If you do not want Passive Capture to use that directory, then use the following steps. The steps configures the logfile directory to be /var/tealeaf.

• Perform all the steps as user root.
• These steps assume that Passive Capture is already installed into /usr/local/ctccap.

1. Stop all Passive Capture daemons:

   
   tealeaf stop
   tealeaf stop failoverd
   

2. Create the directory, if it does not exist, and assign its ownership and permissions.

   
   mkdir /var/tealeaf
   chmod u=rwx,go= /var/tealeaf
   chown ctccap:ctccap /var/tealeaf
   

   A long listing of just the directory must produce the following results:

   
   # ls -ld /var/tealeaf
   drwx------    2 ctccap   ctccap       4096 Sep  6 14:41 /var/tealeaf
   

   Note: The group ctccap was introduced in build 3101.
3. Create empty logfiles. You can use tealeaf initlogs. If that command is not available in the version you are running, you must create at least the capture.log file by using the following commands:

   
   touch /var/tealeaf/capture.log
   chmod u=rw,go= /var/tealeaf/capture.log
   chown ctccap:ctccap /var/tealeaf/capture.log
   

   A long listing of the directory must produce the following results:

   
   # ls -l /var/tealeaf
   total 0
   -rw-------    1 ctccap   ctccap          0 Sep  6 14:42 capture.log
   
   

   You can optionally chose to copy all your existing logfiles from /var/log/tealeaf to the new directory.

4. Edit the syslog daemon configuration file: /etc/syslog.conf. Replace the line for local0 from :

   
   local0.* -/var/log/tealeaf/capture.log
   

   with this code:

   
   local0.* -/var/tealeaf/capture.log
   

5. Restart the syslog daemon:

   
   /etc/init.d/syslog stop
   /etc/init.d/syslog start
   

   On Red Hat systems, you can use:

   
   service syslog stop
   service syslog start
   

6. Edit file /usr/local/ctccap/etc/runtime.conf, which is used by the Passive Capture. Remove any existing variable definition for logfiledir and add the following line:

   
   logfiledir="/var/tealeaf"
   

7. Start the Passive Capture daemons:

   
   tealeaf start failoverd
   tealeaf start
   

If you look at /var/tealeaf/capture.log, you'll see messages from Passive Capture starting.

All of the above steps are based on the processing for configuration variable logfiledir performed by the post-installation script postinstallimp.sh in the Passive Capture distribution (in the sbin subdirectory).