[Oisf-users] change destination of pcap files

erik clark philosnef at gmail.com
Tue Feb 21 13:11:17 UTC 2017

I am trying to change the location of the pcap files being generated on
alert to


Also, I cant seem to capture this anyway. I have

- eve-log:
       - alert:
            packet: yes

but I see nowhere that the files are being captured. Please advise what I
did wrong. Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20170221/a6364528/attachment.html>

More information about the Oisf-users mailing list