LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Blogs > konsolebox
User Name
Password

Notices

Rate this Entry

Example script to run and manage a service (tcpdump) with managed logging.

Posted 10-11-2012 at 07:59 PM by konsolebox
Updated 10-12-2012 at 02:20 AM by konsolebox

I made this script as a reply to a question on a thread before. The accidentally simplified complexity of it amazes me so I thought that it would be nice to post this on a blog as well. Original thread: https://www.linuxquestions.org/quest...cpdump-800385/

The script runs and manages a service (tcpdump). It could also automatically delete files older than C days, and reduce the size of a logfile if it's already larger than N bytes.
Code:
#!/bin/bash

shopt -s extglob

# variables

CURRENTDATE=''
DDBLOCKSIZE=512
LOGDIR='/var/log/tcpdump'
MAINLOGFILE='main.log'
MAINLOGFILEMAXSIZE=20000000  ## in bytes
OLD=14
QUIT=false
TCPDUMP='/usr/sbin/tcpdump'
TCPDUMPCAPTUREFILEPREFIX='capture-'
TCPDUMPCAPTUREFILESUFFIX=''
TCPDUMPPID=0
TEMPDIR='/var/tmp'

# functions

function log {
	echo "[$(date '+%F %T')] $1" >> "$MAINLOGFILE"
	echo "$1"
}

function checktcpdump {
	[[ $TCPDUMPPID -ne 0 ]] && [[ -e /proc/$TCPDUMPPID ]] && kill -s 0 "$TCPDUMPPID" 2>/dev/null
}

function starttcpdump {
	log "Starting tcpdump..."

	CURRENTDATE=$(date +%F)

	"$TCPDUMP" -w "$LOGDIR/${TCPDUMPCAPTUREFILEPREFIX}${CURRENTDATE}${TCPDUMPCAPTUREFILESUFFIX}.log" &

	if [[ $? -ne 0 ]]; then
		TCPDUMPPID=0
		return 1
	fi

	TCPDUMPPID=$!

	disown "$TCPDUMPPID"

	checktcpdump
}

function starttcpdumploop {
	until starttcpdump; do
		log "Error: Failed to start tcpdump.  Waiting for 20 seconds before next attempt..."
		read -t 20 && QUIT=true
	done
}

function stoptcpdump {
	log "Stopping tcpdump..."
	kill "$TCPDUMPPID"
	checktcpdump && kill -s 9 "$TCPDUMPPID"
	TCPDUMPPID=0
	QUIT=true
}

function restarttcpdump {
	log "Restarting tcpdump..."
	checktcpdump && stoptcpdump
	starttcpdumploop
}

function catchsignals {
	log "Caught a signal..."
	QUIT=true
}

function main {
	local CAPTUREFILEPATTERN FILE MAINLOGFILEMAXBLOCKSIZE NEWDATE SIZE TEMPFILE

	CAPTUREFILEPATTERN="${TCPDUMPCAPTUREFILEPREFIX}[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]${TCPDUMPCAPTUREFILESUFFIX}.log"
	[[ $MAINLOGFILE != */* ]] && MAINLOGFILE=$LOGDIR/$MAINLOGFILE
	(( MAINLOGFILEMAXBLOCKSIZE = (MAINLOGFILEMAXSIZE / DDBLOCKSIZE) + ((MAINLOGFILEMAXSIZE % DDBLOCKSIZE) ? 0 : 1) ))

	log "Starting tcpdump manager script..."

	trap catchsignals SIGQUIT SIGINT SIGKILL SIGTERM

	mkdir -p "$LOGDIR"

	starttcpdumploop

	for (( I = 1;; I = (I + 1) % 20 )); do
		read -t 1 && break  ## we have to separate this from the next statement to ensure proper handling of signals

		[[ $QUIT = true ]] && break

		if [[ I -eq 0 ]]; then
			NEWDATE=$(date +%F)

			if [[ ! $NEWDATE = "$CURRENTDATE" ]]; then
				log "A new day has come."

				if read FILE; then
					log "Deleting $OLD-days old files..."

					while
						log "Deleting $FILE..."

						rm -f "$FILE"

						read FILE
					do
						continue
					done
				fi < <(exec find "$LOGDIR" -name "$CAPTUREFILEPATTERN" -daystart -ctime "+$OLD")   # or -mtime?

				restarttcpdump
			fi
		elif [[ I -eq 1 ]]; then
			SIZE=$(stat --printf=%s "$MAINLOGFILE")

			if [[ $SIZE == +([[:digit:]]) && $(( SIZE / DDBLOCKSIZE )) -gt MAINLOGFILEMAXBLOCKSIZE ]]; then
				echo "Reducing log data in $MAINLOGFILE..."

				TEMPFILE=$TEMPDIR/tcpdump-$RANDOM.tmp

				dd "bs=$DDBLOCKSIZE" "count=$MAINLOGFILEMAXBLOCKSIZE" "if=$MAINLOGFILE" "of=$TEMPFILE"

				cat "$TEMPFILE" > "$MAINLOGFILE"; rm -f "$TEMPFILE"  ## better than mv
			fi
		fi
	done

	checktcpdump && stoptcpdump

	log "Ending tcpdump manager script."
}

# start

main
* Please check thread for new updates on the script.
Posted in Howtos
Views 941 Comments 0
« Prev     Main     Next »
Total Comments 0

Comments

 

  



All times are GMT -5. The time now is 08:27 AM.

Main Menu

My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration