take a 10 second packet capture whenever user CPU is elevated.

packet_capture_when_cpu_elevated.sh

#!/usr/bin/env bash

set -euo pipefail -o errtrace

main(){
    trap 'fail $? $LINENO' ERR
    sudo true
    local user_cpu;
    while true ; do
        sudo true
        # user CPU averaged over 5 seconds
        user_cpu=$(sar -u ALL 5 1 | grep Average: | awk '{ print $3; }')
        if [ $(echo "$user_cpu > 50" | bc -l) = '1' ]; then
            echo "$(date): user cpu was over threshold with value of $user_cpu. Starting packet capture."
            sudo timeout 10 sudo tcpdump -w "vtgate_$(date +%s).pcap" -i any || true
            echo "$(date): done with packet capture."
        fi
    done;
}

fail(){
    local exit_code=$1
    local line_no=$2
    local script_name
    script_name=$(basename "${BASH_SOURCE[0]}")
    echo "Error in $script_name at line number: $line_no with exit code: $exit_code"
}

main "$@"