Network captures in 15-minute batches on an ESXi

Posted by

You may have reviewed my blog post about Isolation of Intermittent Network Issue. That blog makes you aware, that ESXI comes with a neat utility that can help you capture network traffic at various points within the host.

Like most troubleshooting tools, pktcap-uw needs a user to be in front of the system to start the data collection. This is not only operational but also a human challenge for environments running at scale.   

The code below is a sample script that you can customize to collect this data in 15-minute batches. 

Code:

#!/bin/sh
capture() 
{
fileid=$1
pktcap-uw --uplink vmnic4 -o /vmfs/volumes/local-ds-86/vmnic4-inbound-file$fileid.pcap >/dev/null & 
pktcap-uw --uplink vmnic4 --dir 1 -o /vmfs/volumes/local-ds-86/vmnic4-outbound-file0$fileid.pcap >/dev/null & 
pktcap-uw --uplink vmnic5 -o /vmfs/volumes/local-ds-86/vmnic5-inbound-file$fileid.pcap >/dev/null & 
pktcap-uw --uplink vmnic5 --dir 1 -o /vmfs/volumes/local-ds-86/vmnic5-outbound-file$fileid.pcap >/dev/null & 
}
for i in 0 1 2 3 4 5 6 7 8 9; 
do 
kill -9 $(lsof | grep -i pktcap | grep vmfs | awk '{print $1}');
capture $i >/dev/null & 
sleep 900;
kill -9 $(lsof | grep -i pktcap | grep vmfs | awk '{print $1}');
done

3 comments

  1. Hi Akshay, so we need to create a file by name lets say and execute it from anywhere. Post that collect the logs from the location mentioned in your script, correct??

    Also I was wondering is it still not a manual process of executing the script? In other words, an admin has to execute/call the above script at the time of the issue while he has access to his production environment. Am I correct??

    1. Thanks Kamal. Yes, your understanding is correct

      Script is indeed not a fully automated solution. However, it can be made fully automated by using any of the following methods
      1) Cron scheduler job that runs the script every two hours
      2) Calling the script in an infinite while loop as background process
      3) Calling the script in while loop as background process with termination file

      I would recommend using option 1 as that does not involve infinite loops

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.