Low nsm partition usage #14148
-
Version2.4.111 Installation MethodSecurity Onion ISO image Descriptionother (please provide detail below) Installation TypeStandalone Locationon-prem with Internet access Hardware SpecsExceeds minimum requirements CPU8 RAM64 Storage for /280GB Storage for /nsm8TB Network Traffic Collectionspan port Network Traffic SpeedsLess than 1Gbps StatusYes, all services on all nodes are running OK Salt StatusNo, there are no failures LogsNo, there are no additional clues DetailAfter 21 days of activity with an average traffic of 40Mb/s I have a NSM partition utilization of 29% with a PCAP retention of just 3 days. All system settings are at the default values. What could be the cause of the problem? Guidelines
|
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 7 replies
-
|
Do you think you should have more disk usage? What do your indices look like? If you look in influxdb, what is your PCAP retention? |
Beta Was this translation helpful? Give feedback.
-
|
all indexes are green and open. On average the indexes associated with ds-logs-suricata.alert-so-aaaa.mm.dd have an average size of 230mb. In influxb the value given for PCAP retention is 2.7 days, and in the alarm grid there is value 2 in the severity column for Low pcap retention. |
Beta Was this translation helpful? Give feedback.
-
|
What is the setting at Administration > Configuration > global > pcapengine? |
Beta Was this translation helpful? Give feedback.
-
|
suricata |
Beta Was this translation helpful? Give feedback.
-
|
OK, so what is the setting at Administration > Configuration > suricata > pcap > maxsize? |
Beta Was this translation helpful? Give feedback.
-
|
Current Grid Value: 25 |
Beta Was this translation helpful? Give feedback.
-
|
OK, so what is the setting at Administration > Configuration > suricata > pcap > conditional? |
Beta Was this translation helpful? Give feedback.
-
|
Current Grid Value: All |
Beta Was this translation helpful? Give feedback.
-
|
What is the setting at Administration > Configuration > bpf > suricata? Have you checked for additional clues in /opt/so/log/suricata/suricata.log? What is the output of the following? |
Beta Was this translation helpful? Give feedback.
-
|
I solved by increasing the maxsize value! |
Beta Was this translation helpful? Give feedback.
OK, so what is the setting at Administration > Configuration > suricata > pcap > maxsize?