Связка с flow-tools

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <arpa/inet.h>
#include "ftlib.h"
/* $Id: $ */
 
 
#pragma pack(1)
typedef struct
{
  unsigned long fromAddr;
  unsigned long toAddr;
  short int fromIface;
  short int toIface;
  short int fromPort;
  short int toPort;
  unsigned long amount;
} bitel;
 
 
/* parameters
* dstfile router_ip [dstfile router] sb srcfile [srcfile..] 
*/
int
main (int argc, char *argv[])
{
  int i = 0;
  int fd = 0;
  int str_count = 0;
  FILE *fp;
  FILE *out;
  struct ftio ftio;
  struct ftprof ftp;
  struct fts3rec_offsets fo;
  struct ftver ftv;
  char *rec;
  u_int32 last_time;
  u_int32 tm;
  bitel b_rec;
 
  if (argc < 3)
    {
      fprintf (stderr, "Usage: %s out_file in_file1 in_file2 in_file3 ... \n",
               argv[0]);
      return 1;
    }
  if ((out = fopen (argv[1], "wb")) == NULL)
    {
      perror ("Cannot create file %m");
      return 2;
    }
 
  for (i = 2; i < argc; i++)
    {
      if ((fp = fopen (argv[i], "rb")) == NULL)
        {
          perror ("Cannot open file %m");
          return 1;
        }
      fd = fileno (fp);
 
      fterr_setid (argv[0]);
      ftprof_start (&ftp);
      if (ftio_init (&ftio, fd, FT_IO_FLAG_READ) < 0)
        {
          perror ("Error in initialization ftio structure:%m");
          return 0;
        }
 
      ftio_get_ver (&ftio, &ftv);
      fts3rec_compute_offsets (&fo, &ftv);
 
      last_time = 0;
      while ( (rec = ftio_read (&ftio)) )
        {
          str_count++;
          tm = *((u_int32 *) (rec + fo.unix_secs));
          if (last_time != tm)
            {
              b_rec.fromAddr = 0;
              b_rec.toAddr = 0;
              b_rec.fromIface = htons (0xff77);
              b_rec.toIface = htons (0xff77);
              b_rec.fromPort = htons ((u_int16) ((tm >> 16) & 0xFFFF));
              b_rec.toPort = htons ((u_int16) (tm & 0xFFFF));
              b_rec.amount = 0;
              fwrite (&b_rec, sizeof (bitel), 1, out);
              last_time = tm;
            }
          b_rec.fromAddr = htonl (*((u_int32 *) (rec + fo.srcaddr)));
          b_rec.toAddr = htonl (*((u_int32 *) (rec + fo.dstaddr)));
          b_rec.fromIface = htons (*((u_int16 *) (rec + fo.input)));
          b_rec.toIface = htons (*((u_int16 *) (rec + fo.output)));
          b_rec.fromPort = htons (*((u_int16 *) (rec + fo.srcport)));
          b_rec.toPort = htons (*((u_int16 *) (rec + fo.dstport)));
          b_rec.amount = htonl (*((u_int32 *) (rec + fo.dOctets)));
          fwrite (&b_rec, sizeof (bitel), 1, out);
        }
      ftio_close (&ftio);
      fclose (fp);
    }
  fclose (out);
  fprintf (stderr, "Total lines: %d\n", str_count);
  return 0;
}

#!/bin/bash
 
export JAVA_HOME=/etc/java-config-2/current-system-vm
indir=/mnt/flow_export
outdir=/mnt/flow_export_converted
convprog=f2b
load_prog=/usr/local/BGIPNNetflowCollector/netflow.sh
flowload=/var/log/flowload.log
 
umask 027
 
hours_ago=$1
[[ -z "${hours_ago}" ]] && hours_ago=1
year=`date --date="${hours_ago} hour ago" +"%Y"`
month=`date --date="${hours_ago} hour ago" +"%m"`
day=`date --date="${hours_ago} hour ago" +"%d"`
hour=`date --date="${hours_ago} hour ago" +"%H"`
 
echo `date` >>$flowload
 
for nas in nas1 nas2 nas3 nas4 nas5
do
 
case "$nas" in
	nas1)       nas_num=5;;
	nas2)       nas_num=6;;
	nas3)       nas_num=7;;
	nas4)       nas_num=8;;
	nas5)       nas_num=9;;
	*)	    echo "unknown nas $nas"
		    exit 1;;
esac
 
if [ ! -d "$indir/$nas/$year-$month-$day" ]
then
    echo "Data dir $indir/$nas/$year-$month-$day not found"
    exit 1
fi
 
echo ==== $nas start >>$flowload
mkdir -p $outdir/source_$nas_num/$year/$month/$day
sleep 2
echo . $nas/$year-$month-$day >>$flowload
 
$convprog $outdir/source_$nas_num/$year/$month/$day/log_$hour $indir/$nas/$year-$month-$day/ft-v05.????-??-??.$hour* >>$flowload 2>&1
 
echo == add $nas $year-$month-$day-$hour >>$flowload
$load_prog isload $nas_num $year-$month-$day-$hour >>$flowload
 
echo ==== $nas stop >>$flowload
 
done
 
exit 0