...
If ethanalayzer is used with "capture-ring-buffer" option in and EEM script, the pcap files are created with no rw permissions:
event manager applet testing_ethanalyzer event cli match "show vers" action 1.0 cli ethanalyzer local interface inband limit-captured-frames 100 capture-ring-buffer filesize 10 write bootflash:high-cpu-tc1-mod7.pcap NEXUS(config-applet)# end NEXUS# sh vers % Command blocked by event manager policy NEXUS# dir | grep high 0 Feb 02 17:51:31 2017 high-cpu-tc1-mod7.pcap 13020 Feb 02 17:51:33 2017 high-cpu-tc1-mod7_00001_20170202175133.pcap 18087 Feb 02 17:51:33 2017 high-cpu-tc1-mod7_00002_20170202175133.pcap 18087 Feb 02 17:51:33 2017 high-cpu-tc1-mod7_00003_20170202175133.pcap NEXUS# ethanalyzer local read bootflash:high-cpu-tc1-mod7_00013_20170202175133.pcap tshark: You don't have permission to read the file "/bootflash/high-cpu-tc1-mod7_00013_20170202175133.pcap".
ethanalyzer with "capture-ring-buffer" option used in an EEM action
Change the permissions to rw from dplug: NEXUS# load n7000-s2-debug-sh.6.2.16.gbin Loading plugin version 6.2(16) ############################################################### Warning: debug-plugin is for engineering internal use only! For security reason, plugin image has been deleted. ############################################################### Successfully loaded debug-plugin!!! Linux(debug)# cd bootflash/ Linux(debug)# ls -l | grep high-cpu -rw-rw-rw- 1 svc-isan isan 0 Feb 2 17:55 high-cpu-tc1-mod7.pcap -rw------- 1 svc-isan isan 13020 Feb 2 17:51 high-cpu-tc1-mod7_00001_20170202175133.pcap -rw------- 1 svc-isan isan 18087 Feb 2 17:51 high-cpu-tc1-mod7_00002_20170202175133.pcap -rw------- 1 svc-isan isan 18087 Feb 2 17:51 high-cpu-tc1-mod7_00003_20170202175133.pcap -rw------- 1 svc-isan isan 18087 Feb 2 17:51 high-cpu-tc1-mod7_00004_20170202175133.pcap Linux(debug)# chmod 666 high-cpu-tc1* Linux(debug)# ls -l | grep high-cpu -rw-rw-rw- 1 svc-isan isan 0 Feb 2 17:55 high-cpu-tc1-mod7.pcap -rw-rw-rw- 1 svc-isan isan 13020 Feb 2 17:51 high-cpu-tc1-mod7_00001_20170202175133.pcap -rw-rw-rw- 1 svc-isan isan 18087 Feb 2 17:51 high-cpu-tc1-mod7_00002_20170202175133.pcap NEXUS# ethanalyzer local read bootflash:high-cpu-tc1-mod7_00001_20170202174957.pcap 2017-02-02 17:49:57.108420 10.113.7.253 -> 224.0.0.102 HSRPv2 110 Hello (state Standby) 2017-02-02 17:49:57.108447 10.113.7.253 -> 224.0.0.102 HSRPv2 110 Hello (state Standby)