tcpdump icon indicating copy to clipboard operation
tcpdump copied to clipboard

postrotate-command not run when tcpdump terminated

Open cygnus2048 opened this issue 2 years ago • 1 comments

tcpdump version 4.9.3

Trying to use postrotate-command to compress the files and does work when the files are rotated, however, when terminating (tried SIGINT, SIGHUP, and SIGTERM) the postrotate-command is not run on the last file.

This leads to a mixture of compressed and uncompressed files.

Worse is when the postrotate-command is doing additional processing of the file, all data since the last rotate is lost.

I believe when terminating and a postrotate-command is specified it should also be run on the active file as well.

cygnus2048 avatar Oct 25 '22 21:10 cygnus2048

I would also like the ability to ask tcpdump to terminate, but to execute the postrotate-command for the last data capture file. In my case the postrotate-command is actually a script, compression is not involved. Currently, I only terminate two always running tcpdump commands about 1 a month, and then I manually run the post processing script on the last data file and start things again in a new directory. However, I want to change to a new directory every day, without needing any manual intervention.

DougSmythies avatar Apr 10 '23 20:04 DougSmythies