547
edits
Incidents: Difference between revisions
Jump to navigation
Jump to search
→Rule configuration
| Line 286: | Line 286: | ||
* lacp_channel_status_change | * lacp_channel_status_change | ||
** channel_status: 0 means that the LACP port channel is not synchronized, 1 means that the LACP port channel is synchronized. | ** channel_status: 0 means that the LACP port channel is not synchronized, 1 means that the LACP port channel is synchronized. | ||
=== Capture settings === | |||
Since firmware version 3.7, it is possible to automatically capture traffic for occurred incidents. These global settings control where capture files are stored and the capturing itself can be enabled for each rule separately. | |||
The incident capture feature requires an active packet ring buffer since the packets are extracted from the buffer at the end of the incident period. | |||
Available settings: | |||
* Capture cooldown period: For each rule a cooldown period stops multiple captures happen in fast succession. By default, new captures happens firstly after 5 seconds, but any other value of at least 1 second can be configured. The cooldown is applied to each rule separately, but for each individual rule it does not matter if the same or a different entity triggers an incident. The incident is still reported within the cooldown period, but no additional capture is started. | |||
* Storage device: Select the storage device where the captures should be stored on. | |||
* Storage directory: Enter the directory where capture files should be stored or leave empty to use the top level directory. | |||
* Select packet ring buffer to capture from: if multiple ring buffer cluster are in use, you can select which ring buffer to use for extraction. | |||
* Capture profile: A capture profile can be configured to apply packet truncation rules to the capture file. If unset, the complete packets are captured (if the ring buffer uses separate truncation rules, truncated packets might still be within the capture file). | |||
== Channel configuration == | == Channel configuration == | ||