fstrm\_capture(1) General Commands Manual fstrm\_capture(1)

# [NAME](#NAME)

fstrm\_capture - Receive and save Frame Streams data from a socket.

# [SYNOPSIS](#SYNOPSIS)

**fstrm\_capture -t *content-type* -w *filename***  
**\[ -u *socket-path* ] \[ -a *IP* -p *port* ]**  
**\[ -c *max-connections* ] \[ -b *buffer-size* ]**  
**\[ -s *seconds* ] \[ --gmtime ] \[ --localtime ]**  
**\[ -d \[-d ...] ]**

**fstrm\_capture --type *content-type* --write *filename***  
**\[ --unix *socket-path* ] \[ --tcp *IP* --port *port* ]**  
**\[ --maxconns *max-connections* ] \[ --buffersize *buffer-size* ]**  
**\[ --split *seconds* ] \[ --gmtime ] \[ --localtime ]**  
**\[ --debug \[--debug ...] ]**

# [DESCRIPTION](#DESCRIPTION)

**fstrm\_capture** listens on a UNIX domain or TCP socket, receives Frame Streams data, and writes the data to a file.

# [OPTIONS](#OPTIONS)

[**-w *filename* | --write *filename***](#w)

Write data to the file *filename*.

If the **--gmtime** or **--localtime** option is given, *filename* is preprocessed with **strftime()**. This will allow specifying a format string which includes the date and time, for example, for the created filename.

If *filename* is "-" and standard output is not connected to a terminal, **fstrm\_capture** will write to standard output. Output splitting (**-s**) may not be used with a *filename* of "-".

Sending *SIGHUP* to **fstrm\_capture** will flush any buffered output to the file. Sending *SIGUSR1* will close and reopen the file.

[**-t *content-type* | --type *content-type***](#t)

Specify the *content-type* to receive from the socket and write to the output *filename*.

[**-u *socket-path* | --unix *socket-path***](#u)

Listen on the Unix domain socket *socket-path* to receive Frame Streams data. Only one of **-u** or **-a** may be given.

[**-a *IP* | --tcp *IP***](#a)

Listen for TCP connections on address *IP* to receive Frame Streams data. Only one of **-u** or **-a** may be given. Use of **-a** requires a port given with **-p**.

[**-p *port* | --port *port***](#p)

If **-a** is given, listen on TCP port *port* to receive Frame Streams data.

[**-c *max-conns* | --maxconns *max-conns***](#c)

Allow at most *max-conns* concurrent connections. If not specified, concurrent connections are not limited.

[**-b *buffersize* | --buffersize *buffersize***](#b)

Set read buffer size to *buffersize* bytes. Combined with **-c**, this can be used to limit the total memory usage of **fstrm\_capture**. The *buffersize* also affects the maximum frame size which **fstrm\_capture** will accept. Frames larger than *buffersize*, including the 4-byte framing overhead, will be discarded.

The default *buffersize* is 262144 (256KiB).

[**-s *interval* | --split *interval***](#s)

Reopen output file every *interval* seconds. Requires the use of either the **--gmtime** or **--localtime** options.

Note that this file rotation is triggered by incoming data, so it may be delayed after the interval.

[**--gmtime**](#gmtime)

Process the **--write** filename through **strftime()** with the current time in GMT. This **--gmtime** option may be used to provide a timestamped output file when starting **fstrm\_capture** or when reopening an output file using the **--split** option or when receiving a *SIGUSR1* signal.

[**--localtime**](#localtime)

Process the **--write** filename through **strftime()** with the current time in the system local time zone. This **--localtime** option may be used to provide a timestamped output file when starting **fstrm\_capture** or when reopening an output file using the **--split** option or when receiving a *SIGUSR1* signal.

[**-d \[ -d ... \] | --debug \[ --debug \]**](#d)

Increase debugging level. Without **-d**, **fstrm\_capture** prints only critical error messages. Up to five **-d** options may be specified, after which more repetitions will have no effect.

# [EXAMPLES](#EXAMPLES)

Receive dnstap data and save to hourly rotating files (with a converted filename such as */var/log/dnstap/dnstap-2018-05-04-12:58:48.fstrm*).

```
	fstrm_capture -t protobuf:dnstap.Dnstap \
		-u /var/run/named/dnstap.sock \
		-w /var/log/dnstap/dnstap-%F-%T.fstrm \
		-s 3600 --gmtime
```

# [SEE ALSO](#SEE_ALSO)

[**fstrm\_dump**(1)](/man/os/fstrm/fstrm_dump.1), [**fstrm\_replay**(1)](/man/os/fstrm/fstrm_replay.1), [**strftime**(3)](/man/os/fstrm/strftime.3),  
Frame Streams C Library **https://farsightsec.github.io/fstrm**

---

Document: fstrm_capture(1) from fstrm 0.6.1-r8 (Chainguard OS)
Source: https://github.com/farsightsec/fstrm