Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Packet Capture stopped due to disk space limit

Created: 23 Jan 2013 • Updated: 23 Jan 2013 | 4 comments

Code: 3305

I know that our Network Monitor is out of space but I have to wait to make changes. What exactly is this preventing? Our responses are still going out and our incidents are still being generated.

I'm getting:

3300    Packet Capture started
3305    Packet Capture stopped due to disk space limit
1000    Monitor started

Every single minute.

Thanks!

Discussion Filed Under:

Comments 4 CommentsJump to latest comment

yang_zhang's picture

Do you find .pcap files under the folder /opt/SymantecDLP/drop_pcap? If so, there may be some problem with your FileReader service of the monitor. You can try to restart this service.

If a forum post solves your problem, please flag it as a solution. If you like an article, blog post or download vote it up.
DLP tester's picture

Hi Zhang,

During our use of DLP, currently we have an error of "PacketCapture restarts excessively".

I think probably you can give me some advice.

I posted the issue on : https://www-secure.symantec.com/connect/forums/packetcapture-restarts-excessively

Thanks & regards,

Weibo

jgt10's picture
Enedbu,
 
The disk is full because PacketCapture isn't working properly and leaving files it normally cleans up and deletes.
 
On the monitor search for directories that have spool or drop or pcap in their names. If you find one (or more) with a large number of files look at the file names. If they are all the same length and a string of numbers and letters, check the create date. 
 
Anything over an hour old you can delete.
 
Once you have free space, things will start working again.
 
Until you get the packetcapture issue fixed, you will need to keep monitoring the situation and deleting old files.
 
JGT
 

--
John G. Thompson
JOAT(MON)