"Error starting capture" with Security Analytics due to license interface count exceeded

book

Article ID: 169130

calendar_today

Updated On:

Products

Security Analytics

Issue/Introduction

When additional Capture Interface(s) are enabled beyond the allowed, licensed amount in Security Analytics, you might not be able to start capturing on the new interface(s). In the Web UI, it fails with Error starting capture. The syslog shows license interface count (x) exceeded

[[email protected] log]# tail -f messages | grep -i license
Jul 13 15:30:44 sensor9 kernel: : solera:  license interface count (4) exceeded
Jul 13 15:30:51 sensor9 kernel: : solera:  license interface count (4) exceeded


 

Cause

Prior to July 2016, Blue Coat imposed a limit on the number of usable Capture Interfaces for each model of Security Analytics.

This limit has since been lifted to allow more Capture Interfaces to be used. Although additional Capture Interfaces are permitted, System Administrators should still ensure that the Security Analytics operates within its designed capacity.

Resolution

The license should be downloaded and applied again on the Security Analytics appliance.
  1. Locate your 12-digit License Key.
  2. Download the DSSEED file from the Web UI under Settings > About > License Details > Download DS Seed.
  3. Go to https://license.soleranetworks.com/
  4. Provide your DSSEED file and 12-digit License Key to download the updated License file that allows the use of additional Capture Interfaces.
  5. Upload the updated License file to the same location in Step 2.
  6. The Security Analytics will reboot after the license is applied.