When additional Capture Interface(s) are enabled beyond the allowed, licensed amount in Security Analytics, you might not be able to start capturing on the new interface(s). In the Web UI, it fails with Error starting capture. The syslog shows license interface count (x) exceeded
[[email protected] log]# tail -f messages | grep -i license
Jul 13 15:30:44 sensor9 kernel: : solera: license interface count (4) exceeded
Jul 13 15:30:51 sensor9 kernel: : solera: license interface count (4) exceeded
Prior to July 2016, Blue Coat imposed a limit on the number of usable Capture Interfaces for each model of Security Analytics.
This limit has since been lifted to allow more Capture Interfaces to be used. Although additional Capture Interfaces are permitted, System Administrators should still ensure that the Security Analytics operates within its designed capacity.
The license should be downloaded and applied again on the Security Analytics appliance.