You may have reviewed my blog post about Isolation of Intermittent Network Issue. That blog makes you aware, that ESXI comes with a neat utility that can help you capture network traffic at various points within the host.
Like most troubleshooting tools, pktcap-uw needs a user to be in front of the system to start the data collection. This is not only operational but also a human challenge for environments running at scale.
The code below is a sample script that you can customize to collect this data in 15-minute batches.
Code:
#!/bin/sh
capture()
{
fileid=$1
pktcap-uw --uplink vmnic4 -o /vmfs/volumes/local-ds-86/vmnic4-inbound-file$fileid.pcap >/dev/null &
pktcap-uw --uplink vmnic4 --dir 1 -o /vmfs/volumes/local-ds-86/vmnic4-outbound-file$fileid.pcap >/dev/null &
pktcap-uw --uplink vmnic5 -o /vmfs/volumes/local-ds-86/vmnic5-inbound-file$fileid.pcap >/dev/null &
pktcap-uw --uplink vmnic5 --dir 1 -o /vmfs/volumes/local-ds-86/vmnic5-outbound-file$fileid.pcap >/dev/null &
}
#Change the number of iterations to reduce the total time of capture
for i in 0 1 2 3 4 5 6 7 8 9;
do
#Kill any existing session. This to make sure that the script can handle a previous dirty exit. For example a script exit using ctrl+c
kill -9 $(lsof | grep -i pktcap | grep vmfs | awk '{print $1}');
#Start captures
capture $i >/dev/null &
#Change the sleep time to reduce the time of capture per batch
sleep 900;
#Kill captures
kill -9 $(lsof | grep -i pktcap | grep vmfs | awk '{print $1}');
done
Leave a Reply