Article Number
000001021
Applies To
RSA Product Set: NetWitness Platform
RSA Product/Service Type: Admin
RSA Version/Condition:11.3.x and later version
Issue
Sometimes you need to cancel the Jobs when you export a huge PCAP file as it spends too much time. In this case, You can see the PCAP files in "/var/lib/netwitness/uax/temp" like the following screenshots. However, even if you delete these extract pcap Jobs on UI, the PCAP files are not deleted from "/var/lib/netwitness/uax/temp". It might be an impact to partition usage.
Resolution
This is function as design.
Even if you delete these extract pcap Jobs on UI, the PCAP files are not deleted from "/var/lib/netwitness/uax/temp". However, You can simply delete these PCAP files from command line without any issue if the partition has not enough available size.
