Packet Capture stopped working

[JoergK]

Hi,

the last days I did some captures on a PA-2020. At Yesterday I tried again but it doesn't work anymore. Tried via WebGUI and CLI.
If I start the capture it is shown running but no files are created. PAN-OS is 4.1.12.

Does anybody know this issue? Can it get fixed without restarting dataplane or device?

Thanks

Jörg

[sdurga]

Try clearing all the Packet capture settings to default and set the filters and the capture files new again.

You can clear all the Packet capture settings using the command "debug dataplane packet-diag clear all "

Tx,

Sandeep

[sraghunandan]

Can you see packet count incrementing  for you capture stages , use this command to verify the same

debug dataplane packet-diag show setting

[JoergK]

Hi sdurga,

already tried this. Didn't fix the problem.

Thx

Jörg

[JoergK]

Hi sraghunandan,

the capture seems to work:

PAGATE> debug dataplane packet-diag show setting

Packet capture

  Enabled:                   yes

  Snaplen:                   0

  Stage firewall          :  file firew

    Captured:     packets - 70041      bytes - 41621506

    Maximum:      packets - 0          bytes - 0

But no files are generated:

FW-PAGATE> view-pcap follow yes filter-pcap

  <No files available>  Directory is empty

Thx

Jörg

[kdd]

Hi Joergk,

how long is the name of the interface? we use panos 5.0.3  with 5020 and capturing doesn't work because of long if-name. instead of eth1/3.4040 it will be shortened to eth1/3.404

Maybe it is the same problem.

Regards Klaus

[JoergK]

Thx Klaus,

good to know! And really poor if length of IF name causes issues in further releases :smileyconfused:

But in my case it already worked.

[sraghunandan · Accepted solution]

can try the following

> debug software restart vardata-receiver

wait for some time and see if it fixes it.

[cchristiansen]

Hello Joergk,

I believe that Klaus may be correct.  This sounds very similar to a known issue.  You should open a case with support so that they can investigate.

-chadd.

[JoergK]

Hi sraghunandan,

> debug software restart vardata-receiver

fixed the problem

Thx

Jörg