Connect the Packet Capture Module to Local Storage

Local storage allows you to store harvested PCAP Packet Capture. A file format that contains captured network packet data, typically used for network analysis and troubleshooting. files in a specific path on the endpoint itself. Use this storage type when you want harvested files to remain on the device rather than written to a cloud repository or network share.

A Local storage profile contains a Local Storage Path and an OS Family that specifies which endpoint operating systems the profile applies to. Local storage profiles appear only when you harvest from a device whose OS family matches the profile.

Prerequisites

Before you create a Local storage profile, ensure the target path is writable and that the partition has enough free space for harvested PCAP files. The path format must match the selected OS family:

• Windows: Use a drive-letter path (for example, C:\tmp).

• Linux: Use an absolute path starting with / (for example, /var/pcap-storage).

• macOS: Use an absolute path starting with / (for example, /var/pcap-storage).

Creating a storage profile for local storage

To create a Local storage profile:

1. Navigate to the PCM Page:

   1. Click the Launchpad button ⁝⁝⁝.

   2. Click Network Observability > Packet Capture.

2. Click the hamburger icon and select Packet Capture Configuration in the side bar.

3. Click the Storage Profile tab.

4. Click Create Storage Profile.

5. Enter a profile name.

6. Select Local Storage from the storage type dropdown.

7. Enter the Local Storage Path.

8. Select the OS Family for the target endpoints.

9. Click Save. Your Local storage profile is now set up. You can specify this storage profile for future harvest commands.

After a harvest completes, use the chain icon in harvest history to copy the target path to the clipboard. For more information, see Lists of Harvests.