--eventroratesize=0		the rorate size(MB) of the event collector file, 1M~65535M, only works for eventaddr server is file. --eventaddr=tls.log --eventroratesize=1 --eventroratetime=30
      --eventroratetime=0		the rorate time(s) of the event collector file, 1s~65535s, only works for eventaddr server is file. --eventaddr=tls.log --eventroratesize=1 --eventroratetime=30

# ./bin/ecapture  -h
NAME:
	eCapture - Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64.

USAGE:
	eCapture [flags]

VERSION:
	linux_amd64:v1.1.0-20250609-0e774f1:5.15.0-136-generic

COMMANDS:
	bash		capture bash command
	gnutls		capture gnutls text content without CA cert for gnutls libraries.
	gotls		Capturing plaintext communication from Golang programs encrypted with TLS/HTTPS.
	help		Help about any command
	mysqld		capture sql queries from mysqld 5.6/5.7/8.0 .
	nspr		capture nss/nspr encrypted text content without CA cert for nss/nspr libraries.
	postgres	capture sql queries from postgres 10+.
	tls		Used to capture TLS/SSL text content without the need for a CA certificate. (Supports OpenSSL 1.0.x/1.1.x/3.x or newer).
	zsh		capture zsh command

DESCRIPTION:
	eCapture(旁观者) is a tool that can capture plaintext packets
	such as HTTPS and TLS without installing a CA certificate.
	It can also capture bash commands, which is suitable for
	security auditing scenarios, such as database auditing of mysqld, etc (disabled on Android).
	Support Linux(Android)  X86_64 4.18/aarch64 5.5 or newer.
	Repository: https://github.com/gojue/ecapture
	HomePage: https://ecapture.cc
	
	Usage:
	  ecapture tls -h
	  ecapture bash -h
	
	Docker usage:
	docker pull gojue/ecapture:latest
	docker run --rm --privileged=true --net=host -v ${HOST_PATH}:${CONTAINER_PATH} gojue/ecapture -h

OPTIONS:
  -b, --btf=0				enable BTF mode.(0:auto; 1:core; 2:non-core)
  -d, --debug[=false]			enable debug logging
      --eventaddr=""			the server address that receives the captured event. --eventaddr tcp://127.0.0.1:8090, default: same as logaddr
      --eventroratesize=0		the rorate size(MB) of the event collector file, 1M~65535M, only works for eventaddr server is file. --eventaddr=tls.log --eventroratesize=1 --eventroratetime=30
      --eventroratetime=0		the rorate time(s) of the event collector file, 1s~65535s, only works for eventaddr server is file. --eventaddr=tls.log --eventroratesize=1 --eventroratetime=30
  -h, --help[=false]			help for eCapture
      --hex[=false]			print byte strings as hex encoded strings
      --listen="localhost:28256"	listen on this address for http server, default: 127.0.0.1:28256
  -l, --logaddr=""			send logs to this server. -l /tmp/ecapture.log or -l tcp://127.0.0.1:8080
      --mapsize=1024			eBPF map size per CPU,for events buffer. default:1024 * PAGESIZE. (KB)
  -p, --pid=0				if pid is 0 then we target all pids
  -t, --tsize=0				the truncate size in text mode, default: 0 (B), no truncate
  -u, --uid=0				if uid is 0 then we target all users
  -v, --version[=false]			version for eCapture

# ./bin/ecapture  tls --eventaddr=/var/log/tls/rorate.log   --eventroratesize=1 --eventroratetime=30
... ...

root@cd-ubuntu:/var/log/tls# ll /var/log/tls/
total 300
drwxr-xr-x  2 root root   4096 Jun 10 00:54 ./
drwxr-xr-x 12 root root   4096 Jun 10 00:51 ../
-rw-------  1 root root   4609 Jun 10 00:52 rorate-2025-06-10T00-52-45.122.log
-rw-------  1 root root  13866 Jun 10 00:53 rorate-2025-06-10T00-53-15.122.log
-rw-------  1 root root 273080 Jun 10 00:53 rorate-2025-06-10T00-54-04.511.log
-rw-------  1 root root      0 Jun 10 00:54 rorate.log