Cleaning more frequent nsm

[farzadha2]

Hi
I was wondering if someone could shed some light currently i see the nsm folder gets full really quick
i have to delete the pcap folder then run so-sensor-clean

but not sure whats the log threshold? or whats the correct way?

129534200	/nsm/
73388148	/nsm/pcap
27469868	/nsm/elasticsearch
27466876	/nsm/elasticsearch/indices
24215240	/nsm/elasticsearch/indices/pTPqvADiTLmhKJ4eS2LQLg
12127104	/nsm/elasticsearch/indices/pTPqvADiTLmhKJ4eS2LQLg/0
12127088	/nsm/elasticsearch/indices/pTPqvADiTLmhKJ4eS2LQLg/0/index
12088124	/nsm/elasticsearch/indices/pTPqvADiTLmhKJ4eS2LQLg/1
12088108	/nsm/elasticsearch/indices/pTPqvADiTLmhKJ4eS2LQLg/1/index
10834092	/nsm/repo
6553940	/nsm/backup
6550248	/nsm/docker-registry/docker
6550248	/nsm/docker-registry
6526196	/nsm/docker-registry/docker/registry/v2
6526196	/nsm/docker-registry/docker/registry
6524488	/nsm/docker-registry/docker/registry/v2/blobs/sha256
6524488	/nsm/docker-registry/docker/registry/v2/blobs
4194308	/nsm/pcap/1709090486942202
4194304	/nsm/pcap/1709090437661210
2864764	/nsm/elastic-fleet/artifacts

Thanks

[cm-ops]

You can edit the diskfreepercentage for steno to purge PCAP sooner. https://docs.securityonion.net/en/2.4/stenographer.html#configuration

[farzadha2]

Thanks for the reply, quick question would this mean to keep 50% free my disk space?

[dougburks]

You'll want to change your soc_standalone setting from 60 to 21.

For more information, please see https://docs.securityonion.net/en/2.4/stenographer.html#configuration.

[farzadha2]

thanks, just changed going to wait, another option is to expand the NSM, whats odd even though i gave security onion 200 gigs it only gave nsm 125gigs whats the recommended size it should have?

[dougburks]

thanks, just changed going to wait,

In your current standalone configuration with diskfreepercentage set to 21 and Elastic set to its default retention, then your /nsm partition should stay at about 79% disk usage. This should ensure that you're maximizing pcap retention while making sure that your disk doesn't fill up and Elastic doesn't hit its watermark settings.

whats odd even though i gave security onion 200 gigs it only gave nsm 125gigs

The installer has to create other partitions like the boot and root partitions and those partitions need enough space so that they don't fill up.

whats the recommended size it should have?

To determine your recommended size, you first need to determine how much pcap you want to retain per day and for how many days. Then size your deployment based on that. 200GB may be sufficient for a homelab environment, but most enterprise deployments have many terabytes of storage. Also, most enterprise deployments are not using a standalone installation but instead a distributed deployment with dedicated forward nodes so that pcap is on a dedicated node separate from Elasticsearch.

For more information, please see the documentation:
https://docs.securityonion.net/en/2.4/hardware.html#standalone-deployments
https://docs.securityonion.net/en/2.4/hardware.html#id1
https://docs.securityonion.net/en/2.4/best-practices.html
https://docs.securityonion.net/en/2.4/architecture.html#distributed

[farzadha2]

Thank you so much for the info :)