topic Daily packet capture limit in General Topics

Daily packet capture limit

indevis — Mon, 11 Apr 2011 11:19:35 GMT

Hello everybody,

can somebody tell me, what this log entry means.

And is it possible to change this limit?

Apr 8 19:24:26

19:24:26,,SYSTEM,general,0,2011/04/08

19:24:26,,general,,0,0,general,high,"Daily packet capture limit (directory threat/20110408\, limit 131072) has been reached."

Reagrds

Christian

Re: Daily packet capture limit

skrall — Thu, 14 Apr 2011 18:32:07 GMT

Christian,

There is no way to change the limit. Most likely there is not much value here either. You are probably capturing the same packet multiple times as the threat tries repeatedly to to contact its endpoint. It is time to start tuning your firewall and get selective about what you actually log.

Steve Krall

Re: Daily packet capture limit

ikinnexi — Tue, 24 Apr 2012 17:00:38 GMT

Hi Steve,

I got the same error message.

I will investigate to see what we can not do a packet capture on.

How long is the packet captures retained in the Palo Alto Device? Daily?

Can you confirm? I will look at the documentation as well to see.

Thanks.

Brian