6.7

Table Of Contents
c Make the following changes.
<config>
<packetCapture>
<enabled>true</enabled>
d (Optional) Configure PacketCapture options.
Option and Default Value Description
<validity>72</validity>
On startup delete all pcap and pcap.gz files that were last modified before the
specified period of hours and are not part of the current process.
<directory>/directory_path</directory>
The directory in which pcap and pcap.gz files are stored. The directory must
exist and be accessible.
<maxDataInPcapFile>52428800</maxDataInPcapFile>
The amount of captured data in bytes that each pcap and pcap.gz file can
store before rolling over to the next file. The minimum size is 5 MB on
vCenter Server Appliance and 2.5MB on ESXi.
Note Storing 50 MB of captured data in a pcap file requires a pcap file of
about 67.5 MB.
<maxPcapFilesCount>5</maxPcapFilesCount>
The number of pcap or pcap.gz files to rotate. The minimum number is 2.
e Save and close the config.xml file.
f Reload the config.xml file by running the following command.
kill -SIGHUP `pidof rhttpproxy`
2 Stop capturing packets.
a Open an SSH connection and log in to the ESXi host or vCenter Server Appliance.
b Open the config.xml file for editing.
c Make the following changes.
<config>
<packetCapture>
<enabled>false</enabled>
d Save and close the config.xml file.
e Reload the config.xml file by running the following command.
kill -SIGHUP `pidof rhttpproxy`
3 Collect the captured data.
The pcap or pcap.gz files are stored in the following default directories.
vSphere Component File Location
ESXi
/var/run/log
vCenter Server Appliance
/var/log/vmware/rhttpproxy
vSphere Networking
VMware, Inc. 206