Rastream reads argus data from an argus-data source, and splits the resulting output into consecutive sections of records based on size, count time, or flow event, writing the output into a set of output-files. By default, rastream splits the stream by output file record count, putting 10,000 records of input into each argus output file, or standard out, as needed. The behavior is similar to the unix split.1 command.

The output files' name consists of a prefix, which is specified using the -w ra option, and a suffix, which is created for each resulting file. If no prefix is provided, then rastream will use 'x' as the default prefix. The suffix that is used is determined by the mode of operation. When rastream is using the default count mode or the size mode, the suffix is a group of letters 'aa',