PCAP Pending && Incomplete

[mohasmr]

Version

2.4.40

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

airgap

Hardware Specs

Meets minimum requirements

CPU

8

RAM

16

Storage for /

71

Storage for /nsm

137

Network Traffic Collection

tap

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

i have a problem since 5 or 6 days with PCAP interface
even i restart (so-sensoroni-restart) and clean sensor (so-sensor-clean) the logs in /opt/so/log/sensoroni/sensoroni.log showing that he processing pcap but with no results

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Can you share the full /opt/so/log/soc/sensoroni-server.log that includes those pending queries? Also, what is the architecture of your grid?

[samanosuke26]

Check to ensure that the parameters of your PCAP query are correct and that the PCAP still exists within /nsm/pcap
I'm not sure about 2.4 but in 2.3 if the PCAP being searched for has already rolled off the job will remain incomplete or pending indefinitely.

It takes manually deleting the PCAP job from either that menu on the grid or the job file within /nsm
#12054

[mohasmr]

the server was damaged on xfs level so i installed a new so-standalone and i have no issue for now if the problem occurs again i will reopen it thanks all for your help