Capture stopped on Security Analytics server

Products

• Security Analytics
• Security Analytics - VA

Issue/Introduction

If the sensor stops capturing for some reason you may see "No Data" showing up in the GUI.  You might get an alert that capture has stopped.  

If you run "scotus stop" and then "scotus start" you may see the following message:

/bin/systemctl start  solera-captured
A dependency job for solera-captured.service failed. See 'journalctl -xe' for details.
scotus: command '/bin/systemctl start  solera-captured' failed with exit value '1'
root: scotus: command '/bin/systemctl start  solera-captured' failed with exit value '1'

Resolution

Here are some things to check to understand why capture has stopped.

1. Is the capture filesystem mounted?  Check with command:  df -h and look for /pfs
2. If there is attached external storage, check to make sure all volumes are ONLINE
3. Is 'solera-captured' running?  service solera-captured status
4. Is capture turned on for the desired interface?
5. Is there a problem with the upstream feed going to the server?

Generate a CSR (Customer Service Report) and open a support case for further analysis.