We have `flow-capture' running for (looking at the `top' output) about 300 hours and pretty many flow. We used the following command: /usr/bin/flow-cat -t "2008/02/13 14:00:00" -T "2008/02/13 14:29:59" /usr/local/sflow/ft | customParser to parse traffic. But the time it takes to complete the above command had been constantly increasing. We have copied half-hour traffic from /usr/local/sflow/ft to another directory and have run the same command for that another directory. The taken time was small as expected. So it appeared `flow-cat' reads all files in all subdirs of /usr/local/sflow/ft in this case which constantly increases the time to parse traffic. Why is that so? Isn't it sane to only read the necessary files? Thanks.
_______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
