.\" Copyright (c) 2000-2003 QoSient, LLC
.\" All rights reserved.
.\"
.\" QOSIENT, LLC DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS
.\" SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
.\" FITNESS, IN NO EVENT SHALL QOSIENT, LLC BE LIABLE FOR ANY
.\" SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER
.\" RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF
.\" CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
.\" CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\"
.\"
.TH RAGRAPH 1 "21 July 2001"
.SH NAME
\fBragraph\fP \- graph \fBargus(8)\fP data.
.SH COPYRIGHT
Copyright (c) 2000-2003 QoSient. All rights reserved.
.SH SYNOPSIS
.B ragraph metric [object]
[\fB\-M\fP \fImode\fP] [\fBoptions\fP] [\fBraoptions\fP]
.SH DESCRIPTION
.IX  "ragraph command"  ""  "\fLragraph\fP \(em argus data"
.LP
.B Ragraph
reads \fBargus(8)\fP data from an \fIargus-file\fP, and graphs
fields of interest from matching argus flow activity records.
Current, \fBragraph\fP uses rrd-tool to generate GIF formatted
graphs, and so many options to rrd-tool are supported by ragraph.

\fBRagraph\fP supports graphing most \fBmetrics\fP that are available
in argus data. The list includes bytes, sbytes, dbytes, pkts,
spkts, dpkts, trans, dur, avgdur.

\fBRagraph\fP also supports graphing based on multiple \fBobjects\fP,
such as the destination address or destination port values.  The
list currently include saddr, daddr, proto, sport, dport.

By default \fBragraph\fP writes its output to ragraph.gif, in
the current directory.  Use the '-w' raoption to specify an
alternate output filename.
.LP
.SH OPTIONS
.TP 4 4
.B \-M <mode> - 
Specify the mode for printing. Current \fBragraph\fP supports
any arbitrary time range as a mode, specified either as a number
followed by the time scale seconds(s), minutes(m), hours(h),
days(d), months(M), years(y), or as a type of time, such as
hourly, daily, etc.
Examles are: 
.nf 
   -M 1s      graph bins of size 1 second.
   -M 15m     graph bins of size 15 minutes.
   -M hourly  graph bins of size 1 hour.
   -M daily   graph bins of size 1 day.
.fi

.TP 4 4
.B \-log
Use logarithmic scale for y-axis.
.TP 4 4
.B \-fill
Turn off area fill.
.TP 4 4
.B \-stack
Turn off data stacking.
.TP 4 4
.B \-split
Turn off axis splitting for src/dst(in/out) traffic.
.TP 4 4
.B \-height
Specify height in pixels for the graph (275 pixels)
.TP 4 4
.B \-width
Specify width in pixels for the graph (800 pixels)
.TP 4 4
.B \-upper
Specify upper bounds for graphing data (automatic).
.TP 4 4
.B \-lower
Specify lower bounds for graphing data (automatic).  When data is
split, you need to specify the value as a negative number.
.TP 4 4
.B \-title
Specify a graph title.
.SH RA OPTIONS
Ragraph, like all ra based clients, supports a number of
\fBra options\fP including filtering of input argus
records through a terminating filter expression, and
specifying an output filename using the -w option.

See \fBra(1)\fP for a complete description of \fBra options\fP.
.SH EXAMPLES
.LP
To graph the total load for the data in an \fIargus-file\fP argus.data
at 10 second intervals:
.RS
.nf
\fBragraph bytes -M 10s -r argus.data -title "Total Load"
.fi
.RE
.LP
To graph the rate (pkt/sec) on a destination port basis for the
data from a specific probe in an \fIargus-file\fP argus.data at
1 minute intervals:
.RS
.nf
\fBragraph pkts dport -M 1m -r argus.data - srcid 192.168.0.10
.fi
.RE

.SH AUTHORS
.nf
Carter Bullard (carter@qosient.com).
.fi
.SH SEE ALSO
.BR ragraph (5),
.BR ra (1),
.BR rarc (5),
.BR argus (8)
.BR tcpdump (1),