trimpcap_install

#!/bin/bash

# Check for root
[ "$(id -u)" -ne 0 ] && echo "This script must be run using sudo!" && exit 1

echo
echo "Installing dpkt and repoze..."
echo
apt install python-dpkt python-repoze.lru

echo
echo "Downloading TrimPCAP..."
echo
wget -O /opt/trimpcap.py https://www.netresec.com/?download=trimpcap

# Set cron job destination
CRON="/etc/cron.d/trimpcap"
echo
echo "Placing cron job..."
echo
cat <<'EOF' >> $CRON
#/etc/cron.d/trimpcap
#
#crontab entry for TrimPCAP

TRIMPCAP="/opt/trimpcap.py"
LOG="/var/log/trimpcap.log"
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# Trim after 3 days
0 1 * * * root echo $(date) >> $LOG; /usr/bin/find /nsm/sensor_data/ -name "snort.log.??????????" -mmin +$((60*72)) -type f -exec /usr/bin/python $TRIMPCAP 1048576 {} \; >> $LOG 2>&1;

# Trim after 6 days
0 1 * * * root echo $(date) >> $LOG; /usr/bin/find /nsm/sensor_data/ -name "snort.log.??????????" -mmin +$((60*144)) -type f -exec /usr/bin/python $TRIMPCAP 104448 {} \; >> $LOG 2>&1;

# Trim after 30 days
0 1 * * * root echo $(date) >> $LOG; /usr/bin/find /nsm/sensor_data/ -name "snort.log.??????????" -mmin +$((60*720)) -type f -exec /usr/bin/python $TRIMPCAP 10240 {} \; >> $LOG 2>&1;
EOF

echo
echo "Installation complete!"
echo