flow-merge.sgml

来自「netflow,抓包」· SGML 代码 · 共 193 行

<!DOCTYPE refentry PUBLIC "-//Davenport//DTD DocBook V3.0//EN">
<refentry>

<refmeta>
<refentrytitle>
<application>flow-merge</application>
</refentrytitle>
<manvolnum>1</manvolnum>
</refmeta>

<refnamediv>
<refname>
<application>flow-merge</application>
</refname>
<refpurpose>
Merge flow files.
</refpurpose>
</refnamediv>

<refsynopsisdiv>
<cmdsynopsis>
<command>flow-merge</command>
<arg>-aghm</arg>
<arg>-b<replaceable> big</replaceable>|<replaceable>little</replaceable></arg>
<arg>-C<replaceable> comment</replaceable></arg>
<arg>-d<replaceable> debug_level</replaceable></arg>
<arg>-o<replaceable> filename</replaceable></arg>
<arg>-z<replaceable> z_level</replaceable></arg>
<arg rep="repeat"><replaceable>file</replaceable>|<replaceable>directory</replaceable></arg>
</cmdsynopsis>
</refsynopsisdiv>

<refsect1>
<title>DESCRIPTION</title>
<para>
The <command>flow-merge</command> utility processes files and/or directories
of files in the flow-tools format.  The resulting merged data set is
written to the standard output or <filename>file</filename> specified by
<option>-o</option>.  If <filename>file</filename> is a single dash (`-')
or absent, flow-merge will read from the standard input.  Unlike flow-cat,
flow-merge interleaves flow records preserving the relative chronological
order.
</para>
</refsect1>

<refsect1>
<title>OPTIONS</title>
<variablelist>

<varlistentry>
<term>-a</term>
<listitem>
<para>
Do not ignore filenames that begin with <filename>tmp</filename>.
</para>
</listitem>
</varlistentry>

<varlistentry>
<term>-b<replaceable> big</replaceable>|<replaceable>little</replaceable</term>
<listitem>
<para>
Byte order of output.
</para>
</listitem>
</varlistentry>

<varlistentry>
<term>-C<replaceable> Comment</replaceable></term>
<listitem>
<para>
Add a comment.
</para>
</listitem>
</varlistentry>

<varlistentry>
<term>-d<replaceable> debug_level</replaceable></term>
<listitem>
<para>
Enable debugging.
</para>
</listitem>
</varlistentry>

<varlistentry>
<term>-g</term>
<listitem>
<para>
Sort file list by capture start time before processing.
</para>
</listitem>
</varlistentry>

<varlistentry>
<term>-h</term>
<listitem>
<para>
Display help.
</para>
</listitem>
</varlistentry>

<varlistentry>
<term>-m</term>
<listitem>
<para>
Disable the use of mmap().
</para>
</listitem>
</varlistentry>

<varlistentry>
<term>-p</term>
<listitem>
<para>
Preload headers.  Use to preserve meta information such as lost flows.
</para>
</listitem>
</varlistentry>

<varlistentry>
<term>-o<replaceable> file</replaceable></term>
<listitem>
<para>
Write to <filename>file</filename> instead of the standard out.
</para>
</listitem>
</varlistentry>

<varlistentry>
<term>-z<replaceable> z_level</replaceable></term>
<listitem>
<para>
Configure compression level to <replaceable> z_level</replaceable>.  0 is
disabled (no compression), 9 is highest compression.
</para>
</listitem>
</varlistentry>

<varlistentry>
<term><replaceable>file</replaceable>|<replaceable>directory...</replaceable></term>
<listitem>
<para>
Process the files and/or directory.
</para>
</listitem>
</varlistentry>

</variablelist>
</refsect1>


<refsect1>
<title>EXAMPLES</title>
<informalexample>
<para>
Merge all flow files begining with ft-v05.2001-05.01, use 
flow-print to display the results.
</para>
<para>
    <command>flow-merge ft-v05.2001-05-01.* | flow-print</command>
</para>
</informalexample>
</refsect1>

<refsect1>
<title>BUGS</title>
<para>
None known.
</para>
</refsect1>

<refsect1>
<title>AUTHOR</title>
<para>
<author>
<firstname>Larry</firstname>
<surname>Lidz</surname>
</author>
<email>[e-mail]</email>
</para>
</refsect1>

<refsect1>
<title>SEE ALSO</title>
<para>
<application>flow-tools</application>(1)
</para>
</refsect1>

</refentry>