Add new file triggertrace
This commit is contained in:
parent
3679058e7d
commit
37c447a584
1 changed files with 147 additions and 0 deletions
147
triggertrace
Normal file
147
triggertrace
Normal file
|
@ -0,0 +1,147 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
##################################
|
||||||
|
# Constants / global variables
|
||||||
|
##################################
|
||||||
|
SCRIPTNAME=`basename "$0"`
|
||||||
|
VERSION="0.0.1"
|
||||||
|
LOGLEVEL=INFO
|
||||||
|
LOGFILE=/var/log/triggertrace.log
|
||||||
|
INTERFACE=eth0 # interface to monitor
|
||||||
|
CAPDEST=/tmp/ # capture destination path
|
||||||
|
THRESHOLD=4000 # threshold in packets per second (pps)
|
||||||
|
SLEEPTIME=30 # sleeptime in seconds
|
||||||
|
HELP_TEXT="
|
||||||
|
$SCRIPTNAME v$VERSION
|
||||||
|
|
||||||
|
This is triggertrace, it will create tcpdump tracefiles
|
||||||
|
when a threshold of pps has been triggered
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
$SCRIPTNAME -l <logfile> -L <loglevel> <command>
|
||||||
|
|
||||||
|
Options:
|
||||||
|
-h|--help Display this help
|
||||||
|
-l|--logfile Specify logfile with path (Default: /var/log/triggertrace.log)
|
||||||
|
-L|--loglevel Logging level needs to be DEBUG, INFO, WARN or ERROR. (Default: INFO)
|
||||||
|
|
||||||
|
Command:
|
||||||
|
start start triggertrace (Required)
|
||||||
|
|
||||||
|
Examples:
|
||||||
|
$SCRIPTNAME start
|
||||||
|
$SCRIPTNAME -l mylogfile.log -L INFO start
|
||||||
|
|
||||||
|
|
||||||
|
"
|
||||||
|
|
||||||
|
##################################
|
||||||
|
# Functions
|
||||||
|
##################################
|
||||||
|
|
||||||
|
# Logging functions
|
||||||
|
log_output () {
|
||||||
|
echo `date "+%Y/%m/%d %H:%M:%S"`" $1"
|
||||||
|
echo `date "+%Y/%m/%d %H:%M:%S"`" $1" >> $LOGFILE
|
||||||
|
}
|
||||||
|
|
||||||
|
log_debug () {
|
||||||
|
if [[ "$LOGLEVEL" =~ ^(DEBUG)$ ]]; then
|
||||||
|
log_output "DEBUG $1"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
log_info () {
|
||||||
|
if [[ "$LOGLEVEL" =~ ^(DEBUG|INFO)$ ]]; then
|
||||||
|
log_output "INFO $1"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
log_warn () {
|
||||||
|
if [[ "$LOGLEVEL" =~ ^(DEBUG|INFO|WARN)$ ]]; then
|
||||||
|
log_output "WARN $1"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
log_error () {
|
||||||
|
if [[ "$LOGLEVEL" =~ ^(DEBUG|INFO|WARN|ERROR)$ ]]; then
|
||||||
|
log_output "ERROR $1"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Help output
|
||||||
|
usage () {
|
||||||
|
echo "$HELP_TEXT"
|
||||||
|
}
|
||||||
|
|
||||||
|
main () {
|
||||||
|
log_output "starting $0"
|
||||||
|
|
||||||
|
while /bin/true; do
|
||||||
|
pktbefore=`grep $INTERFACE: /proc/net/dev | cut -d : -f2 | awk '{ print $2 }'`
|
||||||
|
sleep 1
|
||||||
|
pktafter=`grep $INTERFACE: /proc/net/dev | cut -d : -f2 | awk '{ print $2 }'`
|
||||||
|
|
||||||
|
pkts=$(( $pktafter - $pktbefore ))
|
||||||
|
log_output "`date` $pkts packets/s"
|
||||||
|
|
||||||
|
if [ $pkts -gt $THRESHOLD ]; then
|
||||||
|
log_output "`date` threshold over $THRESHOLD pps, capturing 2000 packets."
|
||||||
|
tcpdump -n -s0 -c 2000 -w $CAPDEST/trace-"$(date +"%Y_%m_%d_%H_%M")".cap
|
||||||
|
log_output "`date` Packets captured, sleeping $SLEEPTIME seconds..."
|
||||||
|
sleep $SLEEPTIME
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
#################################
|
||||||
|
# Main
|
||||||
|
#################################
|
||||||
|
|
||||||
|
# Check if a param is set to a valid value
|
||||||
|
if [[ ! "$LOGLEVEL" =~ ^(DEBUG|INFO|WARN|ERROR)$ ]]; then
|
||||||
|
log_error "Logging level needs to be DEBUG, INFO, WARN or ERROR."
|
||||||
|
usage
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# display usage when no parameter specified
|
||||||
|
if [[ ! "$1" ]]; then
|
||||||
|
usage
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Get input parameters
|
||||||
|
while [[ "$1" != "" ]]; do
|
||||||
|
case "$1" in
|
||||||
|
-l | --logfile )
|
||||||
|
shift
|
||||||
|
LOGFILE=$1
|
||||||
|
;;
|
||||||
|
-L | --loglevel )
|
||||||
|
shift
|
||||||
|
LOGLEVEL=$1
|
||||||
|
;;
|
||||||
|
-h | --help )
|
||||||
|
usage
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
-* )
|
||||||
|
echo -e "Error: Unknown parameter: $1\r" >&2
|
||||||
|
usage
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
start )
|
||||||
|
main "$@"
|
||||||
|
;;
|
||||||
|
* )
|
||||||
|
echo -e "Error: Unknown command: $1\r" >&2
|
||||||
|
usage
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
shift
|
||||||
|
done
|
||||||
|
|
||||||
|
# logic starts here
|
||||||
|
main "$@"
|
Loading…
Add table
Add a link
Reference in a new issue