search

xme / fpc

Full Packet Capture for the Masses
15 stars 3 forks source link

unprocessed pcaps cause moloch-capture start failures #2

Open ghost opened 6 years ago

ghost commented 6 years ago

Any ideas on why it is when pcaps are collected and sitting in the indexer host /data/pcap folder yet to be processed and a restart of container or host occurs, startup then fails with the moloch_capture in the fpc-moloch container?

To get all working again I must:

  1. stop sensor containers.
  2. clear all the pcaps out of the indexer hosts' /data/pcap folder
  3. restart fpc-moloch container on the indexer host.

Thanks!