fpc icon indicating copy to clipboard operation
fpc copied to clipboard

unprocessed pcaps cause moloch-capture start failures

Open ghost opened this issue 7 years ago • 0 comments

Any ideas on why it is when pcaps are collected and sitting in the indexer host /data/pcap folder yet to be processed and a restart of container or host occurs, startup then fails with the moloch_capture in the fpc-moloch container?

To get all working again I must:

  1. stop sensor containers.
  2. clear all the pcaps out of the indexer hosts' /data/pcap folder
  3. restart fpc-moloch container on the indexer host.

Thanks!

ghost avatar Jul 30 '18 16:07 ghost