RAHISTO(1)

📦
version 5.0.2+git20250321.41f65e2 · 2 versions
, in debian trixie, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 RAHISTO(1) 💖

okay bestie, welcome to rahisto, a General Commands Manual moment, and honestly? it's giving histogram queen. let's get into it 🎀

✨ NAME ✨

rahisto — print histogram of metrics from argus(8) data. periodt.

🌸 SYNOPSIS 🌸

rahisto [-M histomode] -H bin[L]:range|size ... [raoptions] [-- filter-expression]

🦋 DESCRIPTION 🦋

So here's the tea: rahisto reads argus data from an argus-data source, sorts the records based on whatever criteria you specified on the command line, and then outputs a valid argus-stream. no cap, that's the whole vibe. 💅

👑 OPTIONS 👑

rahisto, like literally all ra based clients, supports a number of ra options — including filtering of input argus records through a terminating filter expression. See ra(1) for a complete description of ra options, iykyk. 🌈

The rahisto(1) specific options are:

  • -M nozero — don't print bins that have zero frequencies. we're not doing empty bins today bestie, they're not the main character.
  • -M outlayer — print accumulated stats for outlayer values, i.e. the values that are outside the histogram range. those lil outliers still deserve their moment 🫶
  • -M perflow — generate multiple histograms. one histogram for each -H option will be generated each flow discovered. the flow model is specified with the -m option. See the racluster(1) man page for aggregatable objects. note that no aggregation takes place as a result of the -m option; this is used only to classify flow records. one per flow, we stay busy 💅
  • -m aggregation object — supported aggregation objects are listed in the racluster(1) man page.
  • *-H [abs] *metric bin[L]:range | size — specify histogram options, metric, number of bins, whether to use logorithmic scales, and either a range specification to indicate start and stop times, or just the size of each bin. the optional abs indicates that rahisto should use absolute values for the metric. more than one -H option can be supplied. one histogram per metric will be calculated for the same input data. stack 'em up, bestie ✨

rahisto supports 112 argus metrics, which include most of the metrics that can be printed. See ra.1 for metric fields that are supported by the ra* programs. the common metrics include:

  • dur — record total duration.
  • avgdur — record average duration.
  • proto — transaction protocol.
  • sport — source port number.
  • dport — destination port number.
  • stos — source TOS byte value.
  • dtos — destination TOS byte value.
  • sttl — src -> dst TTL value.
  • dttl — dst -> src TTL value.
  • [s|d]bytes — [src | dst] transaction bytes.
  • [s|d]appbytes — [src | dst] application bytes.
  • [s|d]pkts — [src | dst] packet count.
  • [s|d]meansz — [src | dst] mean packet size.
  • [s|d]load — packets per second.
  • [s|d]loss — pkts retransmitted or dropped.
  • [s|d]ploss — percent pkts retransmitted or dropped.
  • [s|d]rate — bits per second.

🧚 INVOCATION 🧚

a sample invocation of rahisto(1). this call reads argus(8) data from inputfile and generates a frequency distribution histogram for the transaction duration for HTTP traffic. look at her go 😭💖

% rahisto -H dur 10 -r ~/argus/data/argus*out.gz - port http
 N = 194     mean = 15.928685  stddev = 23.728876  max = 81.354462  min = 0.008055
           median =  0.079948     95% = 59.208977
 Class     Interval         Freq    Rel.Freq     Cum.Freq
     1   0.000000e+00        123    63.4021%     63.4021%
     2   8.200000e+00          7     3.6082%     67.0103%
     3   1.640000e+01         13     6.7010%     73.7113%
     4   2.460000e+01          9     4.6392%     78.3505%
     5   3.280000e+01          0     0.0000%     78.3505%
     6   4.100000e+01          0     0.0000%     78.3505%
     7   4.920000e+01          6     3.0928%     81.4433%
     8   5.740000e+01         35    18.0412%     99.4845%
     9   6.560000e+01          0     0.0000%     99.4845%
    10   7.380000e+01          1     0.5155%    100.0000%

another sample invocation where the call reads argus(8) data from inputfile and generates a frequency distribution histogram for the round-trip time of arp volleys in argus(8) data. arp volleys!! iconic behavior fr fr 🔥

% rahisto -H dur 10:0-75u  -R /Vol*/Data/Archive/split/*68/2012/0[23] - arp and dur gt 0
 N = 360     mean = 0.000028  stddev = 0.000007  max = 0.000066  min = 0.000014
           median = 0.000031     95% = 0.000028
             mode = 0.000026
 Class     Interval         Freq    Rel.Freq     Cum.Freq
     1   0.000000e+00          0     0.0000%      0.0000%
     2   7.500000e-06          2     0.5556%      0.5556%
     3   1.500000e-05         63    17.5000%     18.0556%
     4   2.250000e-05        188    52.2222%     70.2778%
     5   3.000000e-05         71    19.7222%     90.0000%
     6   3.750000e-05         23     6.3889%     96.3889%
     7   4.500000e-05         10     2.7778%     99.1667%
     8   5.250000e-05          2     0.5556%     99.7222%
     9   6.000000e-05          1     0.2778%    100.0000%
    10   6.750000e-05          0     0.0000%    100.0000%

Copyright (c) 2000-2024 QoSient. All rights reserved.

⭐ SEE ALSO ⭐

ra(1), racluster(1), rarc(5), argus(8),

🍓 AUTHORS 🍓

Carter Bullard (carter@qosient.com).

💀 BUGS 💀

bestie... there is literally nothing here. the BUGS section is empty. no bugs reported. we love a flawless queen ✨ (or at least, a queen with no documented bugs 👀)

and that's the whole page, bestie! 🎀 this version is rahisto 5.0.3, dated 19 September 2023, and yeah it's the RAHISTO(1) page in the flesh. go make some histograms, you absolute icon 👑💖

📦 where this page comes from