000039473 - How to handle PCAP files on "/var/lib/netwitness/uax/temp" in RSA NetWitness Platform

Document created by RSA Customer Support Employee on Dec 3, 2020
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000039473
Applies ToRSA Product Set: NetWitness Platform
RSA Product/Service Type: Admin
RSA Version/Condition:11.3.x and later version
IssueSometimes you need to cancel the Jobs when you export a huge PCAP file as it spends too much time. In this case, You can see the PCAP files in "/var/lib/netwitness/uax/temp" like the following screenshots. However, even if you delete these extract pcap Jobs on UI, the PCAP files are not deleted from "/var/lib/netwitness/uax/temp". It might be an impact to partition usage. 

User-added image

User-added image
ResolutionThis is function as design.
Even if you delete these extract pcap Jobs on UI, the PCAP files are not deleted from "/var/lib/netwitness/uax/temp". However, You can simply delete these PCAP files from command line without any issue if the partition has not enough available size.  

Attachments

    Outcomes