I'm struggling to see where I am going wrong on trying to run a shell script with the -z flag for tcpdump. There does not seem to be a lot of/any examples of this flag being used. In the man page they highlight using gzip as a command and this works fine for me. Here is the man page for -z of tcpdump:
-z postrotate-command Used in conjunction with the -C or -G options, this will make tcpdump run " postrotate-command file " where file is the savefile being closed after each rotation. For example, specifying -z gzip or -z bzip2 will compress each savefile using gzip or bzip2. Note that tcpdump will run the command in parallel to the capture, using the lowest priority so that this doesn't disturb the capture process. And in case you would like to use a command that itself takes flags or different arguments, you can always write a shell script that will take the savefile name as the only argument, make the flags & arguments arrangements and execute the command that you want.
My shell script for now is very basic...just cause I'm trying to root out where I am going wrong:
test.sh - this file is 777 to make sure it's not a permissions issue
#!/bin/sh cp $1 $1.BAK
tcpdump port 53 -i any -U -G 60 -z test.sh -Z root -w tcpdump_files/tcpdump_%M.pcap ... compresss_savefile: execlp(test.sh, tcpdump_files/tcpdump_02.pcap) failed: No such file or directory.
Seems like I need to tell tcpdump to execute this file so:
tcpdump port 53 -i any -U -G 60 -z ./test.sh -Z root -w tcpdump_files/tcpdump_%M.pcap ... compresss_savefile: execlp(./test.sh, tcpdump_files/tcpdump_02.pcap) failed: Permission denied.
Maybe fully qualifying the script? Nope..
tcpdump port 53 -i any -U -G 60 -z /home/me/test.sh -Z root -w tcpdump_files/tcpdump_%M.pcap ... compresss_savefile: execlp(/home/me/test.sh, tcpdump_files/tcpdump_02.pcap) failed: Permission denied.
I most likely am misunderstanding how the argument works for the -z flag and the execlp it is running in the background. I've also for the heck of it tried doing
-z '/bin/sh, test.sh' But this gave the no such file or dir error.