Security Onion running out of space in the /nsm filesystems?
If you have insufficient space for Security Onion’s /nsm filesystems, then consider adjusting these parameters in the SOC (Administration > Configuration):
- pcap > config > maxdirectoryfiles
- Setting this value to roughly
144000files yields roughly 100 days of packet capture, although you milage may vary. Be prepared to lower or raise this value as needed. - The default value of
30000files amounts to approximately 21.4 days of packet capture for my use case. In other words, a yield of approximately 1401 files/day.
- Setting this value to roughly
- elasticsearch > index_settings > global_overrides > policy > phases > delete > min_age
- Set this value close to the number of days of packet capture, say
100d, and you should be good. Be prepared to lower or raise this value as needed.
- Set this value close to the number of days of packet capture, say
While here, if you adjust kratos > config > session > lifespan, only the following units are allowed:
h(hours)m(minutes)s(seconds)ms(milliseconds)us(microseconds)
If you specified 30d instead of the accepted 720h, hoping to achieve 30 days, to recover you must edit /opt/so/saltstack/local/pillar/kratos/soc_kratos.sls on the manager, and run sudo so-soc-restart, also on the manager.
Why anyone would use seconds, milliseconds, or even microseconds, be it on their own or combined with the larger units, remains a mystery.