.\" Copyright (c) 2000-2016 QoSient, LLC
.\" All rights reserved.
.\" 
.\" This program is free software; you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation; either version 2, or (at your option)
.\" any later version.
.\"
.\" This program is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program; if not, write to the Free Software
.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
.\"
.TH RAHISTO 1 "07 November 2000" "rahisto 3.0.8"
.SH NAME
\fBrahisto\fP \- print histogram of metrics from \fBargus(8)\fP data.
.SH SYNOPSIS
.B rahisto
[\fB\-M\fP \fIhistomode\fP] \fB\-H\fP \fIbin[L]:range|size\fP ...
[\fBraoptions\fP] [\fB--\fP \fIfilter-expression\fP]
.SH DESCRIPTION
.IX  "rahisto command"  ""  "\fLrahisto\fP \(em argus data"
.LP
.B Rahisto
reads
.BR argus
data from an \fIargus-data\fP source, sorts the records based on
the criteria specified on the command line, and outputs a valid
\fIargus-stream\fP.
.SH OPTIONS
Rahisto, like all ra based clients, supports a number of
\fBra options\fP including filtering of input argus
records through a terminating filter expression.
See \fBra(1)\fP for a complete description of \fBra options\fP.
\fBrahisto(1)\fP specific options are:
.PP
.PD 0
.TP 4 4
.B \-M nozero
Don't print bins that have zero frequencies.
.TP 4 4
.B \-M outlayer
Print accumulated stats for outlayer values, i.e. the values that
are outside the histogram range.
.TP 15
.BI \-H "\| metric bin[L]:range | size\^"

.TP 5
Supported metrics are:
.PP
.RS
.TP 15
.B dur
record total duration.
.TP
.B avgdur
record average duration.
.TP
.B proto
transaction protocol.
.TP
.B sport
source port number.
.TP
.B dport
destination port number.
.TP
.B stos
source TOS byte value.
.TP
.B dtos
destination TOS byte value.
.TP
.B sttl
src -> dst TTL value.
.TP
.B dttl
dst -> src TTL value.
.TP
.B [s|d]bytes
[src | dst] transaction bytes.
.TP
.B [s|d]appbytes
[src | dst] application bytes.
.TP
.B [s|d]pkts
[src | dst] packet count.
.TP
.B [s|d]meansz
[src | dst] mean packet size.
.TP
.B [s|d]load
packets per second.
.TP
.B [s|d]loss
pkts retransmitted or dropped.
.TP
.B [s|d]ploss
percent pkts retransmitted or dropped.
.TP
.B [s|d]rate
bits per second.
.PD
.RE

.SH INVOCATION
A sample invocation of \fBrahisto(1)\fP.  This call reads \fBargus(8)\fP data
from \fBinputfile\fP and generates a frequency distribution histogram for
the transaction duration for HTTP traffic. 

.nf
.ft CW
.ps 8
.vs 8
% rahisto -H dur 10 -r ~/argus/data/argus*out.gz - port http
 N = 194     mean = 15.928685  stddev = 23.728876  max = 81.354462  min = 0.008055
           median =  0.079948     95% = 59.208977
 Class     Interval         Freq    Rel.Freq     Cum.Freq    
     1   0.000000e+00        123    63.4021%     63.4021%    
     2   8.200000e+00          7     3.6082%     67.0103%    
     3   1.640000e+01         13     6.7010%     73.7113%    
     4   2.460000e+01          9     4.6392%     78.3505%    
     5   3.280000e+01          0     0.0000%     78.3505%    
     6   4.100000e+01          0     0.0000%     78.3505%    
     7   4.920000e+01          6     3.0928%     81.4433%    
     8   5.740000e+01         35    18.0412%     99.4845%    
     9   6.560000e+01          0     0.0000%     99.4845%    
    10   7.380000e+01          1     0.5155%    100.0000%  
.vs
.ps
.ft P

.fi

A sample invocation where the call reads \fBargus(8)\fP data
from \fBinputfile\fP and generates a frequency distribution histogram for
the round-trip time of arp volleys in \fBargus(8)\fP data.

.nf
.ft CW
.ps 8
.vs 8
% rahisto -H dur 10:0-75u  -R /Vol*/Data/Archive/split/*68/2012/0[23] - arp and dur gt 0
 N = 360     mean = 0.000028  stddev = 0.000007  max = 0.000066  min = 0.000014
           median = 0.000031     95% = 0.000028
             mode = 0.000026
 Class     Interval         Freq    Rel.Freq     Cum.Freq    
     1   0.000000e+00          0     0.0000%      0.0000%    
     2   7.500000e-06          2     0.5556%      0.5556%    
     3   1.500000e-05         63    17.5000%     18.0556%    
     4   2.250000e-05        188    52.2222%     70.2778%    
     5   3.000000e-05         71    19.7222%     90.0000%    
     6   3.750000e-05         23     6.3889%     96.3889%    
     7   4.500000e-05         10     2.7778%     99.1667%    
     8   5.250000e-05          2     0.5556%     99.7222%    
     9   6.000000e-05          1     0.2778%    100.0000%    
    10   6.750000e-05          0     0.0000%    100.0000% 

.vs
.ps
.ft P
.fi

.SH COPYRIGHT
Copyright (c) 2000-2016 QoSient. All rights reserved.

.SH SEE ALSO
.BR ra(1),
.BR rarc(5),
.BR argus(8),

.SH AUTHORS
.nf
Carter Bullard (carter@qosient.com).
.fi
.SH BUGS