The content you are looking for has been archived. View related content below.
How to handle PCAP files on "/var/lib/netwitness/uax/temp" in RSA NetWitness Platform
RSA Product Set: NetWitness Platform RSA Product/Service Type: Admin RSA Version/Condition:11.3.x and later version
Sometimes you need to cancel the Jobs when you export a huge PCAP file as it spends too much time. In this case, You can see the PCAP files in "/var/lib/netwitness/uax/temp" like the following screenshots. However, even if you delete these extract pcap Jobs on UI, the PCAP files are not deleted from "/var/lib/netwitness/uax/temp". It might be an impact to partition usage.
This is function as design. Even if you delete these extract pcap Jobs on UI, the PCAP files are not deleted from "/var/lib/netwitness/uax/temp". However, You can simply delete these PCAP files from command line without any issue if the partition has not enough available size.