Instead of watching for closed files in the capture directory, assuming
capture is moving files into a process directory, so watch for that
event instead. When you see a moved event, process all files in the
process directory; accumulator assumes that files are moved atomically
(meaning they came from the same file system, likely tmpfs).

accumulator unlinks visited files in the process directory. It has a
simple safety check looking for the string "pcap" somewhere in the
filename before unlinking.