Use system global instead of hard-coded /tmp path.
Remove pcap logs over configured max_files limit.