Monitoring for Large-Scale Networks

SiLK

rwcompare

NAME

rwcompare - Compare the records in two SiLK Flow files

SYNOPSIS

rwcompare [--quiet] [--site-config-file] FILE1 FILE2

rwcompare --help

rwcompare --version

DESCRIPTION

rwcompare opens the two files named on the command and compares the SiLK Flow records they contain. If the records are identical, rwcompare exits with status 0. If any of the records differ, rwcompare prints a message and exits with status 1. If there is an issue reading either file, an error is printed and the exit status is 2. Use the --quiet switch to suppress all output (error messages included). You may use - or stdin for one of the file names, in which case rwcompare reads from the standard input.

OPTIONS

Option names may be abbreviated if the abbreviation is unique or is an exact match for an option. A parameter to an option may be specified as --arg=param or --arg param, though the first form is required for options that take optional parameters.

--quiet: Do not print a message if the files differ, and do not an print error message if a file cannot be opened or read.
--site-config-file=FILENAME: Read the SiLK site configuration from the named file FILENAME. When this switch is not provided, rwcombine searches for the site configuration file in the locations specified in the "FILES" section.
--help: Print the available options and exit.
--version: Print the version number and information about how SiLK was configured, then exit the application.

EXAMPLES

In the following examples, the dollar sign ($) represents the shell prompt. Some input lines are split over multiple lines in order to improve readability, and a backslash (\) is used to indicate such lines. The examples assume the existence of the file data.rw that contains SiLK Flow records. The exit status of the most recent command is available in the shell variable $?.

Compare a file with itself:

$ rwcompare data.rw data.rw
$ echo $?
0

Compare a file with itself, where one instance of the file is read from the standard input:

$ rwcat data.rw | rwcompare - data.rw
$ echo $?
0

Use rwsort(1) to modify one instance of the file and compare the results:

$ rwsort --fields=proto data.rw | rwcompare - data.rw
- data.rw differ: record 1
$ echo $?
1

Run the command again and use the --quiet switch:

$ rwsort --fields=proto data.rw | rwcompare --quiet - data.rw
$ echo $?
1

Compare the file with input containing two copies of the file:

$ rwcat data.rw data.rw | rwcompare data.rw -
data.rw - differ: EOF data.rw
$ echo $?
1

Compare the file with /dev/null:

$ rwcompare --quiet /dev/null data.rw
$ echo $?
2

rwcompare checks whether two files have the same records in the same order. To compare two arbitrary files, use rwsort(1) to reorder the records. Make certain to provide enough fields to the rwsort command so that the records are in the same order.

$ rwsort --fields=1-10,12-15,20-29 data.rw > /tmp/sorted-data.rw
$ rwsort --fields=1-10,12-15,20-29 other-data.rw   \
  | rwcompare /tmp/sorted-data.rw -
/tmp/sorted-data.rw - differ: record 103363

ENVIRONMENT

SILK_CONFIG_FILE: This environment variable is used as the value for the --site-config-file when that switch is not provided.
SILK_DATA_ROOTDIR: This environment variable specifies the root directory of data repository. As described in the "FILES" section, rwcombine may use this environment variable when searching for the SiLK site configuration file.
SILK_PATH: This environment variable gives the root of the install tree. When searching for configuration files, rwcombine may use this environment variable. See the "FILES" section for details.

FILES

${SILK_CONFIG_FILE}
${SILK_DATA_ROOTDIR}/silk.conf
/data/silk.conf
${SILK_PATH}/share/silk/silk.conf
${SILK_PATH}/share/silk.conf
/usr/share/silk/silk.conf
/usr/share/silk.conf: Possible locations for the SiLK site configuration file which are checked when the --site-config-file switch is not provided.