Packet Capture stopped due to disk space limit

Created: 23 Jan 2013 | Updated: 23 Jan 2013 | 4 comments

enebdu

Code: 3305

I know that our Network Monitor is out of space but I have to wait to make changes. What exactly is this preventing? Our responses are still going out and our incidents are still being generated.

I'm getting:

3300   Packet Capture started
3305   Packet Capture stopped due to disk space limit
1000   Monitor started

Every single minute.

Thanks!

Discussion Filed Under:

Security, Data Loss Prevention (Vontu), Basics

Login or register to post comments
Comments RSS Feed

Comments 4 Comments • Jump to latest comment

yang_zhang Symantec Employee Accredited

Packet Capture stopped due to disk space limit - Comment:23 Jan 2013 : Link

Do you find .pcap files under the folder /opt/SymantecDLP/drop_pcap? If so, there may be some problem with your FileReader service of the monitor. You can try to restart this service.

If a forum post solves your problem, please flag it as a solution. If you like an article, blog post or download vote it up.

DLP tester

Packet Capture stopped due to disk space limit - Comment:20 Feb 2013 : Link

Hi Zhang,

During our use of DLP, currently we have an error of "PacketCapture restarts excessively".

I think probably you can give me some advice.

I posted the issue on : https://www-secure.symantec.com/connect/forums/packetcapture-restarts-excessively

Thanks & regards,

Weibo

jgt10

Packet Capture stopped due to disk space limit - Comment:21 Feb 2013 : Link

Enedbu,

The disk is full because PacketCapture isn't working properly and leaving files it normally cleans up and deletes.

On the monitor search for directories that have spool or drop or pcap in their names. If you find one (or more) with a large number of files look at the file names. If they are all the same length and a string of numbers and letters, check the create date.

Anything over an hour old you can delete.

Once you have free space, things will start working again.

Until you get the packetcapture issue fixed, you will need to keep monitoring the situation and deleting old files.

JGT

--
John G. Thompson
JOAT(MON)