DAEMONLOGGER(1)

📦
version 1.2.2 · 2 versions
, in debian trixie, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 DAEMONLOGGER — the manual page, bestie edition 💖

okay so this is daemonlogger(1), from the General Commands Manual section of your local man setup. it's a whole lil command and we're gonna get you fluent. periodt.

✨ NAME ✨

daemonlogger — a simple network logger and soft tap daemon 🦋

🌸 SYNOPSIS 🌸

daemonlogger [Options]

that's it. just options. no positional nonsense, no drama. 💅

🎀 DESCRIPTION 🎀

so, daemonlogger is a simple network packet logger and a soft tap daemon. it does two main character things: it can log packets to file, or it can mirror them to another interface. that's the whole vibe. iconic behavior honestly. 🔥

👑 OPTIONS 👑

one bullet per option, no skips, no "you get the idea." we're doing all of them. 🫶

  • --help — show a summary of the options. your lil cheat sheet.
  • -v — show the version of the program.
  • -c <count> — log <count> packets and then exit. like, that's your whole shift.
  • -d — run as a daemon. go live in the background, king. 👑
  • -f <bpf file> — load a bpf filter from a file.
  • -F — flush the pcap buffer for each packet. every single one. no cap.
  • -g <group id> — set the group to <group id>.
  • -u <user name> — set the user to <user name>.
  • -i <interface> — set the interface to grab data from to <interface>. this is your source, bestie.
  • -l <path> — set the log directory to <path>.
  • -m <count> — generate <count> number of log files and then exit.
  • -n <name> — set the output file prefix to <name>.
  • -o <interface> — disable logging, and instead mirror traffic from -i <interface> to -o <interface>. glow-up mode: instead of writing it down, you're just passing the vibe along. 💫
  • -p <pidfile> — set the PID filename to <pidfile>.
  • -P <path> — set the PID path to <path>.
  • -r — activate ringbuffer mode. 🔄
  • -R <pcap file> — read packets from <pcap file>
  • -s <bytes> — automatically roll over the log file after <bytes>.
  • -S <snaplen> — set the number of bytes per packet to capture to <snaplen>.
  • -t <seconds> — rollover the log file on time intervals. this one's a whole saga, so buckle up:
    • append an 'm' to rollover on minute boundaries, 'h' to rollover on hour boundaries, and 'd' to rollover on day boundaries.
    • if no interval selector is used, then the default rollover interval is in seconds.
    • for example, "-t 60" rolls the log file over every 60 seconds, and "-t 2h" rolls the log file over every two hours at the top of the hour.
    • in the case of minute/hour/day-based rollovers, it will round to the next highest hour. for example, if the program is told to rollover every 2 hours and is started 38 minutes into the current hour, it will add 2 to the current hour and rollover as scheduled at the top of the hour at <current hour> + 2. if the program was started at 13:38, it would roll over the logfile at 15:00. math is mathing. 🧚
  • -T <chroot dir> — chroot daemonlogger to <chroot dir>
  • -z — select log file pruning behavior.
okay so listen, this one needs its own moment: omitting this switch results in the default mode being used, where the oldest log file in the logging directory is pruned. setting the -z switch changes the behavior so that Daemonlogger will prune the oldest file from its current instantiation and leave files from older runs in the same logging directory alone. so like, -z = "only my files, not the ex's." 💀

🌈 RESOURCES 🌈

💜 AUTHOR 💜

daemonlogger was written by Martin Roesch <roesch@sourcefire.com>.

This manual page was written by Chris Taylor <ctaylor@debian.org>, for the Debian project (but may be used by others).

and that's the whole page, bestie 🥹 this version of the DAEMONLOGGER(1) page from the General Commands Manual is dated December 08, 2009 — ancient, but the lore still slaps. go log some packets, you absolute icon. 💖✨🎀🦋🌸💅🫶

📦 where this page comes from