From dd9794e193c4c95061451c8b938eb5d663f8fdad Mon Sep 17 00:00:00 2001 From: Seth Grover Date: Fri, 8 Dec 2023 08:32:11 -0700 Subject: [PATCH] idaholab/Malcolm#281, arkime capture work in progress --- docs/kubernetes.md | 2 +- docs/malcolm-hedgehog-e2e-iso-install.md | 2 +- scripts/install.py | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/kubernetes.md b/docs/kubernetes.md index 23b244c17..b1b351d50 100644 --- a/docs/kubernetes.md +++ b/docs/kubernetes.md @@ -375,7 +375,7 @@ Enter index threshold (e.g., 250GB, 1TB, 60%, etc.): 250G Determine oldest indices by name (instead of creation time)? (Y / n): y -Should Arkime delete PCAP files based on available storage (see https://arkime.com/faq#pcap-deletion)? (y / N): y +Should Arkime delete uploaded PCAP files based on available storage (see https://arkime.com/faq#pcap-deletion)? (y / N): y Enter PCAP deletion threshold in gigabytes or as a percentage (e.g., 500, 10%, etc.): 10% diff --git a/docs/malcolm-hedgehog-e2e-iso-install.md b/docs/malcolm-hedgehog-e2e-iso-install.md index a537f9f65..ba5511a5f 100644 --- a/docs/malcolm-hedgehog-e2e-iso-install.md +++ b/docs/malcolm-hedgehog-e2e-iso-install.md @@ -177,7 +177,7 @@ The [configuration and tuning](malcolm-config.md#ConfigAndTuning) wizard's quest - Choose **Y** to proceed to the following related questions about managing the data storage used by Malcolm. - **Delete the oldest indices when the database exceeds a certain size?** - Most of the configuration around OpenSearch [Index State Management](https://opensearch.org/docs/latest/im-plugin/ism/index/) and [Snapshot Management](https://opensearch.org/docs/latest/opensearch/snapshots/sm-dashboards/) can be done in OpenSearch Dashboards. In addition to (or instead of) the OpenSearch index state management operations, Malcolm can also be configured to delete the oldest network session metadata indices when the database exceeds a certain size to prevent filling up all available storage with OpenSearch indices. - - **Should Arkime delete PCAP files based on available storage?** + - **Should Arkime delete uploaded PCAP files based on available storage?** - Answering **Y** allows Arkime to prune (delete) old PCAP files based on available disk space (see https://arkime.com/faq#pcap-deletion). - **Enter PCAP deletion threshold in gigabytes or as a percentage (e.g., 500, 10%, etc.)** - If [Arkime PCAP-deletion](https://arkime.com/faq#pcap-deletion) is enabled, Arkime will delete PCAP files when **free space** is lower than this value, specified as integer gigabytes (e.g., `500`) or a percentage (e.g., `10%`) diff --git a/scripts/install.py b/scripts/install.py index 4547ca2ef..6a6e37d08 100755 --- a/scripts/install.py +++ b/scripts/install.py @@ -1046,7 +1046,7 @@ def tweak_malcolm_runtime(self, malcolm_install_path): (opensearchPrimaryMode != DatabaseMode.OpenSearchLocal) or (malcolmProfile != PROFILE_MALCOLM) or InstallerYesOrNo( - 'Should Arkime delete PCAP files based on available storage (see https://arkime.com/faq#pcap-deletion)?', + 'Should Arkime delete uploaded PCAP files based on available storage (see https://arkime.com/faq#pcap-deletion)?', default=args.arkimeManagePCAP, ) ) @@ -1953,7 +1953,7 @@ def tweak_malcolm_runtime(self, malcolm_install_path): # whether or not to restart services automatically (on boot, etc.) line = f"{sectionIndents[currentSection] * 2}restart: {restartMode}" - elif currentService == 'arkime': + elif (currentService == 'arkime') or (currentService == 'arkime-live'): # stuff specifically in the arkime section if re.match(r'^\s*-.+:/data/pcap(:.+)?\s*$', line): # Arkime's reference to the PCAP directory