SA Packet collection stops after 5 - 10 mins of service restart

[RonaldNgara]

Hi Guy

I am doing a new deployment of Security Analytics which has 4 appliances, a decoder, concentrator, hybrid and SA server with broker. I upgraded the appliances from 10.5 to 10.5.1 then finally to 10.5.1.2. Collection on the decoders stops after about 5 - 10 minutes of service restart. So if I restart the service every 20 minutes I will have data every time. At times collection can start on its own hours later and stop again. I have checked everything. In case you are wondering yes, all services are set to auto start.

[DavidPoirier]

Hi Ronald,

At the 5-10 minute mark, do you see any message in the /var/log/messages that indicate why the service stops.

It should read something like “ Capture is stopping “

On the decoder configuration > what is your capture interface?