NAME

       radium - argus record multiplexor

SYNOPSIS

       radium [ options ] [ raoptions ]

DESCRIPTION

       Radium  is  a  real-time  Argus  Record  multiplexor that processes Argus records and Netflow records and
       outputs them to any number of client programs and files.  Radium is a combination of the features of ra.1
       and argus.8, supporting access for upto 128 client programs to argus records originating from remote data
       sources and/or local managed argus data files.  Using  radium  you  can  construct  complex  distribution
       networks  for  collecting  and  processing argus data, and providing a single point of access to archived
       argus data.

       Designed to run as a daemon, radium generally reads argus records  directly  from  a  remote  argus,  and
       writes the transaction status information to a log file or open socket connected to an argus client (such
       as  ra(1)).  Radium provides the same data access controls as argus.8, including remote filtering, source
       address based access control, indivual oriented strong authentication and confidentiality protection  for
       the  distributed  data,  using  SASL  and tcp_wrapper technology.  Please refer to the INSTALL and README
       files for each distribution for a complete description.

       Radium is normally configured from a system /etc/radium.conf configuration file, or from a  configuration
       file either in the $RADIUMHOME directory, or specified on the command line.

RADIUM SPECIFIC OPTIONS

       Radium,  like all ra based clients, supports a number of ra options including remote data access, reading
       from multiple files and filtering of  input  argus  records  through  a  terminating  filter  expression.
       radium(8) specific options are:

OPTIONS

       -B <addr>
            Specify the bind interface address for remote access.  Acceptable values are IP version 4 addresses.
            The default is to bind to INADDR_ANY address.

       -d   Run radium as a daemon.  This will cause radium to do the things that Unix daemons do and return, if
            there were no errors, with radium running as a detached process.

       -e <value>
            Specify  the  source  identifier  for  this  radium.  Acceptable values are numbers, hostnames or ip
            address.

       -f <radium.conf>
            Use radium.conf as a source of configuration information.  Options set in  this  file  override  any
            other  specification,  and  so  this  is the last word on option values. This file is read after the
            system /etc/radium.conf file is processed. See radium.conf.5 for the configuration file format.

       -O   Turn off Berkeley Packet Filter optimizer.  No reason to do this  unless  you  think  the  optimizer
            generates bad code.

       -p   Override  the  persistent  connection  facility.   Radium  provides a fault tolerant feature for its
            remote argus data access facility.  If the remote argus data source closes, radium will maintain its
            client connections, and attempt to reestablish its  connection  with  remote  source.   This  option
            overrides this behavior, causing radium to terminate if any of its remote sources closes.

       -P <portnum>
            Specifies  the <portnum> for remote client connection.  The default is to not support remote access.
            Setting the value to zero (0) will forceably turn off the facility.

       -S   <host[:port][//full/path/to/argus.data.file]> Attach to a specific  remote  host  to  receive  argus
            records.  Append  an  optional  port specifier to attach to a port value other than the default 561.
            Without the optional full pathname, radium will continuously transmit a  stream  of  real-time  flow
            records  as  they  are  received.   With  the optional filename, radium will open the argus datafile
            specified, and stream the contents, closing the connection with the file EOF.

       -T threshold[smh] (secs)
            Indicate that radium should correct the timestamps of received argus records, if  they  are  out  of
            sync  by threshold secconds.  Threshold can be specified with the extensions s, m, or h for seconds,
            minutes or hours.  -X Clear existing radium configuration.  This  removes  any  initialization  done
            prior  to encountering this flag.  Allows you to eliminate the effects of the /etc/radium.conf file,
            or any radium.conf files that may have been loaded.

SIGNALS

       Radium catches a number of signal(3) events.  The three signals SIGHUP, SIGINT, and SIGTERM cause  radium
       to  exit, writing TIMEDOUT status records for all currently active transactions.  The signal SIGUSR1 will
       turn on debug reporting, and subsequent SIGUSR1 signals,  will  increment  the  debug-level.  The  signal
       SIGUSR2 will cause radium to turn off all debug reporting.

ENVIRONMENT

       $RADIUMHOME - Radium Root directory
       $RADIUMPATH - Radium.conf search path (/etc:$RADIUMHOME:$HOME)

FILES

       /etc/radium.conf         - radium daemon configuration file
       /var/run/radium.#.#.pid  - PID file

EXAMPLES

       Run  radium  as  a  daemon,  reading  records  from  a  remote  host, using port 561, and writing all its
       transaction status reports to output-file.  This is a typical mode.
              radium -S remotehost:561 -d -e `hostname` -w output-file

       Collect records from multiple argi, using port 561 on one and port 430 on the  other,  and  make  all  of
       these records available to other programs on port 562.
              radium -S host1:561 -S host2:430 -de `hostname` -P 562

       Collect records from multiple Cisco Netflow sources, using the default port, and make the resulting argus
       records available on port 562.
              radium -C -S host1 -S host2 -de `hostname` -P 562

       Radium  supports  both input filtering and output filtering, and radium supports multiple output streams,
       each with their own independant filters.

       If you are interested in distributing IP traffic only (input filter) and want to  separate  traffic  into
       differing files based on traffic type, this simple example separates ICMP traffic from other traffic.
              radium -w file1 "icmp" -w file2 "not icmp" - ip

       Audit  the network activity that is flowing between the two gateway routers, whose ethernet addresses are
       00:08:03:2D:42:01 and 00:00:0C:18:29:F1.  Make records available to other programs through port 430/tcp.
              radium -S source -P 430 - ether host (0:8:3:2d:42:1 and 0:0:c:18:29:f1) &

       Process argus records from a remote source only between 9am and 5pm every day and provide access to  this
       stream on port 562.
              radium -S remotehost -t 9-17 -P 562

COPYRIGHT

       Copyright (c) 2000-2016 QoSient, LLC   All rights reserved.

AUTHORS

       Carter Bullard (carter@qosient.com)

SEE ALSO

       radium.conf(5), argus(8), hosts_access(5), hosts_options(5), tcpd(8), tcpdump(1)

radium 3.0.8                                     21 October 2001                                       RADIUM(8)