How to handle PCAP files on /var/lib/netwitness/uax/temp in RSA NetWitness Platform

Issue

Sometimes you need to cancel the Jobs when you export a huge PCAP file as it spends too much time. In this case, You can see the PCAP files in "/var/lib/netwitness/uax/temp" like the following screenshots. However, even if you delete these extract pcap Jobs on UI, the PCAP files are not deleted from "/var/lib/netwitness/uax/temp". It might be an impact to partition usage. 

Resolution

This is function as design.
Even if you delete these extract pcap Jobs on UI, the PCAP files are not deleted from "/var/lib/netwitness/uax/temp". However, You can simply delete these PCAP files from command line without any issue if the partition has not enough available size.

Product Details

RSA Product Set: NetWitness Platform
RSA Product/Service Type: Admin
RSA Version/Condition:11.3.x and later version

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue