source: tools/tracesplit/tracesplit.1 @ 19f1efd

cachetimestampsdeveloprc-4.0.4ringdecrementfixringperformance
Last change on this file since 19f1efd was 19f1efd, checked in by GitHub <noreply@…>, 2 years ago

adjust compression level manpage to actual options in code

  • Property mode set to 100644
File size: 2.7 KB
Line 
1.TH TRACESPLIT "1" "January 2011" "tracesplit (libtrace)" "User Commands"
2.SH NAME
3tracesplit \- split traces
4.SH SYNOPSIS
5.B tracesplit
6[ \fB-f \fRbpf | \fB--filter=\fRbpf]
7[ \fB-j \fRnumhdrs | \fB--jump=\fRnumhdrs]
8[ \fB-c \fRcount | \fB--count=\fRcount]
9[ \fB-b \fRbytes | \fB--bytes=\fRbytes]
10[ \fB-i \fRseconds | \fB--seconds=\fRseconds]
11[ \fB-s \fRunixtime | \fB--starttime=\fRunixtime]
12[ \fB-e \fRunixtime | \fB--endtime=\fRunixtime]
13[ \fB-m \fRmaxfiles | \fB--maxfiles=\fRmaxfiles]
14[ \fB-S \fRsnaplen | \fB--snaplen=\fRsnaplen]
15[ \fB-z \fRlevel | \fB--compress-level=\fRlevel]
16[ \fB-Z \fRmethod | \fB--compress-type=\fRmethod]
17inputuri [inputuri ...] outputuri
18.SH DESCRIPTION
19tracesplit splits the given input traces into multiple tracefiles
20.TP
21\fB\-f\fR bpf filter
22output only packets that match tcpdump style bpf filter
23
24.TP
25\fB\-j\fR numhdrs
26Strip headers before the numhdrs layer 3 header.  For example, \-j1 will strip
27off all the layer 2 headers, \-j2 will strip off all the l2 headers, the first
28l3 header, any transport headers, and return a trace that starts at the next
29l3 header.
30
31.TP
32\fB\-c\fR count
33output count packets per output file.  The output file will be named after
34the basename given in the outputuri with the packet number of the first packet
35in this file.
36
37.TP
38\fB\-b\fR bytes
39output bytes bytes per file
40
41.TP
42\fB\-i\fR seconds
43start a new tracefile after "seconds" seconds
44
45.TP
46\fB\-s\fR unixtime
47don't output any packets before unixtime
48
49.TP
50\fB\-e\fR unixtime
51don't output any packets after unixtime
52
53.TP
54\fB\-m\fR maxfiles
55do not create more than "maxfiles" trace files
56
57.TP
58\fB\-S\fR snaplen
59Truncate packets to "snaplen" bytes long.  The default is collect the entire
60packet.
61
62.TP
63\fB\-z\fR level
64Compress the data using the specified compression level, ranging from 0 to 9.
65Higher compression levels tend to result in better compression but require
66more processing power to compress.
67
68.TP
69\fB-Z\fR compression-method
70Compress the data using the specified compression algorithm. Accepted methods
71are "gz", "bz", "lzo", "xz" or "no". Default value is none unless a
72compression level is specified, in which case gzip will be used.
73
74.SH EXAMPLES
75create a 1MB erf trace of port 80 traffic.
76.nf
77tracesplit \-z 1 -Z gzip \-f 'port 80' \-b $[ 1024 * 1024 ]
78erf:/traces/bigtrace.gz erf:/traces/port80.gz
79.fi
80
81.SH LINKS
82More details about tracesplit (and libtrace) can be found at
83http://www.wand.net.nz/trac/libtrace/wiki/UserDocumentation
84
85.SH SEE ALSO
86libtrace(3), tracemerge(1), tracefilter(1), traceconvert(1), tracesplit_dir(1),
87tracereport(1), tracertstats(1), tracestats(1), tracepktdump(1), traceanon(1),
88tracesummary(1), tracereplay(1), tracediff(1), traceends(1), tracetopends(1)
89
90.SH AUTHORS
91Perry Lorier <perry@cs.waikato.ac.nz>
Note: See TracBrowser for help on using the repository browser.