Artica PCAP filter daemon
Daemon mode lets you manage the process in the background
When using daemon mode, the process ensures automatic database updates and the ability to send events via syslog.
Set Daemon mode
The token -daemon allows the process to switch to daemon mode.
The process will write its PID to the /var/run/articapsniffer.pid file
To turn off daemon mode, use the token -disable-daemon
Set the update schedule
By default, in daemon mode, updates are checked every hour, but you can change this frequency.
The token -update-schedule [minutes] changes the interval between checks.
Daemon status (1.0.28)
The token -status allows you to get the daemon status and all saved parameters
Reload the Daemon
To reload the daemon, which means flushing memory caches and reloading the source databases in memory, use the token -reload
Get daemon statistics (1.0.28)
When running kill -USR1 [pid], Artica PCAP filter will write statistics in the events log
Example:
{"level":"info","time":1690675847,"message":"Statistics: Number of captured packets: 0"}
{"level":"info","time":1690675847,"message":"Statistics: Number received syslog messages: 10353"}
{"level":"info","time":1690675847,"message":"Statistics: Number received Fortinet syslog messages: 10295"}
{"level":"info","time":1690675847,"message":"Statistics: Number of bad addresses found: 35"}