---
title: "Rotate PCAP Delete"
slug: "feature-push-pcap-automatic-delete"
updated: 2026-07-30T08:59:47Z
published: 2026-07-30T08:59:47Z
canonical: "docs.fmad.io/feature-push-pcap-automatic-delete"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fmad.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate PCAP Delete

FW:10280+

The FMADIO Push PCAP function is a great way to export data to downstream systems. However where the PCAP is transferred to (remote or local) the disk storage can end up consuming and filling up the entire drive.

By default FMADIO does not rotate the files or manage the size of the directory. Typically its the downstream application which will monitor and delete files appropriately, e.g. when the PCAP has been successfully transferred off the system, it can be deleted.

In some cases its preferred the FMADIO system will delete these PCAPs. This example shows how to configure automatic deletion of PCAP files.

## Step 1) Create a configuration file

Create a configuration file in

`/opt/fmadio/etc/pcap_rotate.lua`

This specifies the directory and maximum file size of all data in that directory. An example is shown below

```lua
local Config = {}

-- list directories to cycle
table.insert(Config,
{
        Path = "/mnt/remote0/pcap/",
        MaxByte = 1e12,
})

return Config
```

In the above example, the system will monitor the contents of `/mnt/remote0/pcap` and ensure the maximum directory size does not exceed 1TB (1e12 bytes).

This path could be a remote NFS path (such as above) or a local path such as `/mnt/store1/pcap` on the system itself.

Multiple directories can be specified with different maximum byte sizes.

## Step 2) Confirm no syntax errors in configuration file

To confirm the syntax of the configuration file run

`fmadiolua /opt/fmadio/etc/pcap_rotate.lua`

A correct output looks like the following below

```plaintext
fmadio@fmadio20v2-149:~$ fmadiolua /opt/fmadio/etc/pcap_rotate.lua
fmad fmadlua Nov 18 2024 (fmadiolua /opt/fmadio/etc/pcap_rotate.lua )
Cycles/Sec 2100010596.0000 Std:       0 cycle std(  0.00000000) Target:2.10 Ghz
failed to open self? [fmadiolua]
done 0.000046Sec 0.000001Min
fmadio@fmadio20v2-149:~$
```

## Step 3) Enable on the scheduler

Enable the rotation in the GUI as follows, see the row highlighted in red. Analytics Engine is

`pcap_rotate`

![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/image(49).png?sv=2026-02-06&spr=https&st=2026-11-01T13%3A11%3A12Z&se=2026-11-01T14%3A11%3A12Z&sr=c&sp=r&sig=3MQjdTEBv%2BaTqDDBaSoNJH6l7YuBLXSImrbV%2FaxOHjs%3D)

In this example its run 24/7

## Step 4) Finish

System will now monitor the directory and try maintain the target disk usage

---

## Debug

### Logfiles

Debug logs can be found in the following location

```plaintext
/mnt/store0/log/analytics_pcap_rotate.cur
```

### Lock file Stale

The pcap_rotate script checks a lock file exists before running, this prevents multiple instances of the script running simultaniously

Lock file is located in

```plaintext
/var/run/fmadio_pcap_rotate
```

Symptom of the problem is

- files are not being deleted correct / the disks ends up full
- The log file above shows

```plaintext
fmad fmadlua Nov 12 2025 (/opt/fmadio/bin/fmadiolua /opt/fmadio/analytics/pcap_rotate.lua )
pcap rotate already running
```

1. Check the script is not running

```plaintext
ps aux | grep pcap_rotate.lua
```
2. Delete the stale lock file

```plaintext
sudo rm /var/run/fmadio_pcap_rotate
```
3. Confirm the script runs correctly. It runs off a 60sec cron job, it may take up to 1 min for new log entries to show

```plaintext
tail -F /mnt/store0/log/analytics_pcap_rotate.cur
```

FMADIO Packet Capture systems provide a built-in PCAP Push feature to transfer captured PCAP data on a regular schedule to a remote system or local Scratch Disk.