Daily packet capture limit

[indevis]

Hello everybody,

can somebody tell me, what this log entry means.

And is it possible to change this limit?

Apr  8 19:24:26

19:24:26,,SYSTEM,general,0,2011/04/08

19:24:26,,general,,0,0,general,high,"Daily packet capture limit (directory threat/20110408\, limit 131072) has been reached."

Reagrds

Christian

[skrall]

Christian,

There is no way to change the limit. Most likely there is not much value here either. You are probably capturing the same packet multiple times as the threat tries repeatedly to to contact its endpoint. It is time to start tuning your firewall and get selective about what you actually log.

Steve Krall

[ikinnexi]

Hi Steve,

I got the same error message.

I will investigate to see what we can not do a packet capture on.

How long is the packet captures retained in the Palo Alto Device? Daily?

Can you confirm? I will look at the documentation as well to see.

Thanks.

Brian