547
edits
Capture module: Difference between revisions
→Configuration settings
| Line 217: | Line 217: | ||
* Split PCAP file after this duration This option can be used to limit the duration of the PCAP file when storing to an attached device. The duration starts counting with the start of the capture. Once the captured traffic would exceed the duration, a new PCAP file with the current time stamp is created and the traffic is written to the new file. When set to 0, no splitting will be done. Both split parameters can be combined. The PCAP file will be split as soon as one threshold has been reached. | * Split PCAP file after this duration This option can be used to limit the duration of the PCAP file when storing to an attached device. The duration starts counting with the start of the capture. Once the captured traffic would exceed the duration, a new PCAP file with the current time stamp is created and the traffic is written to the new file. When set to 0, no splitting will be done. Both split parameters can be combined. The PCAP file will be split as soon as one threshold has been reached. | ||
* The maximum number of concurrent packet ring buffers | |||
:This option is used to specify how many cluster packet ring buffers can run in parallel. | |||
:Be aware that each cluster will have it's own queue in memory and therefore the memory required is the number of cluster packet ring buffers multiplied by the setting of '''The size in MB for the queue of the packet ring buffer'''. | |||
: A reboot of the device or a restart of the processing is needed for a change to this option to take effect. | |||
* The size in MB for the queue of the packet ring buffer This option allows to configure the size of the queue that holds processed packets before they are written to the packet ring buffer. Increasing the size of this queue may help if the disk used for the packet ring buffer cannot keep up with bursts of traffic so that packet drops occur in the packet ring buffer. Be aware that memory allocated to this queue is not available for storing statistics and metadata so that choosing a large value for this queue reduces the overall data storage time. Most users will not need to change this value from the default value. A reboot of the device or a restart of the processing is needed for a change to this option to take effect. | * The size in MB for the queue of the packet ring buffer This option allows to configure the size of the queue that holds processed packets before they are written to the packet ring buffer. Increasing the size of this queue may help if the disk used for the packet ring buffer cannot keep up with bursts of traffic so that packet drops occur in the packet ring buffer. Be aware that memory allocated to this queue is not available for storing statistics and metadata so that choosing a large value for this queue reduces the overall data storage time. Most users will not need to change this value from the default value. A reboot of the device or a restart of the processing is needed for a change to this option to take effect. | ||
* The maximum size in MB for the packet reorder buffer when capturing from the packet ring buffer This setting allows to choose the maximum size that the packet reorder buffer may grow to. For performance reasons the packet ring buffer does not ensure a total order of packets when storing them on disk. The packet reorder buffer is used to restore the correct order of packets in a capture when capturing from the packet ring buffer. A larger packet reorder buffer makes it more likely that the packet order can be restored for all packets. The actual amount of memory used for the packet reorder buffer depends on this setting but also on the amount of free memory in the system so that the effectively used amount of memory may be less than this setting indicates. | * The maximum size in MB for the packet reorder buffer when capturing from the packet ring buffer This setting allows to choose the maximum size that the packet reorder buffer may grow to. For performance reasons the packet ring buffer does not ensure a total order of packets when storing them on disk. The packet reorder buffer is used to restore the correct order of packets in a capture when capturing from the packet ring buffer. A larger packet reorder buffer makes it more likely that the packet order can be restored for all packets. The actual amount of memory used for the packet reorder buffer depends on this setting but also on the amount of free memory in the system so that the effectively used amount of memory may be less than this setting indicates. | ||
==== Capture settings dialog ==== | ==== Capture settings dialog ==== | ||