Changes between Version 1 and Version 2 of TraceSplit


Ignore:
Timestamp:
02/28/07 10:14:48 (14 years ago)
Author:
spa1
Comment:

--

Legend:

Unmodified
Added
Removed
Modified
  • TraceSplit

    v1 v2  
    22
    33=== Usage ===
    4 {{{tracesplit [ -f exp | --filter=exp ] [ -c num | --count num ] [ -b num | --bytes num ] [ -i secs | --interval secs ] }}}
     4{{{ tracesplit [ -f exp | --filter=exp ] [ -c num | --count=num ] [ -b num | --bytes=num ] [ -i secs | --interval=secs ] }}}
     5{{{     [ -s unixtime | --starttime=unixtime ] [ -e unixtime | --endtime=unixtime ] [ -m files | --maxfiles=files] inputuri outputuri }}}
     6
     7=== Options ===
     8 {{{-f, --filter}}}::
     9   Only output packets that match the bpf filter expression. See tcpdump(1) for the syntax of the bpf filter expression
     10 {{{-c, --count}}}::
     11   Output __count__ packets per output file.
     12 {{{-b, --bytes}}}::
     13   Output __num__ bytes per output file.
     14 {{{-i, --interval}}}::
     15   Start a new file after __secs__ seconds of trace time.
     16 {{{-s, --starttime}}}::
     17   Do not output any packets with a timestamp earlier than __unixtime__
     18 {{{-e, --endtime}}}::
     19   Do not output any packets with a timestamp later than __unixtime__
     20 {{{-m, --maxfiles}}}::
     21   Do not create more than __files__ trace files
     22
     23=== Applications ===
     24==== Create a small 10 minute trace from a larger trace ====
     25{{{
     26tracesplit -i 600 -m 1 erf:longtrace.erf.gz erf:10min_trace.erf.gz
     27}}}
     28
     29==== Capture a trace to disk with a one hour file rotation ====
     30{{{
     31tracesplit -i 3600 int:eth0 erf:trace.erf.gz
     32}}}
     33
     34=== Notes ===
     35 * As {{{tracesplit}}} is capable of producing multiple output files, the output URI is used as the base of the output filename. Appended is the packet number, timestamp or byte number of the first packet in the subtrace, depending on what criteria was used to determine the split. For example:
     36{{{
     37tracesplit -c 100 erf:original.erf.gz erf:split.erf.gz
     38}}}
     39   will produces files called split.erf.gz-1, split.erf.gz-101, split.erf.gz-201, etc.