Imperva Cyber Community

communities_1.jpg
 View Only
  • 1.  Agent disk quota has exceeded the configured quota

    Posted 09-23-2020 07:29
    Hello,

    The agent which is installed on some of our Application Servers produce a large number of pcap files.
    As a consequence , I get all the time the following message:

    "Agent disk quota has exceeded the configured quota (90%)"

    My questions are the following:

    1. Why do these pcap files get produced ? Is there a setting so that I can disable them ?
    2. How can I configure the quota which by default is 90% ? Can I do this via the Advanced configuration which is xml based ?

    Regards.
    #DatabaseActivityMonitoring

    ------------------------------
    Nikolaos Liakopoulos
    Athens
    ------------------------------


  • 2.  RE: Agent disk quota has exceeded the configured quota

    Posted 09-23-2020 10:02
    Hello,

    Mostly based on knowledge base articles and my experience:

    PCAPs are created by the Remote Agent on the database server if the connectivity to the gateway is dropped.Once the limit is reached no new data will be recorded. Once the connectivity is up, the Remote Agent will send those PCAPs to the gateway and resumes to work normally. After the PCAPs are sent to the gateway they are erased from the database server.

    Do you have any connectivity issues? Or maybe you can try to tune your audit policies.

     In the Main workspace, click Setup > Agents > Setting > General Setting > Advanced Configuration  what value do you have in <quota></quota> tags?


    ------------------------------
    Sabajete Elezaj
    SNT Albania
    ------------------------------



  • 3.  RE: Agent disk quota has exceeded the configured quota

    Posted 09-24-2020 02:52
    First and foremost I would like to thank you for your prompt response.

    Indeed with regard to the agents that produce the pcap files, there are connectivity issues.
    I haven't  configured any threshold in the advanced configuration, but I suppose that the default is 90%. (see photo)

    What value can I place inside the <quota></quota> tags ? Will it a percentage value OR a MB value ? 
    Also, is there a way to disable completely the pcap files that get produced ?
    Can you refer me to any imperva documentation
    Agent Logs
    Thank you very much !


    ------------------------------
    Nikolaos Liakopoulos
    Athens
    ------------------------------



  • 4.  RE: Agent disk quota has exceeded the configured quota

    Posted 09-24-2020 04:42
    Hello, 

    Default value of <quota> tags is 8000 which is equal to 8GB. You should look your configured value in Setup > Agents > Setting > General Setting > Advanced Configuration.
    I do not have information on how to disable pcaps being created, but if you do disable that means your application/database won't be audited when connectivity with the gateway is lost.
    If you just want to not receive this alert you can configure <system-events-disk-quota-enable> parameters, but this means still pcaps will be created but you wont be notified.

    ------------------------------
    Sabajete Elezaj
    SNT Albania
    ------------------------------



  • 5.  RE: Agent disk quota has exceeded the configured quota

    Posted 09-28-2020 14:27
    If your server is having issues sending the pcap files, then creating a smaller sized file may help.
    The default size for the pcap files is 1gb.   

    I have used <max-file-size-mb>512</max-file-size-mb> in a couple of agents that were giving me disk quota errors.


  • 6.  RE: Agent disk quota has exceeded the configured quota

    Posted 02-03-2022 01:17

    Hello,

    Please let me know which directory stores pcap file and if i want to delete it from server end, then which directory & files i have to delete to increase the disk space.

    Thanks & Regards,
    Bachchulal Varma
    NPCI



    ------------------------------
    Endpoint Team
    Deputy Manager
    NPCI
    Mumbai
    ------------------------------