From 50a7bca0eda3e6685361d3e5601abd17b783da08 Mon Sep 17 00:00:00 2001
From: Mike Reeves <luke@geekempire.com>
Date: Wed, 21 Nov 2018 20:05:50 -0500
Subject: [PATCH] Telegraf - Track Oldest PCAP

---
 salt/common/telegraf/etc/telegraf.conf  | 3 ++-
 salt/common/telegraf/scripts/oldpcap.sh | 8 ++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 salt/common/telegraf/scripts/oldpcap.sh

diff --git a/salt/common/telegraf/etc/telegraf.conf b/salt/common/telegraf/etc/telegraf.conf
index 1a7a5bb1e..f5fe28c83 100644
--- a/salt/common/telegraf/etc/telegraf.conf
+++ b/salt/common/telegraf/etc/telegraf.conf
@@ -626,7 +626,8 @@
 [[inputs.exec]]
    commands = [
      "/scripts/redis.sh",
-     "/scripts/stenoloss.sh"
+     "/scripts/stenoloss.sh",
+     "/scripts/oldpcap.sh"
    ]
    data_format = "influx"
 {% endif %}
diff --git a/salt/common/telegraf/scripts/oldpcap.sh b/salt/common/telegraf/scripts/oldpcap.sh
new file mode 100644
index 000000000..e9ae7698a
--- /dev/null
+++ b/salt/common/telegraf/scripts/oldpcap.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# Get the data
+OLDPCAP=$(find /nsm/pcap -type f -printf '%Cs %p\n' | sort | head -n 1 | awk {'print $1'})
+DATE=$(date +%s)
+AGE=$(expr $DATE - $OLDPCAP)
+
+echo "pcapage seconds=$AGE"