Title: Alarm for Failure in cleanup of exported IDPS PCAP tar gz files
Event ID: ids_ips.pcap_export_purge_failure
Alarm Description
VMware NSX
A scheduled job attempts to purge all tar gz files exported for IDPS PCAP that are older than 24 hours. If this job encounters an error deleting the file from the filesystem or while deleting the record associated with it from the database, an alarm is raised. If this is a temporary failure and if the next cycle for the cleanup job is able to delete the files successfully, the alarm will be resolved.
Steps to Resolve
For release 4.2.0 and higher
Recommended Action:
GET https://<mgr_ip>/policy/api/v1/infra/settings/firewall/security/intrusion-services/pcaps
DELETE https://<mgr_ip>/api/v1/infra/settings/firewall/security/intrusion-services/pcaps/<exported_tar_gz_id>
where <exported_tar_gz_id>
is the value of parameter "id" from the GET output