Packet capture stops automatically

[Adrian_Jensen]

Is there any way to force Packet Capture to run for extended lengths? Since 11.1 PaloAlto has changed the underlying config and now forces packet capture to automatically end after 60 seconds. It's like no one at PaloAlto has ever used packet capture or had to track down an intermittent problem.

The time limit can partially be increased with the "debug dataplane packet-diag set log timeout <sec>" command, but it has a max limit of 3600sec. How do I make it run for hours?

[JayGolf · Accepted solution]

Hi @Adrian_Jensen ,

If you set the timeout to 0,  the logging timeout will be disabled. Don't forget to revert it or turn it off completely. 

debug dataplane packet-diag set lof timeout 0

[Adrian_Jensen]

@JayGolf - It doesn't work. With timeout set at both 3600 (1 hour) and 0, packet captures arbitrarily stop after a random period of time. A dozen packet captures over 4 hours, all automatically stopped between 3min and 24min into the capture. Any timeout of your user, or when switching between different status pages in the web GUI (i.e. you need to watch Traffic logs and current Sessions to know when the desired event has occured), the packet capture will stop. Makes it impossible to do long-term packet captures for intermittent events.

I just did another packet capture, lasted less than 14min before arbitrarily ending while I looked at System logs for corresponding events: 

debug dataplane packet-diag set log timeout 0

Logging
  Enabled:                   no
  Log-throttle:              no
  Sync-log-by-ticks:         yes
  Features:
  Counters:
  Timeout duration:          Never
  Buffer threshold:          80%
  CPU threshold:             80%

capture start: 10:34:56

capture end (uncommanded): 10:48:09

total capture size: 3.3MB

Never timed out as user/closed window/etc., viewing Traffic and System logs, Dataplane CPU never exceeded 11%

System log on arbitrary packet capture end:

2026/10/20 10:48:10 debug informational packet-diag-log "Packet-diag logging is disabled"

 packet-diag settings:

--------------------------------------------------------------------------------
Packet diagnosis setting:
--------------------------------------------------------------------------------
Packet filter
  Enabled:                   yes
  Match pre-parsed packet:   no
  Filter offload:            yes
  Index 1: 0.0.0.0/32[0]->XXX.XXX.XXX.XXX/32[0], proto 0
           ingress-interface any, egress-interface any, exclude non-IP
--------------------------------------------------------------------------------
Logging
  Enabled:                   no
  Log-throttle:              no
  Sync-log-by-ticks:         yes
  Features:
  Counters:
  Timeout duration:          Never
  Buffer threshold:          80%
  CPU threshold:             80%
--------------------------------------------------------------------------------
Packet capture
  Enabled:                   no
  Snaplen:                   0
  Username:
  Stage receive           :  file XXXXX_154.17.pcap
    Captured:     packets - 4471       bytes - 1622904
    Maximum:      packets - 0          bytes - 0
  Stage transmit          :  file XXXXX_154.17.pcap
    Captured:     packets - 4471       bytes - 1617660
    Maximum:      packets - 0          bytes - 0
--------------------------------------------------------------------------------