1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
|
...\" $Header: /usr/src/docbook-to-man/cmd/RCS/docbook-to-man.sh,v 1.3 1996/06/17 03:36:49 fld Exp $
...\"
...\" transcript compatibility for postscript use.
...\"
...\" synopsis: .P! <file.ps>
...\"
.de P!
\\&.
.fl \" force out current output buffer
\\!%PB
\\!/showpage{}def
...\" the following is from Ken Flowers -- it prevents dictionary overflows
\\!/tempdict 200 dict def tempdict begin
.fl \" prolog
.sy cat \\$1\" bring in postscript file
...\" the following line matches the tempdict above
\\!end % tempdict %
\\!PE
\\!.
.sp \\$2u \" move below the image
..
.de pF
.ie \\*(f1 .ds f1 \\n(.f
.el .ie \\*(f2 .ds f2 \\n(.f
.el .ie \\*(f3 .ds f3 \\n(.f
.el .ie \\*(f4 .ds f4 \\n(.f
.el .tm ? font overflow
.ft \\$1
..
.de fP
.ie !\\*(f4 \{\
. ft \\*(f4
. ds f4\"
' br \}
.el .ie !\\*(f3 \{\
. ft \\*(f3
. ds f3\"
' br \}
.el .ie !\\*(f2 \{\
. ft \\*(f2
. ds f2\"
' br \}
.el .ie !\\*(f1 \{\
. ft \\*(f1
. ds f1\"
' br \}
.el .tm ? font underflow
..
.ds f1\"
.ds f2\"
.ds f3\"
.ds f4\"
.ta 8n 16n 24n 32n 40n 48n 56n 64n 72n
.TH "\fBflow-cat\fP" "1"
.SH "NAME"
\fBflow-cat\fP \(em Concatenate flow files
.SH "SYNOPSIS"
.PP
\fBflow-cat\fP [-aghmp] [-b\fI big\fP|\fIlittle\fP] [-C\fI comment\fP] [-d\fI debug_level\fP] [-o\fI filename\fP] [-t\fI start_time\fP] [-T\fI start_time\fP] [-z\fI z_level\fP] [\fIfile\fP|\fIdirectory\fP \&...]
.SH "DESCRIPTION"
.PP
The \fBflow-cat\fP utility processes files and/or directories
of files in the flow-tools format\&. The resulting concatenated data set is
written to the standard output or \fBfile\fP specified by
\fB-o\fP\&. If \fBfile\fP is a single dash (`-\&')
or absent, flow-cat will read from the standard input\&.
.SH "OPTIONS"
.IP "-a" 10
Do not ignore filenames that begin with \fBtmp\fP\&.
.IP "-b\fI big\fP|\fIlittle\fP" 10
Byte order of output\&.
.IP "-C\fI Comment\fP" 10
Add a comment\&.
.IP "-d\fI debug_level\fP" 10
Enable debugging\&.
.IP "-g" 10
Sort file list by capture start time before processing\&.
.IP "-h" 10
Display help\&.
.IP "-m" 10
Disable the use of mmap()\&.
.IP "-p" 10
Preload headers\&. Use to preserve meta information such as lost flows\&.
.IP "-o\fI file\fP" 10
Write to \fBfile\fP instead of the standard out\&.
.IP "-t\fI start_time\fP" 10
Select flow files up to \fIstart_time\fP\&. If used with
-T select files between \fIstart_time\fP and
\fIend_time\fP\&.
.IP "-T\fI end_time\fP" 10
Select flow files after \fIend_time\fP\&. If used with
-t select files between \fIstart_time\fP and
\fIend_time\fP\&.
.IP "-z\fI z_level\fP" 10
Configure compression level to \fI z_level\fP\&. 0 is
disabled (no compression), 9 is highest compression\&.
.IP "\fIfile\fP|\fIdirectory\&.\&.\&.\fP" 10
Process the files and/or directory\&.
.SH "TIME/DATE parsing"
.PP
start_time and end_time parsing is implemented with
\fBgetdate\&.y\fP, a commonly used function to process free-form
time date specifications\&. Example usage borrowed from \fBcvs\fP:
1 month ago
2 hours ago
400000 seconds ago
last year
last Monday
yesterday
a fortnight ago
3/31/92 10:00:07 PST
January 23, 1987 10:05pm
22:00 GMT
.SH "EXAMPLES"
.PP
Concatenate all flow files begining with ft-v05\&.2001-05\&.01, use
flow-print to display the results\&.
.PP
\fBflow-cat ft-v05\&.2001-05-01\&.* | flow-print\fP
.PP
Concatenate flow files in \fB/flows/krc4\fP, store
store the output in \fBcompressed\&.flows\fP at compression
level 9 (best)\&. The headers are preloaded so various metadata such
as the flow count is correct in the result\&. Filenames begining with
\fBtmp\fP which are typically in-progress flow files
from \fBflow-capture\fP are not processed\&.
.PP
\fBflow-cat -p -z9 /flows/krc4 > compressed\&.flows\fP
.SH "BUGS"
.PP
None known\&.
.SH "AUTHOR"
.PP
Mark Fullmer maf@splintered\&.net
.SH "SEE ALSO"
.PP
\fBflow-tools\fP(1)
...\" created by instant / docbook-to-man, Fri 28 Nov 2003, 23:24
|
