monitored. # # The default value is 60 seconds, but a value of 60 seconds is # very common. # # Commandline equivalent -M # RADIUM_MAR_STATUS_INTERVAL=60 # # Radium can attach to any number of remote argus servers, and # collect argus data in real time. The syntax for this variable # is a hostname or a dot notation IP address, followed by an # optional port value, separated by a ':'. If the port is not # specified, the default value of 561 is used. # # Commandline equivalent -S # #RADIUM_ARGUS_SERVER=amon:12345 #RADIUM_ARGUS_SERVER=thoth:561 #RADIUM_ARGUS_SERVER=apophis:562 #RADIUM_ARGUS_SERVER=otherhost:50000 # You can provide a filter expression here, if you like. # Radium will filter all input records based on this definition. # It should be limited to 2K in length. The default is to # not filter. # # No Commandline equivalent # #RADIUM_FILTER="" # Radium can adjust the timestamps in argus records as it receives # them, based on the measured time difference between radium() # and the sources. The variable takes a threshold value in # seconds, so you can specify when to make a correction. # # No Commandline equivalent # #RADIUM_ADJUST_TIME=5 # Radium has filter capabilities that use a filter optimizer. # If there is a need to not use this filter optimizer, # you can turn it off here. The default is to leave it on. # # Commandline equivalent -O # #RADIUM_FILTER_OPTIMIZER=yes # Radium can read Cicso Netflow records directly from Cisco # routers. Specifying this value will alert Radium to open # a UDP based socket listening for data from this name or address. # # Commandline equivalent -C # #RADIUM_CISCONETFLOW_PORT=9996 # When argus is compiled with SASL support, radium may be # required to authenticate to the argus data source before data # can be received. This variable will allow one to # set the user and authorization id's, if needed. Although # not recommended you can provide a password through the # RADIUM_AUTH_PASS variable. The format for this variable is: # # RADIUM_USER_AUTH="user_id/authorization_id" # # Commandline equivalent -U # #RADIUM_USER_AUTH="" #RADIUM_AUTH_PASS="" # Radium monitors can provide a real-time remote access port # for other programs to collect Radium data. This is a TCP based # port service and the default port number is tcp/561, the # "experimental monitor" service. This feature is disabled by # default, and can be forced off by setting it to zero (0). # # When you do want to enable this service, 561 is a good choice, # as all ra* clients are configured to try this port by default. # # Commandline equivalent -P # RADIUM_ACCESS_PORT=561 # # Radium can write its output to one or a number of files, # default limit is 64 concurrent files, each with their own # independant filters. # # The format is: # RADIUM_OUTPUT_FILE=/full/path/file/name # RADIUM_OUTPUT_FILE=/full/path/file/name "filter" # # Most sites will have radium write to a file, for reliablity # and performance. The example file name used here supports # the archive program ./support/Archive/argusarchive # which is configured to use this file. # # Commandline equivalent -w # #RADIUM_OUTPUT_FILE=/var/log/argus/argus.out