Homer Capture Storage location...?

[PJ111288]

Hello Guys,

Where are the captured logs or pcap saved in homer?

Thanks, AS

[lmangani]

There are no PCAPs stored anywhere. All exports are dynamically generated from the Database entries.

[PJ111288]

Hi Imangani,

Thanks for answering my question. I am curious to know more about homer like what are these files.....

Homer-Srv:/var/lib/postgresql/13/main/base/13444# ls 112 13295_fsm 13310_fsm 2600_fsm 2606 2611 2618_fsm 2659 2678 2693 2831 2995 3351 3456 3575 3603 3997 4157 4172 827 113 13295_vm 13310_vm 2600_vm 2606_fsm 2612 2618_vm 2660 2679 2696 2832 2996 3379 3456_fsm 3576 3603_fsm 4143 4158 4173 828 1247 13297 13312 2601 2606_vm 2612_fsm 2619 2661 2680 2699 2833 3079 3380 3456_vm 3596 3603_vm 4144 4159 4174 pg_filenode.map 1247_fsm 13299 13314 2601_fsm 2607 2612_vm 2619_fsm 2662 2681 2701 2834 3079_fsm 3381 3466 3597 3604 4145 4160 5002 PG_VERSION 1247_vm 13300 1417 2601_vm 2607_fsm 2613 2619_vm 2663 2682 2702 2835 3079_vm 3394 3467 3598 3605 4146 4161 548 1249 13300_fsm 1418 2602 2607_vm 2615 2620 2664 2683 2703 2836 3080 3394_fsm 3468 3599 3606 4147 4162 549 1249_fsm 13300_vm 174 2602_fsm 2608 2615_fsm 2650 2665 2684 2704 2837 3081 3394_vm 3501 3600 3607 4148 4163 6102 1249_vm 13302 175 2602_vm 2608_fsm 2615_vm 2651 2666 2685 2753 2838 3085 3395 3502 3600_fsm 3608 4149 4164 6104 1255 13304 2187 2603 2608_vm 2616 2652 2667 2686 2753_fsm 2838_fsm 3118 3429 3503 3600_vm 3609 4150 4165 6106 1255_fsm 13305 2224 2603_fsm 2609 2616_fsm 2653 2668 2687 2753_vm 2838_vm 3119 3430 3534 3601 3712 4151 4166 6110 1255_vm 13305_fsm 2328 2603_vm 2609_fsm 2616_vm 2654 2669 2688 2754 2839 3164 3431 3541 3601_fsm 3764 4152 4167 6111 1259 13305_vm 2336 2604 2609_vm 2617 2655 2670 2689 2755 2840 3256 3433 3541_fsm 3601_vm 3764_fsm 4153 4168 6112 1259_fsm 13307 2337 2605 2610 2617_fsm 2656 2673 2690 2756 2840_fsm 3257 3439 3541_vm 3602 3764_vm 4154 4169 6113 1259_vm 13309 2579 2605_fsm 2610_fsm 2617_vm 2657 2674 2691 2757 2840_vm 3258 3440 3542 3602_fsm 3766 4155 4170 6117 13295 13310 2600 2605_vm 2610_vm 2618 2658 2675 2692 2830 2841 3350 3455 3574 3602_vm 3767 4156 4171 826

[kYroL01]

Hi @PJ111288 those are not Homer file, but from Postgresql. Check here https://pgpedia.info/p/pg_filenode_map.html Thanks

[PJ111288]

Hi @kYroL01

Yes, i agreed but why and how is it generating and what data they are containing?

Thanks, AS

[lmangani]

It's impossible to tell but since this is on your system you can inspect them. As suggested by our colleague, this is more of a postgres question, not a HOMER related one.

Thanks!

[PJ111288]

Hello @lmangani,

Ok, but it defaults on homer-srv configuration postgres. nothing else.

Thanks, AS

[kYroL01]

Hi @PJ111288 You can choose the DB you want, PostgreSQL it's just one, and although it's the default by homer, we don't have any control on that side. If you think that those files are not required or you need more details on why PostgreSQL generates them I suggest you to ask directly on their support. Unfortunately we cannot know such fine-grained definition, as we're not the PostgreSQL developer. It's an honest question if you need more clarification.

Thank you. Michele