google/stenographer

Feature Request: Option to run with disabled stenotype

dcode opened this issue · 2 comments

dcode commented

It would be helpful to have a configuration option that disables stenotype altogether. This would allow the stenographer server to run and serve an existing database to clients, which is useful for testing (e.g really helps with memory allocation in API testing) or to serve an existing PCAP library that is no longer collecting. I would think this would prevent old PCAP from ageing off since no new files would be created.

This would be a really useful configuration option since we have been using Stenographer to collect PCAP, then later on export it for training. I have been paranoid about the potential for aging off the old PCAP when having multiple operators work with the old data.

Although not officially supported, it is actually quite simple to achieve by replacing stenotype with any dummy process in your configuration, ie:

/usr/bin/stenofake

#!bin/bash
tail -f /dev/null

/etc/stenographer/config

...
 "StenotypePath": "/usr/bin/stenofake"
...