Sensor is not capturing any traffic

Products

• Security Analytics

Issue/Introduction

The Security Analytics sensor is no longer capturing traffic.

Resolution

If the Security Analytics sensor is no longer capturing traffic, it can be caused by any number of things.  The most common are:

1. The traffic has stopped somewhere upstream
2. The capture filesystem is unhealthy.  Usually caused by a failed volume or failed hard drives.
3. The sensor is not licensed properly.

Check /var/log/messages for any errors about either licenses or pfs not being mounted or the 'captured' service not running.  Contact technical support for further assistance.