ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

Unable to move file from /var/spool/pcap to /var/vontu/drop_pcap


Article ID: 160782


Updated On:


Data Loss Prevention Network Monitor


PacketCapture is unable to move file from /var/spool/pcap to /var/vontu/drop_pcap


PacketCapture is unable to move file from /var/spool/pcap to /var/vontu/drop_pcap if they are not on the same mount point and partition.

Symantec DLP needs those directories to be not only on the same file system, but on the same mount points as well (could be confirmed using df -kl)

This is due to the OS calls used internally to move the files.


If these directories are on different file systems it has been observed that they do not get deleted and they will accumulate.  Sooner or later the customer will run out of disk space.