Packet capture unable to start on newly installed Network Monitor.

Products

• Data Loss Prevention Network Monitor
• Data Loss Prevention

Issue/Introduction

Packet Capture restarts after installing the Network Monitor.

Error : 1008 Packet capture down          

Packet capture.log

FATAL StreamFile = StreamFile::initFile() Error openning file: d:/drop_pcap/<folder>/#####.vpcap strerror says open failed: No such file or directory [.\StroutFile.cpp(154)]

Cause

PacketCapture is unable to create files in the drop_pcap directory. This directory is where messages are stored for FileReader.  Without being able to write those files, it is unable to create messages to be processed. 

Resolution

Check the permissions of the drop_pcap folder and the rest of the DLP folders. Make sure the correct user and permissions are added to the DLP folders with which the Symantec DLP Detection Server service is running.