Configuring Local PCAP File Ingestion from a Directory

The configure local PCAP file ingestion from a directory, take the following steps:

Update the phoenix_config file.

1. Go to /opt/phoenix/config/.
2. Edit the /opt/phoenix/config/phoenix_config.txt file as follows:
   Change:
   # FSM upgrade preserves customer changes to parameter value
pcap_file_directory= #/opt/phoenix/cache/PCAP
   to
   # FSM upgrade preserves customer changes to parameter value
pcap_file_directory=/opt/phoenix/cache/PCAP
3. Save the file.
4. Create and chown the directory by running the following commands.
   [root@fortisiem ~]# mkdir /opt/phoenix/cache/PCAP
[root@fortisiem ~]# chown admin:admin /opt/phoenix/cache/PCAP
5. Restart the application processes to read the configuration changes using the following commands. Note that this will cause a few minutes interruption to event processing, resulting in new events received being lost as the phParser process is restarted.
   [root@fortisiem PCAP]# phtools --stop phParser
[root@fortisiem PCAP]# phtools --start phParser
6. Copy the .pcap file to the directory /opt/phoenix/cache/PCAP, using SCP or SFTP to copy the PCAP file to the directory. Note: the file will be deleted once ingested, keep another copy if required.
7. Search for the PCAP data by performing an Analytics query for 'Event Type = PH_DEV_MON_PCAP_DATA'. PCAP data is written as JSON formatted events with event type PH_DEV_MON_PCAP_DATA. Various attributes are also parsed, and can be used in advanced queries.