/nsm/pcap and /nsm/pcapindex

[DebianGuru]

Version

2.4.120

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

20

RAM

18GB

Storage for /

166G

Storage for /nsm

3.4TB

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

My standalone install had been running and stable for a long time now. But I recently saw that my pcap retention, which used to show around 30 days, has droped to 3. I'm not sure what in the world has happened because not much has changed as far as workload. My question is that in the course of investigating this, I looked in the /nsm folder and notices /nsm/pcap and /nsm/pcapindex which both have the exact same size and modify times. I don't really recall that from the past. Did something change that would have caused this with the previous versions? Am I really duplication pcaps?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[DebianGuru]

Update to this. I don't know what is causing the PCAP retention to diminish, but it now says 0.0 days. I have 2.8TB free in the /nsm drive. The /nsm/pcap folder has about 5000+ files fot a a total of 36.4GB. These date back about 3 days. Why doesn't it see all of these files? Any Ideas would be great.

[reyesj2]

can you share the output of

du -hd1 /nsm

[DebianGuru]

@reyesj2, Thanks for the reply. Here's the output of that command:
28G /nsm/docker-registry
3.5G /nsm/repo
4.5G /nsm/elastic-fleet
7.8M /nsm/kratos
242M /nsm/rules
4.2G /nsm/influxdb
12G /nsm/backup
92K /nsm/soc
46G /nsm/pcap
528K /nsm/import
0 /nsm/pcapout
235M /nsm/mysql
1.6T /nsm/elasticsearch
4.0K /nsm/logstash
4.0K /nsm/redis
4.0K /nsm/pcaptmp
601M /nsm/pcapindex
164K /nsm/suricata
23G /nsm/zeek
47G /nsm/strelka
0 /nsm/suripcap
406G /nsm/SO-ES-Backup
143M /nsm/securityonion-resources
0 /nsm/custom-mappings
2.1T /nsm

Note: the SO-ES-Backup is where I'm dumping the elasticsearch snapshots, which are then backed up via daily cronjob to another box.

Here's also the output of df -h (Just the lines that concern this drive.)
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/system-nsm 5.0T 2.4T 2.7T 48% /nsm

Of course, I use bpf to ignore some things I don't want captured, but is there a way to see within SO exactly what is hogging up the pcaps?

Again, thanks for the help.

[reyesj2]

Because /nsm/suripcap is empty it looks like you're using stenographer for pcap on this standalone? You may need to review your disk free percentage setting https://docs.securityonion.net/en/2.4/stenographer.html#disk-free-percentage