title: how to exit a bash script running tcpdump with error data
body: <p>I have the following bash script that takes tcpdump data and pipes it (eventually) to mysql to be written to a database. In case the script crashes, cron runs with piped output once a minute to check for the tcpdump process and restart it if necessary.</p>
  <pre><code>bash /usr/bin/uem_trap &gt;&gt;/var/log/uem.log 2&gt;&amp;1
  </code></pre>
  <p>The script does crash from time to time with various errors and I'd like to get more verbose information when it does so that I can improve the script.</p>
  <pre><code>ERROR 1064 (42000) at line 1665: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ',,,,,&quot;&quot;,&quot;);
  </code></pre>
  <p>Linux host.domain.com 3.10.0-1160.36.2.el7.x86_64 #1 SMP Wed Jul 21 11:57:15 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
  Maria DB version: 10.2.40-MariaDB</p>
  <pre><code>#!/bin/sh
  
  if ps -ef | grep -v grep | grep '/usr/sbin/tcpdump -l -i ens192 -n -nn port snmptrap' ; then
      exit 0
  else
      /usr/sbin/tcpdump -l -i ens192 -n -nn port snmptrap | stdbuf -i0 -o0 -e0 awk -F '( IP 1| +\\.1.3.6.1.([0-9]|\\.)+=)' '{gsub(/(^\&quot;|\&quot;$)/,&quot;&quot;,$15); gsub(/\&quot;/,&quot;|&quot;,$15); gsub(/(^|$)/,&quot;\&quot;&quot;,$15); print &quot;use uem; INSERT INTO uem_log (uem_dt, uem_num, uem_seq, category, entity, resource, severity, detect_time, message) VALUES (\&quot;&quot; $1 &quot;\&quot;,&quot;  $3 &quot;,&quot; $16 &quot;,&quot; $7 &quot;,&quot; $9 &quot;,&quot; $10 &quot;,&quot; $11 &quot;,\&quot;&quot; $13 &quot;\&quot;,&quot; $15 &quot;);\n&quot;}' | stdbuf -i0 -o0 -e0 mysql --user=uuuu --password=pppp &amp;
  fi
  </code></pre>
  <p>per request, a few lines of tcpdump:</p>
  <pre><code>09:49:15.914587 IP 192.168.11.20.60751 &gt; 10.74.251.198.162:  F= U=&quot;MotoNorth&quot; E=_80_00_00_a1_03_00_0c_29_5e_74_32 C=&quot;&quot; V2Trap(448)  .1.3.6.1.2.1.1.3.0=568989040 .1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.4.1.161.3.10.104.1 .1.3.6.1.4.1.161.3.10.105.3.0=55420744 .1.3.6.1.4.1.161.3.10.105.4.0=&quot;PortStatusClear&quot; .1.3.6.1.4.1.161.3.10.105.5.0=4 .1.3.6.1.4.1.161.3.10.105.6.0=&quot;10.201.8.240:port:16&quot; .1.3.6.1.4.1.161.3.10.105.7.0=&quot;16&quot; .1.3.6.1.4.1.161.3.10.105.8.0=&quot;cs01l008s1.convloc8.csub1.ucs&quot; .1.3.6.1.4.1.161.3.10.105.9.0=6 .1.3.6.1.4.1.161.3.10.105.10.0=&quot;10.201.8.240:HpSwitch2620-24&quot; .1.3.6.1.4.1.161.3.10.105.11.0=07_e6_06_0a_09_31_0f_08_2d_05_00 .1.3.6.1.4.1.161.3.10.105.12.0=07_b2_01_01_00_00_00_00_2b_00_00 .1.3.6.1.4.1.161.3.10.105.13.0=&quot;Port state is UP&quot; .1.3.6.1.4.1.161.3.10.105.19.0=7901418 .1.3.6.1.4.1.161.3.10.105.20.0=&quot;10.201.8.240&quot;
  09:49:15.915396 IP 192.168.11.20.60751 &gt; 10.74.251.198.162:  F= U=&quot;MotoNorth&quot; E=_80_00_00_a1_03_00_0c_29_5e_74_32 C=&quot;&quot; V2Trap(536)  .1.3.6.1.2.1.1.3.0=568989040 .1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.4.1.161.3.10.104.1 .1.3.6.1.4.1.161.3.10.105.3.0=55420745 .1.3.6.1.4.1.161.3.10.105.4.0=&quot;.1.3.6.1.4.1.11.2.3.7.11.129.0.2&quot; .1.3.6.1.4.1.161.3.10.105.5.0=256 .1.3.6.1.4.1.161.3.10.105.6.0=&quot;10.201.8.240&quot; .1.3.6.1.4.1.161.3.10.105.7.0=&quot;10.201.8.240&quot; .1.3.6.1.4.1.161.3.10.105.8.0=&quot;cs01l008s1.convloc8.csub1.ucs&quot; .1.3.6.1.4.1.161.3.10.105.9.0=7 .1.3.6.1.4.1.161.3.10.105.10.0=&quot;10.201.8.240:HpSwitch2620-24&quot; .1.3.6.1.4.1.161.3.10.105.11.0=07_e6_06_0a_09_31_0f_08_2d_05_00 .1.3.6.1.4.1.161.3.10.105.12.0=07_b2_01_01_00_00_00_00_2b_00_00 .1.3.6.1.4.1.161.3.10.105.13.0=&quot;HP Networking 2620-24 Trap - I 06/10/22 14:49:12 00076 ports: port 16 is now on-line&quot; .1.3.6.1.4.1.161.3.10.105.19.0=7901419 .1.3.6.1.4.1.161.3.10.105.20.0=&quot;10.201.8.240&quot;
