From d77556c6729aac42d9d0cdd05cf9b632ed18365a Mon Sep 17 00:00:00 2001
From: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Date: Thu, 21 Aug 2025 08:25:48 -0500
Subject: [PATCH] pcap dir

---
 salt/pcap/init.sls | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/pcap/init.sls b/salt/pcap/init.sls
index dffeac85c..6812c2d91 100644
--- a/salt/pcap/init.sls
+++ b/salt/pcap/init.sls
@@ -23,7 +23,7 @@ include:
 # /nsm/pcap is empty until stenographer is used as pcap engine
 {% set pcap_id = 941 %}
 {% set user_list = salt['user.list_users']() %}
-{% if 'stenographer' not in user_list %}
+{% if GLOBALS.pcap_engine == "SURICATA" and 'stenographer' not in user_list %}
 {%   set pcap_id = 939 %}
 {% endif %}
 pcapdir: