parallel-tcpdump.yml

parallel-tcpdump.yml

- hosts: all
  sudo: yes
  vars:
      cap_file: packet_capture_{{ ansible_hostname }}_{{ ansible_date_time['epoch'] }}.cap
 
  tasks:
    - name: start tcpdump
      command: /usr/sbin/tcpdump -i eth0 -s 0 -w /tmp/${cap_file}
      async: 60
      poll: 0
 
    - pause: minutes=1 prompt="pause for 60 seconds or press Ctrl + c then c to continue"
 
    - name: kill tcpdump
      command: /usr/bin/pkill tcpdump
 
    - name: compress capture file
      command: gzip ${cap_file} chdir=/tmp
 
    - name: copy logs to local boxes webroot
      fetch: src=/tmp/${cap_file}.gz dest=/var/www/ flat=yes
 
    - name: remove files from server
      file: path=/tmp/${cap_file}.gz state=absent