  09:49:17.938223 IP 192.168.11.20.60751 &gt; 10.74.251.198.162:  F= U=&quot;MotoNorth&quot; E=_80_00_00_a1_03_00_0c_29_5e_74_32 C=&quot;&quot; V2Trap(493)  .1.3.6.1.2.1.1.3.0=568989243 .1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.4.1.161.3.10.104.1 .1.3.6.1.4.1.161.3.10.105.3.0=55420746 .1.3.6.1.4.1.161.3.10.105.4.0=&quot;zc_trunked_site_channel.1.1&quot; .1.3.6.1.4.1.161.3.10.105.5.0=11 .1.3.6.1.4.1.161.3.10.105.6.0=&quot;MZC-1:zc_trunked_site_channel:60.4&quot; .1.3.6.1.4.1.161.3.10.105.7.0=&quot;Trunked Site Channel 4&quot; .1.3.6.1.4.1.161.3.10.105.8.0=&quot;Site 60 at zone1&quot; .1.3.6.1.4.1.161.3.10.105.9.0=6 .1.3.6.1.4.1.161.3.10.105.10.0=&quot;MZC-1:ZCcallProcessingSubsystemSite:60&quot; .1.3.6.1.4.1.161.3.10.105.11.0=07_e6_06_0a_09_31_11_09_2d_05_00 .1.3.6.1.4.1.161.3.10.105.12.0=07_e6_06_0a_09_31_11_00_2d_05_00 .1.3.6.1.4.1.161.3.10.105.13.0=&quot;ENABLED, NO REASON&quot; .1.3.6.1.4.1.161.3.10.105.19.0=7901420 .1.3.6.1.4.1.161.3.10.105.20.0=&quot;10.1.233.100&quot;
  09:49:22.886594 IP 192.168.11.20.60751 &gt; 10.74.251.198.162:  F= U=&quot;MotoNorth&quot; E=_80_00_00_a1_03_00_0c_29_5e_74_32 C=&quot;&quot; V2Trap(644)  .1.3.6.1.2.1.1.3.0=568989738 .1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.4.1.161.3.10.104.1 .1.3.6.1.4.1.161.3.10.105.3.0=55420747 .1.3.6.1.4.1.161.3.10.105.4.0=&quot;.1.3.6.1.2.1.14.16.2.10.1&quot; .1.3.6.1.4.1.161.3.10.105.5.0=256 .1.3.6.1.4.1.161.3.10.105.6.0=&quot;10.1.253.202&quot; .1.3.6.1.4.1.161.3.10.105.7.0=&quot;10.1.253.202&quot; .1.3.6.1.4.1.161.3.10.105.8.0=&quot;z001edge02.zone1&quot; .1.3.6.1.4.1.161.3.10.105.9.0=7 .1.3.6.1.4.1.161.3.10.105.10.0=&quot;10.1.253.202:FMT_juniper-1500&quot; .1.3.6.1.4.1.161.3.10.105.11.0=07_e6_06_0a_09_31_16_08_2d_05_00 .1.3.6.1.4.1.161.3.10.105.12.0=07_b2_01_01_00_00_00_00_2b_00_00 .1.3.6.1.4.1.161.3.10.105.13.0=&quot;OSPF packet has been retransmitted on a non- virtual interface. All packets that may be re- transmitted are associated with an LSDB entry. The LS type, LS ID, and Router ID are used to identify the LSDB entry.&quot; .1.3.6.1.4.1.161.3.10.105.19.0=7901421 .1.3.6.1.4.1.161.3.10.105.20.0=&quot;10.1.253.202&quot;
  </code></pre>
  <p>UPDATE 6/10 14:27: I discovered that every now and then I get these when one device sends a few traps with a large message:</p>
  <pre><code>10:26:14.969355 IP 192.168.11.20.60751 &gt; 10.74.251.198.snmptrap:  [len1468&lt;asnlen2143]
  10:26:14.970131 IP 192.168.11.20.60751 &gt; 10.74.251.198.snmptrap:  [len1468&lt;asnlen2042]
  10:26:15.179580 IP 192.168.11.20.60751 &gt; 10.74.251.198.snmptrap:  [len1468&lt;asnlen2225]
  10:26:15.290469 IP 192.168.11.20.60751 &gt; 10.74.251.198.snmptrap:  [len1468&lt;asnlen2338]
  </code></pre>
  <p>I have increased the capture size to 2500. We'll watch and see what happens.</p>
  <pre><code>/usr/sbin/tcpdump -s 2500 -l -i ens192 -n -nn port snmptrap...
  </code></pre>