How to query available range of packet captures?

[lonelyadmin]

Running 2.4 in a distributed mode. I recently needed a pcap that was no longer available because of the lack of space in the /nsm partition. I added space to each of the forward nodes to resolve that issue. I'd like to monitor the current history range of the pcap files, but I'm not sure of the cleanest most concise way of doing this...not to mention I have no experience with stenographer.

What's the best way of achieving this? Reading up on sten* tools now.

[dougburks]

If you just want the number of days of pcap retention, then take a look at the PCAP Retention visualization in InfluxDB:

For more information about InfluxDB, please see:
https://docs.securityonion.net/en/2.4/influxdb.html

You could also take a look at the timestamps on the files in the /nsm/pcap/ directory. For example, you could start with a simple listing of the files like this:

sudo ls -alh /nsm/pcap

If you just want to see the unique dates that have pcap:

sudo ls -alh /nsm/pcap | awk '{print $6 " " $7}' | uniq

For more information about steno, please see:
https://docs.securityonion.net/en/2.4/stenographer.html