--- name: "radium" section: "8" platform: "linux" package: "argus-client" version: "1:5.0.2+git20250321.41f65e2-2" release: "Debian 13 (Trixie)" platforms: ["linux"] url: "https://new.carta.tech/radium" --- # radium(8) argus record multiplexor ## NAME radium - argus record multiplexor ## SYNOPSIS **radium** \[ **options** \] \[ **raoptions** \] ## DESCRIPTION **Radium** is a real-time Argus Record multiplexor that processes Argus records and Netflow records and outputs them to any number of client programs and files. **Radium** is a combination of the features of ra.1 and argus.8, supporting access for upto 128 client programs to argus records originating from remote data sources and/or local managed argus data files. Using **radium** you can construct complex distribution networks for collecting and processing argus data, and providing a single point of access to archived argus data. Designed to run as a daemon, **radium** generally reads argus records directly from a remote argus, and writes the transaction status information to a log file or open socket connected to an **argus** client (such as **[ra(1)](/ra/1.md)**). **Radium** provides the same data access controls as argus.8, including remote filtering, source address based access control, indivual oriented strong authentication and confidentiality protection for the distributed data, using **SASL** and **tcp\_wrapper** technology. Please refer to the INSTALL and README files for each distribution for a complete description. **Radium** is normally configured from a system **/etc/radium.conf** configuration file, or from a configuration file either in the **$RADIUMHOME** directory, or specified on the command line. ## RADIUM SPECIFIC OPTIONS Radium, like all ra based clients, supports a number of **ra options** including remote data access, reading from multiple files and filtering of input argus records through a terminating filter expression. **[radium(8)](/radium/8.md)** specific options are: ## OPTIONS - **-B \** Specify the bind interface address for remote access. Acceptable values are IP version 4 addresses. The default is to bind to INADDR\_ANY address. - **-d** Run radium as a daemon. This will cause radium to do the things that Unix daemons do and return, if there were no errors, with radium running as a detached process. - **-e \** Specify the source identifier for this **radium**. Acceptable values are numbers, hostnames or ip address. - **-f \** Use *radium.conf* as a source of configuration information. Options set in this file override any other specification, and so this is the last word on option values. This file is read after the system /etc/radium.conf file is processed. See *radium.conf.5* for the configuration file format. - **-O** Turn off Berkeley Packet Filter optimizer. No reason to do this unless you think the optimizer generates bad code. - **-p** Override the persistent connection facility. **Radium** provides a fault tolerant feature for its remote argus data access facility. If the remote argus data source closes, **radium** will maintain its client connections, and attempt to reestablish its connection with remote source. This option overrides this behavior, causing **radium** to terminate if any of its remote sources closes. - **-P \** Specifies the **\** for remote client connection. The default is to not support remote access. Setting the value to zero (0) will forceably turn off the facility. - **-S** \ Attach to a specific remote *host* to receive argus records. Append an optional port specifier to attach to a port value other than the default 561. Without the optional full pathname, **radium** will continuously transmit a stream of real-time flow records as they are received. With the optional filename, **radium** will open the argus datafile specified, and stream the contents, closing the connection with the file EOF. - **-T threshold\[smh\] (secs)** Indicate that *radium* should correct the timestamps of received *argus* records, if they are out of sync by threshold secconds. Threshold can be specified with the extensions s, m, or h for seconds, minutes or hours. **-X** Clear existing radium configuration. This removes any initialization done prior to encountering this flag. Allows you to eliminate the effects of the */etc/radium.conf* file, or any radium.conf files that may have been loaded. ## SIGNALS **Radium** catches a number of **[signal(3)](/signal/3.md)** events. The three signals **SIGHUP**, **SIGINT**, and **SIGTERM** cause **radium** to exit, writing TIMEDOUT status records for all currently active transactions. The signal **SIGUSR1** will turn on **debug** reporting, and subsequent **SIGUSR1** signals, will increment the **debug-level**. The signal **SIGUSR2** will cause **radium** to turn off all **debug** reporting. ## ENVIRONMENT ``` $RADIUMHOME - Radium Root directory $RADIUMPATH - Radium.conf search path (/etc:$RADIUMHOME:$HOME) ``` ## FILES ``` /etc/radium.conf - radium daemon configuration file /var/run/radium.#.#.pid - PID file ``` ## EXAMPLES Run **radium** as a daemon, reading records from a remote host, using port 561, and writing all its transaction status reports to *output-file*. This is a typical mode. ``` radium -S remotehost:561 -d -e `hostname` -w output-file ``` **Collect records from multiple argi, using port 561 on one and port** **430 on the other, and make all of these records available to other** **programs on port 562.** ``` radium -S host1:561 -S host2:430 -de `hostname` -P 562 ``` **Collect records from multiple Cisco Netflow sources, using** **the default port, and make the resulting argus records available** **on port 562.** ``` radium -C -S host1 -S host2 -de `hostname` -P 562 ``` **Radium supports both input filtering and output filtering,** **and radium supports multiple output streams, each with their** **own independant filters.** **If you are interested in distributing IP traffic only (input** **filter) and want to separate traffic into differing files** **based on traffic type, this simple example separates ICMP** **traffic from other traffic.** ``` radium -w file1 "icmp" -w file2 "not icmp" - ip ``` **Audit the network activity that is flowing between the two** **gateway routers, whose ethernet addresses are 00:08:03:2D:42:01 and** **00:00:0C:18:29:F1. Make records available to other programs through** **port 430/tcp.** ``` radium -S source -P 430 - ether host (0:8:3:2d:42:1 and 0:0:c:18:29:f1) & ``` **Process argus records from a remote source only between 9am and 5pm every day** **and provide access to this stream on port 562.** ``` radium -S remotehost -t 9-17 -P 562 ``` ## COPYRIGHT **Copyright (c) 2000-2024 QoSient, LLC All rights reserved.** ## AUTHORS ``` Carter Bullard (carter@qosient.com) ``` ## SEE ALSO [**radium.conf**(5)](/radium.conf/5.md), [**argus**(8)](/argus/8.md), [**hosts\_access**(5)](/hosts_access/5.md), [**hosts\_options**(5)](/hosts_options/5.md), [**tcpd**(8)](/tcpd/8.md), [**tcpdump**(1)](/tcpdump/1.md)