Question

我使用此命令使用tcpdump将多个pcap日志文件转换为文本：

$ cat /home/dalya/snort-2.9.9.0/snort_logs/snort.log.* | tcpdump -n -r - > /home/dalya/snort-2.9.9.0/snort_logs2/bigfile.txt

并且运作良好。

现在我想将输出，每个转换后的文件分别用于这样的循环：

for f in /home/dalya/snort-2.9.9.0/snort_logs/snort.log.* ; do
tcpdump -n -r "$f" > /home/dalya/snort-2.9.9.0/snort_logs2/"$f.txt" ; 
done

但它给了我：

bash: /home/dalya/snort-2.9.9.0/snort_logs2//home/dalya/snort-2.9.9.0/snort_logs/snort.log.1485894664.txt: No such file or directory
bash: /home/dalya/snort-2.9.9.0/snort_logs2//home/dalya/snort-2.9.9.0/snort_logs/snort.log.1485894770.txt: No such file or directory
bash: /home/dalya/snort-2.9.9.0/snort_logs2//home/dalya/snort-2.9.9.0/snort_logs/snort.log.1487346947.txt: No such file or directory

我认为$ f中的问题，我哪里出错了？

Answer 1

如果你跑

for f in /home/dalya/snort-2.9.9.0/snort_logs/snort.log.* ; do
    echo $f
done

你会发现你正在

/home/dalya/snort-2.9.9.0/snort_logs/snort.log.1485894664
/home/dalya/snort-2.9.9.0/snort_logs/snort.log.1485894770
/home/dalya/snort-2.9.9.0/snort_logs/snort.log.1487346947

您可以使用basename

只获取文件名，如下所示：

for f in /home/dalya/snort-2.9.9.0/snort_logs/snort.log.* ; do
    base="$(basename $f)"
    echo $base
done

如果您对此工作感到满意，请删除echo语句并使用

tcpdump -n -r "$f" > /home/dalya/snort-2.9.9.0/snort_logs2/"$base.txt"

代替。

修改：tcpdump -n -r "$base" > ...应该是tcpdump -n -r "$f" > ...;您只想在创建新文件名的上下文中使用$base，而不是在读取现有数据的上下文中。

使用循环将多个文件转换为单独的文件

1 个答案: