2017-02-27 20 views
0

我用这个命令转换多个PCAP日志文件使用tcpdump的文本:使用循环将多个文件转换成不同的文件

$ cat /home/dalya/snort-2.9.9.0/snort_logs/snort.log.* | tcpdump -n -r - > /home/dalya/snort-2.9.9.0/snort_logs2/bigfile.txt 

,效果不错。

现在我想输出分开,每个使用循环这样转换的文件在一个单独的输出文件:

for f in /home/dalya/snort-2.9.9.0/snort_logs/snort.log.* ; do 
tcpdump -n -r "$f" > /home/dalya/snort-2.9.9.0/snort_logs2/"$f.txt" ; 
done 

但它给了我:

bash: /home/dalya/snort-2.9.9.0/snort_logs2//home/dalya/snort-2.9.9.0/snort_logs/snort.log.1485894664.txt: No such file or directory 
bash: /home/dalya/snort-2.9.9.0/snort_logs2//home/dalya/snort-2.9.9.0/snort_logs/snort.log.1485894770.txt: No such file or directory 
bash: /home/dalya/snort-2.9.9.0/snort_logs2//home/dalya/snort-2.9.9.0/snort_logs/snort.log.1487346947.txt: No such file or directory 

我想在$问题f,我哪里错了?

回答

1

如果运行

for f in /home/dalya/snort-2.9.9.0/snort_logs/snort.log.* ; do 
    echo $f 
done 

你会发现,你得到

/home/dalya/snort-2.9.9.0/snort_logs/snort.log.1485894664 
/home/dalya/snort-2.9.9.0/snort_logs/snort.log.1485894770 
/home/dalya/snort-2.9.9.0/snort_logs/snort.log.1487346947 

您可以使用basename

为了只获取文件名,这样的事情:

for f in /home/dalya/snort-2.9.9.0/snort_logs/snort.log.* ; do 
    base="$(basename $f)" 
    echo $base 
done 

一旦您对此表示满意,请删除回声声明并使用

tcpdump -n -r "$f" > /home/dalya/snort-2.9.9.0/snort_logs2/"$base.txt" 

代替。编号:tcpdump -n -r "$base" > ...应该是tcpdump -n -r "$f" > ...;您只想在创建新文件名的上下文中使用$base,而不是在读取现有数据的上下文中。

+0

我照你说的做了,它的工作,直到最后一个,当我用这个:#for f in /home/dalya/snort-2.9.9.0/snort_logs/snort.log.*;做 base =“$(basename $ f)” tcpdump -n -r“$ base”> /home/dalya/snort-2.9.9.0/snort_logs2/"$base.txt“ done。 它给了我这样的: tcpdump的:snort.log.1485894664:没有这样的文件或目录 tcpdump的:snort.log.1485894770:没有这样的文件或目录 tcpdump的:snort.log.1487346947:没有这样的文件或目录 的tcpdump :截断的转储文件;试图读取4个文件头字节,只有0 – Dalya

相关问题