3

I'm trying to write a script used on a buffer box that does full packet capture of network traffic. As it's for a fairly big network we split the captures into 100MB segments. At times of high network traffic oftentimes over a one minute period we will have multiple pcaps which cover that period.

So what I want to do is have a bash script that lets the analyst who is searching for something specify a date and time and how many minutes either side of it they want to search for files. Obviously I can do something like this -

ls -al | grep "Dec  1" | grep 02:00
ls -al | grep "Dec  1" | grep 02:01

and so on, get each result and grep each file individually for the specific keyword I'm looking for, but I'd like to be able to do a wider search for all files created within a time range and then grep each of them for the keyword.

I'm not entirely sure how to do that, any help would be appreciated.

7
  • The find command is your friend, especially the -ctime, -mtime and/or -newer options. Do a man find for more details.
    – Eric
    Dec 1, 2013 at 2:30
  • Yeah I've looked into using find, but that only works in days. We have 100% capture on the network for 30 days, averaging maybe, I dunno... thousands of 100mb segments per day. Doing searches over days of packets will put unnecessary strain on an already heavily loaded system.
    – Steve
    Dec 1, 2013 at 2:34
  • 1
    Culled from man find: -ctime n[smhdw] s second m minute (60 seconds) h hour (60 minutes) d day (24 hours) w week (7 days) So you can specify units
    – Eric
    Dec 1, 2013 at 2:40
  • I need to look for files in a RANGE of times on a specific date. Say between 11:20pm and 11:30pm on 3rd November.
    – Steve
    Dec 1, 2013 at 2:42
  • 1
    Here is a method using find: aaronbonner.io/post/28969404367/… (just omit the delete portion of course).
    – MaQleod
    Dec 1, 2013 at 8:02

2 Answers 2

1

Some of the fine things find (on GNU/Linux) can do for you:

Units:

  • n exactly n untis
  • -n less than n units
  • +n more than n units -

What happened:

  • -atime: last time accessed
  • -ctime: changes on file itself (permissions, owners, …), not its content
  • -mtime: file's content changed
  • -amin n: n minutes age
  • -atime n: n days (24 hours) ago
  • same goes for ctime/min and mtime/min)

Thus:

  • find -atime -30 → last accessed less than 30 days ago
  • find -ctime +5 → more than 5 days ago, changes on file itself
  • find -mtime +2 -31 → file's content changed more than two days but less than 31 days ago

also - -daystart: after today, 0.00h


Grepping

find stuff -exec grep {} \; →; the last part ({} \;) is essential - mind the single white space between {} and \;

The -exec options allows incorporating other commands into find


Also: Why one shouldn't parse the output of ls

1

find -iname "" -mtime -7 -exec zgrep "" {} \;

For ex-

find /opt/WebSphere/AppServer/profiles/application/logs/ -iname "SystemOut*" -mtime -7 -exec zgrep "FileNotFoundException" {} \;

It will find within directory /opt/WebSphere/AppServer/profiles/application/logs/ for files starting with SystemOut in last 7 days and will look for String FileNotFoundException.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .