Bettercap: event.stream.output rotate feature

[ohpe]

Sometimes we need to run bettercap for hours/days and logs get bigger and bigger...
Right now, my best solution is to interact externally with a job like this and a tmux session:

~# tmux kill-session -t netmon && ./scripts/start_cap.sh

#!/bin/bash
# start_cap.sh
TS=`date +"%FT%H%M%z"`

BETTERCAP_LOG="bce_latest.log"
BETTERCAP_LOGDIR="/root/bcelogs"

mkdir -p $BETTERCAP_LOGDIR

# Rotate
if [ -e "${BETTERCAP_LOGDIR}/${BETTERCAP_LOG}" ]; then
    cp "${BETTERCAP_LOGDIR}/${BETTERCAP_LOG}" "${BETTERCAP_LOGDIR}/bce_${TS}.log"
    tar -zcf "${BETTERCAP_LOGDIR}/bce_${TS}.tar.gz" "${BETTERCAP_LOGDIR}/bce_${TS}.log" --remove-files
    echo "Previous logile archived as ${BETTERCAP_LOGDIR}/bce_${TS}.tar.gz"

fi

tmux new-session -s netmon -d
tmux rename-window -t netmon "bettercap"
tmux send-keys -t netmon:0 "./bettercap -eval \"set events.stream.output ${BETTERCAP_LOGDIR}/${BETTERCAP_LOG}\"" C-m

sleep 2
tmux split-window -v -t netmon
tmux send-keys -t netmon:0 "tail -f ${BETTERCAP_LOGDIR}/${BETTERCAP_LOG}" C-m

tmux attach -t netmon

It would be useful to have a native log rotate option in the events.stream.
Maybe something like this:

events.output.rotate:

• type: it can be by time or file size
• period: in seconds
• size: in MB
• pattern: the file-name pattern
• compress: bool

[evilsocket]

hey @ohpe could you do some testing for me please? you can check the new events.stream.output.rotate parameters here https://github.com/bettercap/bettercap/wiki/events.stream

[ohpe]

It's perfect. Just a minor change in the events.stream.output.rotate.when.
Better to use MB for the size than Bytes. Here's the PR: #378

[evilsocket]

great, thanks! :D