"Error starting capture" with Security Analytics due to license interface count exceeded


Article ID: 169130


Updated On:


Security Analytics


When additional Capture Interface(s) are enabled beyond the allowed, licensed amount in Security Analytics, you might not be able to start capturing on the new interface(s). In the Web UI, it fails with Error starting capture. The syslog shows license interface count (x) exceeded

[[email protected] log]# tail -f messages | grep -i license
Jul 13 15:30:44 sensor9 kernel: : solera:  license interface count (4) exceeded
Jul 13 15:30:51 sensor9 kernel: : solera:  license interface count (4) exceeded



Prior to July 2016, Blue Coat imposed a limit on the number of usable Capture Interfaces for each model of Security Analytics.

This limit has since been lifted to allow more Capture Interfaces to be used. Although additional Capture Interfaces are permitted, System Administrators should still ensure that the Security Analytics operates within its designed capacity.


The license should be downloaded and applied again on the Security Analytics appliance.
  1. Locate your 12-digit License Key.
  2. Download the DSSEED file from the Web UI under Settings > About > License Details > Download DS Seed.
  3. Go to https://license.soleranetworks.com/
  4. Provide your DSSEED file and 12-digit License Key to download the updated License file that allows the use of additional Capture Interfaces.
  5. Upload the updated License file to the same location in Step 2.
  6. The Security Analytics will reboot after the license is applied.