Packet capture stops automatically

Adrian_Jensen — Mon, 19 Oct 2026 18:52:04 GMT

Is there any way to force Packet Capture to run for extended lengths? Since 11.1 PaloAlto has changed the underlying config and now forces packet capture to automatically end after 60 seconds. It's like no one at PaloAlto has ever used packet capture or had to track down an intermittent problem.

The time limit can partially be increased with the "debug dataplane packet-diag set log timeout <sec>" command, but it has a max limit of 3600sec. How do I make it run for hours?

Re: Packet capture stops automatically

JayGolf — Tue, 20 Oct 2026 04:07:07 GMT

Hi @Adrian_Jensen ,

If you set the timeout to 0, the logging timeout will be disabled. Don't forget to revert it or turn it off completely.

debug dataplane packet-diag set lof timeout 0

Re: Packet capture stops automatically

Adrian_Jensen — Tue, 20 Oct 2026 18:55:12 GMT

@JayGolf - It doesn't work. With timeout set at both 3600 (1 hour) and 0, packet captures arbitrarily stop after a random period of time. A dozen packet captures over 4 hours, all automatically stopped between 3min and 24min into the capture. Any timeout of your user, or when switching between different status pages in the web GUI (i.e. you need to watch Traffic logs and current Sessions to know when the desired event has occured), the packet capture will stop. Makes it impossible to do long-term packet captures for intermittent events.

I just did another packet capture, lasted less than 14min before arbitrarily ending while I looked at System logs for corresponding events:

debug dataplane packet-diag set log timeout 0

Logging Enabled: no Log-throttle: no Sync-log-by-ticks: yes Features: Counters: Timeout duration: Never Buffer threshold: 80% CPU threshold: 80%

capture start: 10:34:56

capture end (uncommanded): 10:48:09

total capture size: 3.3MB

Never timed out as user/closed window/etc., viewing Traffic and System logs, Dataplane CPU never exceeded 11%

System log on arbitrary packet capture end:

2026/10/20 10:48:10 debug informational packet-diag-log "Packet-diag logging is disabled"

packet-diag settings:

-------------------------------------------------------------------------------- Packet diagnosis setting: -------------------------------------------------------------------------------- Packet filter Enabled: yes Match pre-parsed packet: no Filter offload: yes Index 1: 0.0.0.0/32[0]->XXX.XXX.XXX.XXX/32[0], proto 0 ingress-interface any, egress-interface any, exclude non-IP -------------------------------------------------------------------------------- Logging Enabled: no Log-throttle: no Sync-log-by-ticks: yes Features: Counters: Timeout duration: Never Buffer threshold: 80% CPU threshold: 80% -------------------------------------------------------------------------------- Packet capture Enabled: no Snaplen: 0 Username: Stage receive : file XXXXX_154.17.pcap Captured: packets - 4471 bytes - 1622904 Maximum: packets - 0 bytes - 0 Stage transmit : file XXXXX_154.17.pcap Captured: packets - 4471 bytes - 1617660 Maximum: packets - 0 bytes - 0 --------------------------------------------------------------------------------

topic Packet capture stops automatically in General Topics

Packet capture stops automatically

Re: Packet capture stops automatically

Re: Packet capture stops automatically