Tshark revolving file collection

Question

I am interested in running a startup script in windows that runs tshark.exe -i 1 -a filesize:100000 -b files:10 -w revolvingfiles

The idea is to only have a maximum of 1GB of harddrive space occupied at any given time, but to have the collection start at boot up. The problem is that when you re-run the command above it finds the next available number and starts its count over. This would would occupy 3GB of space after being run three times.

Is there a way to force tshark to recognize the existence of previous files and to maintain the state of 10 files after multiple executions of the program (ie. after 3 reboots, still having only 10 files)

I understand that I could write a script that deletes the previous set of files, but this is not ideal.

Accepted Answer

I have a script (batch file) that basically does this. Here's the basic usage:

A batch file that allows you to limit the number of files in a directory or the total disk space consumed by those files, or both. Optionally, you can specify a particular file pattern to match rather than the default, which is for all files. WARNING: All files in excess of the maximum allowed WILL BE DELETED! Usage: maxfiles.bat <-d dir> [options] … where options are: [-c countlimit] [-s sizelimit] [-p pattern] [-r secs] [-q] [-h]

-d dir The directory of files. (Required!) -c countlimit The maximum number of files allowed in the directory. -s sizelimit The maximum size limit of the files in the directory. -p pattern The file matching pattern. (Default is all files) -r secs Run continuously with a specified delay between loops. -q Run quietly. -h Display this help and exit.

Disclaimer: It hasn’t seen a lot of testing since I just wrote it today, and it has problems with file names that contain certain rather problematic characters in them, but if you avoid naming your files with characters such as "@#$%& ()_+{}~-=[];' then it should be OK. (Some of those characters are actually not a problem, but I forget exactly which ones.)

You indicated that, “but this is not ideal.", so maybe this is of no use to you? Anyway, let me know if you’re interested. I’m not quite sure where I’d post it though, but we’ll figure something out, I guess.