idaholab#281, arkime capture work in progress

mmguero-dev · Dec 8, 2023 · dd9794e · dd9794e
1 parent bf64861
commit dd9794e
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 4 deletions.
diff --git a/docs/kubernetes.md b/docs/kubernetes.md
@@ -375,7 +375,7 @@ Enter index threshold (e.g., 250GB, 1TB, 60%, etc.): 250G
 
 Determine oldest indices by name (instead of creation time)? (Y / n): y
 
-Should Arkime delete PCAP files based on available storage (see https://arkime.com/faq#pcap-deletion)? (y / N): y
+Should Arkime delete uploaded PCAP files based on available storage (see https://arkime.com/faq#pcap-deletion)? (y / N): y
 
 Enter PCAP deletion threshold in gigabytes or as a percentage (e.g., 500, 10%, etc.): 10%
 

diff --git a/docs/malcolm-hedgehog-e2e-iso-install.md b/docs/malcolm-hedgehog-e2e-iso-install.md
@@ -177,7 +177,7 @@ The [configuration and tuning](malcolm-config.md#ConfigAndTuning) wizard's quest
     - Choose **Y** to proceed to the following related questions about managing the data storage used by Malcolm.
     - **Delete the oldest indices when the database exceeds a certain size?**
         - Most of the configuration around OpenSearch [Index State Management](https://opensearch.org/docs/latest/im-plugin/ism/index/) and [Snapshot Management](https://opensearch.org/docs/latest/opensearch/snapshots/sm-dashboards/) can be done in OpenSearch Dashboards. In addition to (or instead of) the OpenSearch index state management operations, Malcolm can also be configured to delete the oldest network session metadata indices when the database exceeds a certain size to prevent filling up all available storage with OpenSearch indices.
-    - **Should Arkime delete PCAP files based on available storage?**
+    - **Should Arkime delete uploaded PCAP files based on available storage?**
         - Answering **Y** allows Arkime to prune (delete) old PCAP files based on available disk space (see https://arkime.com/faq#pcap-deletion).
     - **Enter PCAP deletion threshold in gigabytes or as a percentage (e.g., 500, 10%, etc.)**
         - If [Arkime PCAP-deletion](https://arkime.com/faq#pcap-deletion) is enabled, Arkime will delete PCAP files when **free space** is lower than this value, specified as integer gigabytes (e.g., `500`) or a percentage (e.g., `10%`)

diff --git a/scripts/install.py b/scripts/install.py
@@ -1046,7 +1046,7 @@ def tweak_malcolm_runtime(self, malcolm_install_path):
                 (opensearchPrimaryMode != DatabaseMode.OpenSearchLocal)
                 or (malcolmProfile != PROFILE_MALCOLM)
                 or InstallerYesOrNo(
-                    'Should Arkime delete PCAP files based on available storage (see https://arkime.com/faq#pcap-deletion)?',
+                    'Should Arkime delete uploaded PCAP files based on available storage (see https://arkime.com/faq#pcap-deletion)?',
                     default=args.arkimeManagePCAP,
                 )
             )
@@ -1953,7 +1953,7 @@ def tweak_malcolm_runtime(self, malcolm_install_path):
                                 # whether or not to restart services automatically (on boot, etc.)
                                 line = f"{sectionIndents[currentSection] * 2}restart: {restartMode}"
 
-                            elif currentService == 'arkime':
+                            elif (currentService == 'arkime') or (currentService == 'arkime-live'):
                                 # stuff specifically in the arkime section
                                 if re.match(r'^\s*-.+:/data/pcap(:.+)?\s*$', line):
                                     # Arkime's reference to the PCAP directory