Arkime viewer not rolling pcaps

[coffeecoffeecoffeecoffeecoffee]

Describe the bug

We are running a full Malcolm setup with docker compose using the malcolm profile that monitors a local network interface with netsniff-ng. As per the docs for a low resources environment, SURICATA_LIVE_CAPTURE / ZEEK_LIVE_CAPTURE are set to false and SURICATA_ROTATED_PCAP / ZEEK_ROTATED_PCAP are set to true.

Pcaps are filling up the drive they are on, even with MANAGE_PCAP_FILES set to True. Everything shows False under Locked in the arkime files tab.

Expected behavior

The arkime container should delete pcaps once the disk usage has surpassed the designated amount of free space.

Malcolm Version:

• v24.04.0

How are you running Malcolm?

• ISO installed (on VM or dedicated hardware)
• via Docker on Linux
• via Docker on Microsoft Windows
• via Docker on macOS
• via Kubernetes (please provide platform details: e.g., on-prem K3s, Amazon AWS EKS, Microsoft Azure AKS, etc.)
• other (please describe)

Additional context

Upon further investigation, I found an old issue and this commit that referenced the same problem. In the arkime container, the pcapDir was set to /data/pcap/arkime-live by the docker entrypoint. After changing the pcapDir back to processed in the config.ini and restarting the viewer process, it correctly removed pcaps to make space.

I'm assuming the issue lies here, but I'm not very familiar with Malcolm. We are not using arkime live capture so I wonder if that replacement should only be applied when that is the case?

[mmguero]

I thought that the line you referenced in your last comment actually doesn't make any difference when arkime-live isn't doing the capture (which it isn't in your case). It should just be these two variables that come into play. But I'll look closer at it tomorrow and see if I can reproduce the issue; it may be that viewer is basing what it does on that directory you linked for its free space calculations, in which case it should be an easy fix. Thanks for bringing it to my attention.

[mmguero]

Thanks, you're exactly right. I've adjusted the entrypoint to only change that location in the case where it's actually doing live capture.