Always-On SPAN to file functionalities

These are the key functionalities of Always-On SPAN to file:

• Default SPAN enablement: Enables a default SPAN to-file session for packet forwarding and buffer drops automatically, provided the platform supports it. The session is always active and periodically writes to the disk without stopping the capture, up to the maximum configured storage capacity limit. This functionality ensures continuous packet capture and storage.

  You can disable this session if it’s not needed using the monitor-session default-capture-disable command.

• SPAN truncation and sampling: Allows for packet truncation and sampling for software-mirrored packets like SPAN to file, even if hardware support isn't available. This functionality enhances flexibility by enabling these operations within the software.

• Always-on SPAN to file: Automatically starts packet capture when the file destination is configured, without requiring additional action commands. This functionality ensures immediate and continuous packet capture.

  Use the destination file always-on command in monitor-session configuration mode to enable always-on packet capture.

• SPAN to file continuous capture: Provides the ability to write packet data to a file without stopping the ongoing packet capture. This capability ensures uninterrupted packet monitoring and data collection.

  Use the monitor-session <session name> packet-collection write [directory <dir>] [filename <file>] command to write the current packet buffer to a file without stopping packet collection. If you don't use the optional keywords directory and filename, the system writes the buffer contents to a file named <session_name>_<node location>_<timestamp>.pcap in a default capture directory.

• SPAN periodic file writing: Allows you to set a period after which the buffered SPAN to file packet data is automatically written to a file. This automatic writing prevents data loss if there is a system reload and ensures persistent storage of captured packets. The feature includes configurable limits to manage file storage effectively, ensuring user-written files remain intact and session-specific data management doesn't impact other sessions.

  Use the destination file [size <kbytes>] [always-on [periodic-write <secs> [capacity [<num> <kB|MB|GB>]]] command in monitor-session configuration mode to set the file writing interval.

  When the periodic-write option is used, the contents of the buffer are written to a file named <session_name>_<node location>_<timestamp>.pcap, in a default capture directory /misc/scratch/SPAN/<node>/.

Storage capacity management and file retention rules

There are two configurable capacity options to manage the periodically written files.

• A per-session limit: The maximum storage capacity for the set of files captured periodically for an individual monitor session. When this limit is exceeded, the system automatically deletes the oldest files to make room for new ones. Depending on the newer file size, it may delete multiple older files. In cases where only a single file is captured, the file is written completely, even if its size exceeds the per-session capacity limit. The file remains stored until another file is captured for that session.

  When a new file is significantly larger than the previous captures, the system may delete all existing files, leaving only the new file. This ensures that the new file is saved in its entirety without any truncation.

  Use the destination file [capacity <num> <kB|MB|GB>] command to configure the per-session capacity limit.

• A global limit: The total storage capacity for all files captured by SPAN on disk. If this limit is exceeded, further write operations don’t happen. Stopping the write operation without deleting files protects periodic and user-triggered writes in the default directory that remain unmoved or uncleared, regardless of session.

  Use the monitor-session local-capture-capacity <num> <kB|MB|GB> command to configure the global capacity limit.

  Note

  This capacity limit configuration applies only to files written in the default directory. Any files moved out of the default directory don't count toward this limit.

If you don't configure these capacity parameters, the system uses default values specific to the platform variant to manage storage capacity.