[Oisf-users] change destination of pcap files

[erik clark]

I am trying to change the location of the pcap files being generated on
alert to

/opt/suricata/var/pcap

Also, I cant seem to capture this anyway. I have

- eve-log:
    types:
       - alert:
            packet: yes

but I see nowhere that the files are being captured. Please advise what I
did wrong. Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20170221/a6364528/attachment.html>