low PCAP Retention

[ByteAndBits]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

64

RAM

512

Storage for /

15TB

Storage for /nsm

30TB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi,

we run a seconion as a fresh installation. Now we get the error from influx:

Low PCAP Retention

What does this mean? We have one Sensor node with 6TB NSM. Is this to low.

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[m0duspwnens]

Low PCAP Retention refers to how much PCAP is currently stored being low. The default alerts for this are critical for 1 day and warning for 3 days.