| Bug ID |
9534
|
| Summary |
tshark/dumpcap doesn't clean up ringbuffer files when it has fallen behind
|
| Classification |
Unclassified
|
| Product |
Wireshark
|
| Version |
1.10.3
|
| Hardware |
x86-64
|
| OS |
Debian
|
| Status |
UNCONFIRMED
|
| Severity |
Normal
|
| Priority |
Low
|
| Component |
TShark
|
| Assignee |
[email protected]
|
| Reporter |
[email protected]
|
Build Information:
tshark: Lua: Error during loading:
[string "/usr/share/wireshark/init.lua"]:46: dofile has been disabled due to
running Wireshark as superuser. See
http://wiki.wireshark.org/CaptureSetup/CapturePrivileges for help in running
Wireshark as an unprivileged user.
TShark 1.10.3 (SVN Rev 53022 from /trunk-1.10)
Copyright 1998-2013 Gerald Combs <[email protected]> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with GLib 2.36.4, with libpcap, with libz 1.2.8, with POSIX
capabilities (Linux), without libnl, with SMI 0.4.8, with c-ares 1.10.0, with
Lua 5.2, without Python, with GnuTLS 2.12.23, with Gcrypt 1.5.3, with MIT
Kerberos, with GeoIP.
Running on Linux 3.11-2-amd64, with locale en_US.UTF-8, with libpcap version
1.4.0, with libz 1.2.8.
AMD E-350 Processor
Built using gcc 4.8.2.
--
If tshark falls behind the ringbuffer, it will not clean up the file it was
working on when re-entering the buffer. this results in a situation where
residual files are left on the disk that are not expected to be there.
Example:
-rw------- 1 root root 98M Dec 9 10:20 tshark-stats_00018_20131209094918.pcap
-rw------- 1 root root 17M Dec 9 10:25 tshark-stats_00019_20131209102014.pcap
-rw------- 1 root root 98M Dec 8 22:50 tshark-stats_00067_20131208224648.pcap
-rw------- 1 root root 98M Dec 8 22:55 tshark-stats_00068_20131208225057.pcap
-rw------- 1 root root 22M Dec 8 22:56 tshark-stats_00069_20131208225518.pcap
Files 67, 68, and 69 should have been cleaned up once tshark finished
processing them, however are left behind instead.
You are receiving this mail because:
- You are watching all bug changes.
