source: tools/tracesplit/tracesplit.1 @ 361d283

4.0.1-hotfixescachetimestampsdevelopdpdk-ndagetsilivegetfragoffhelplibtrace4ndag_formatpfringrc-4.0.1rc-4.0.2rc-4.0.3rc-4.0.4ringdecrementfixringperformanceringtimestampfixes
Last change on this file since 361d283 was ae76c14, checked in by Shane Alcock <salcock@…>, 11 years ago
  • Updated tracesplit manpage to reflect new abilities
  • Property mode set to 100644
File size: 2.4 KB
RevLine 
[ae76c14]1.TH TRACESPLIT "1" "January 2011" "tracesplit (libtrace)" "User Commands"
[5d022cd]2.SH NAME
3tracesplit \- split traces
4.SH SYNOPSIS
[1369834]5.B tracesplit
[634089d]6[ \fB-f \fRbpf | \fB--filter=\fRbpf]
7[ \fB-c \fRcount | \fB--count=\fRcount]
8[ \fB-b \fRbytes | \fB--bytes=\fRbytes]
9[ \fB-i \fRseconds | \fB--seconds=\fRseconds]
10[ \fB-s \fRunixtime | \fB--starttime=\fRunixtime]
11[ \fB-e \fRunixtime | \fB--endtime=\fRunixtime]
12[ \fB-m \fRmaxfiles | \fB--maxfiles=\fRmaxfiles]
[0a65ed8]13[ \fB-S \fRsnaplen | \fB--snaplen=\fRsnaplen]
[ba91618]14[ \fB-z \fRlevel | \fB--compress-level=\fRlevel]
[bfe8535]15[ \fB-Z \fRmethod | \fB--compress-type=\fRmethod]
[ae76c14]16inputuri [inputuri ...] outputuri
[1369834]17.SH DESCRIPTION
[ae76c14]18tracesplit splits the given input traces into multiple tracefiles
[5d022cd]19.TP
20\fB\-f\fR bpf filter
21output only packets that match tcpdump style bpf filter
22
23.TP
24\fB\-c\fR count
[e86124e]25output count packets per output file.  The output file will be named after
26the basename given in the outputuri with the packet number of the first packet
27in this file.
[5d022cd]28
29.TP
30\fB\-b\fR bytes
31output bytes bytes per file
32
33.TP
34\fB\-i\fR seconds
35start a new tracefile after "seconds" seconds
36
37.TP
38\fB\-s\fR unixtime
39don't output any packets before unixtime
40
41.TP
42\fB\-e\fR unixtime
43don't output any packets after unixtime
44
[634089d]45.TP
46\fB\-m\fR maxfiles
47do not create more than "maxfiles" trace files
48
[0a65ed8]49.TP
50\fB\-S\fR snaplen
[0bfd4a0]51Truncate packets to "snaplen" bytes long.  The default is collect the entire
52packet.
[0a65ed8]53
[bfe8535]54.TP
55\fB\-z\fR level
56Compress the data using the specified compression level, ranging from 0 to 9.
57Higher compression levels tend to result in better compression but require
58more processing power to compress.
59
60.TP
61\fB-Z\fR compression-method
62Compress the data using the specified compression algorithm. Accepted methods
63are "gzip", "bzip2", "lzo" or "none". Default value is none unless a
64compression level is specified, in which case gzip will be used.
65
[5d022cd]66.SH EXAMPLES
67create a 1MB erf trace of port 80 traffic.
68.nf
[bfe8535]69tracesplit \-z 1 -Z gzip \-f 'port 80' \-b $[ 1024 * 1024 ]
70erf:/traces/bigtrace.gz erf:/traces/port80.gz
[5d022cd]71.fi
72
[634089d]73.SH LINKS
74More details about tracesplit (and libtrace) can be found at
75http://www.wand.net.nz/trac/libtrace/wiki/UserDocumentation
76
[5d022cd]77.SH SEE ALSO
[67825b2]78libtrace(3), tracemerge(1), tracefilter(1), traceconvert(1), tracesplit_dir(1),
[1481ba7]79tracereport(1), tracertstats(1), tracestats(1), tracepktdump(1), traceanon(1),
80tracesummary(1), tracereplay(1), tracediff(1)
[67825b2]81
[5d022cd]82.SH AUTHORS
83Perry Lorier <perry@cs.waikato.ac.nz>
Note: See TracBrowser for help on using the repository browser.