0

I am using nfcapd to capture Netflow export packets. It has a -x option to call another program when a new flow output file is available. I want to call nfdump whenever a new file becomes available, so I run nfcapd like this:

#!/bin/bash
t="nfcapd -p 5566 -l /root/nfcapd_log/ -t 5 -x \"nfdump -r %d%f \""
echo $t
eval $t

which calls nfdump fine as I see its output on the screen.

I pass the path to the new file from nfcapd to the -r option in nfdump.

My problem is that I need pass fmt: %ts %te %td %pr %sa %da %sp %dp %ra %in %out %pkt %ipkt %opkt %ibyt %obyt %fl %dir %ismc %odmc %idmc %osmc as an argument to nfdump which is a string to tell it what type of flow information I want, so it needs to be in quotes. I have experimented with escaping the quotes but I am getting nowhere. This is my script so far:

#!/bin/bash
t1="nfcapd -p 5566 -l /root/nfcapd_log/ -t 5 -x  \"nfdump -r %d%f -o \\\"fmt: %ts %te %td %pr %sa %da %sp %dp %ra %in %out %pkt %ipkt %opkt %ibyt %obyt %fl %dir %ismc %odmc %idmc %osmc\\\" \" "
echo $t1
eval $t1

But nfdump doesn't like the format as the help information is printed.

I am fairly new to bash so there might be a really simple solution. Any help would be much appreciated.

Thanks.

1

1 Answer 1

1

First of all, you can get rid of one level of quotes by using a helper function (called output_and_exec() in the following example) which outputs and executes what is passed to it. Then, use single quotes when passing the command to nfcapd. These single quotes can include any character except single quotes, so just use double quotes for the argument to nfdump.

output_and_exec() { echo "$@" ; "$@" ; }
output_and_exec nfcapd -p 5566 -l /root/nfcapd_log/ -t 5 -x  'nfdump -r %d%f -o "fmt: %ts %te %td %pr %sa %da %sp %dp %ra %in %out %pkt %ipkt %opkt %ibyt %obyt %fl %dir %ismc %odmc %idmc %osmc"' 

Disclaimer: I haven't tested this since I don't have to the nfapd/nfdump programs.

Sign up to request clarification or add additional context in comments.

1 Comment

Thanks for answering, but it didn't work. It ran nfcapd, but the help text was still shown for nfdump.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.