Calculate the rate of dating hitting HDFS. Should roughly match the incoming packet rate.
hadoop fs -ls /apps/metron/pcap | awk '{sum += $5} END { print sum}' && \
sleep 60 && \
hadoop fs -ls /apps/metron/pcap | awk '{sum += $5} END { print sum}'
Are the pcap files rolling correctly?
hdfs dfs -ls -r -t /apps/metron/pcap | grep "2017-05-17" | awk -F" " '{print $7}' | sort -n | uniq -c