PCAP Rollover not working correctly.

[Inkman647]

Hello, first of all going to mention that we're using Arkime instead of Stenographer, in a distributed environment. Meaning we set our PCAP path to /nsm/arkimepcap to differentiate. These factors shouldn't effect this problem though.

The PCAP files are rolling over at 90% fine. I can see the filecount for the 23rd decreasing, and the filecount for today increasing.

However, there's several hundred files PCAP files (most 13 GB each) from the 15th/16th/17th that aren't being deleted. This should be way past our rollover point. The read/write permissions are the same. The date modified is the dates they were created.

Is there a way to mark a PCAP file to not be deleted in the SOConsole? Rather than downloading it somewhere. And if so is there a way for someone to have done that for hundreds of files on accident?

See picture attached. Shows the filecount of each date.

Thank you

[dougburks]

By default, we configure Stenographer to purge its own files. Since you've decided not to use Steno and instead use Arkime which we don't include or support, we're not able to assist you any further.