Double imports when restarting Malcolm

[KchChr]

When restarting Malcom (./scripts/stop ./scripts/start) or rebooting the VM, Malcolm reimports all files in the pcap/processed folder and they appear double in the arkime - files view.

To reproduce: restart Malcolm. This behaviour appears everytime Malcolm restarts or the VM restarts.

I was not able to find an „expect behaviour“.

Malcolm version 24.03.0

I am running Malcolm by cloning the Git Repo on a Debian 12 VM airgapped

[mmguero]

Hm, there's supposed to be a check against the arkime files database that prevents that from happening, I'll have to look into that. In the meantime, try this:

• PCAP_PIPELINE_IGNORE_PREEXISTING in config/upload-common.env
• EXTRACTED_FILE_IGNORE_EXISTING in config/zeek.env

Set those values to true and restart Malcolm and see how that goes.

[KchChr]

This worked. I assume this is a workaround?

Thank you for the fast answer.
Have a nice weekend!

[mmguero]

Yes, this is a workaround, but like I said it should have prevented that with the files database check I mentioned, so I'll leave this bug open to try to figure that out.