pcap stream rotation and pruning

Posted by pilcrow on Server Fault See other posts from Server Fault or by pilcrow
Published on 2010-03-15T15:44:02Z Indexed on 2010/03/15 15:50 UTC
Read the original article Hit count: 580

Filed under:
|
|
|

Some of my servers collect a lot of packet data. Is there a utility (or patch to tcpdump(1)) to log a pcap stream to disk which:

  1. Rotates based on size of data written
  2. Prunes written files, keeping only the N most recent
  3. Does not re-use output filenames
  4. Is self-contained
    (Ruling out, e.g., a rotation with external pruning via crond(8)+tmpwatch(8))

Basically I want a multilog or svlogd that groks the pcap record format.

The -W filecount option of tcpdump-4.0.0 "prunes" by recycling old filenames, which violates #3 above, forcing me to consult mtimes to determine recency and providing no guarantees against surprise truncation of the log file.

The -G option introduces strftime(2)-specifier support in output filenames, which would give me at least second-precision in file names, but I can't figure out how to get pruning to work with this scheme.

© Server Fault or respective owner

Related posts about logs

Related posts about rotation