Unable to move file from /var/spool/pcap to /var/vontu/drop_pcap

book

Article ID: 160782

calendar_today

Updated On:

Products

Data Loss Prevention Network Monitor

Issue/Introduction

PacketCapture is unable to move file from /var/spool/pcap to /var/vontu/drop_pcap

Resolution

PacketCapture is unable to move file from /var/spool/pcap to /var/vontu/drop_pcap if they are not on the same mount point and partition.

Symantec DLP needs those directories to be not only on the same file system, but on the same mount points as well (could be confirmed using df -kl)

This is due to the OS calls used internally to move the files.

 

If these directories are on different file systems it has been observed that they do not get deleted and they will accumulate.  Sooner or later the customer will run out of disk space.