Im trying to use mergecap to merge 15 old pcap files in a folder. I tried to use

FILES=($(find /mnt/md0/capture/DCN/ -maxdepth 1 -type f -name "*.pcap"  -print0 | xargs -0 ls -lt | tail -15 | awk '{print $8}'))

and use mergecap command as mergecap -w Merge.pcap ${FILES[@]} but the mergecap doesnt run when I put it on crontab. Is there any method to combine these two commands to work properly.

I tried as answer suggested @l0b0 tried find /mnt/md0/capture/DCN/ -maxdepth 1 -type f -name "*.pcap" -print0 | tr '\0\n' '\n\0' | tail -15 | tr '\0\n' '\n\0' | xargs -r0 mergecap -w /mnt/md0/capture/DCN/Merge_"${TAG1}".pcap in order to get the name of the oldest file to be merged into the output files name. But it gives gibberish as the file name. Am I doing anything wrong? Following scripts gets me the file names

FILES=($(find /mnt/md0/capture/DCN/ -maxdepth 1 -type f -name "*.pcap"  -print0 | xargs -0 ls -lt | tail -15 | awk '{print $8}'))

TAG1=$(basename "${FILES[0]}" | sed 's/.pcap//')

With zsh (again):

mergecap -w Merge.pcap /mnt/md0/capture/DCN/(D.om[-15,-1])

Or with GNU tools:

cd /mnt/md0/capture/DCN/ &&
  find . -maxdepth 1 -name '*.pcap' ! -name Merge.pcap -type f  -printf '%T@@%p\0' |
    tr '\0\n' '\n\0' |
    sort -n |
    head -n 15 |
    cut -d@ -f2- |
    tr  '\0\n' '\n\0' |
    xargs -r0 mergecap -w Merge.pcap
  • I am not allowed to install zsh on this system. – Jishnu U Nair Feb 6 '14 at 14:07

You can use a trick to use tail on NUL-delimited output:

find /mnt/md0/capture/DCN/ -maxdepth 1 -type f -name "*.pcap" -print0 |
  tr '\0\n' '\n\0' |
  tail -n 15 |
  tr '\0\n' '\n\0' |
  xargs -r0 mergecap -w Merge.pcap

And you should not parse ls output.

  • That doesn't sort the list my modification time (as the OP's ls -t would imply) before taking the last 15 entries though. – Stéphane Chazelas Feb 6 '14 at 13:34
  • Im trying to merge the last 15 modified files.. – Jishnu U Nair Feb 6 '14 at 14:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.