Packet Capture can't be started

[lukral]

Recently all configured packet capture (in GUI) somehow lost all captured packets, and can't be started again. I can create new packet capture, but this can't be started as well. Status is still "Not Running" and clicking the "starting triangle" doesn't start capturing... Last week I used capturing with no problems and I'm not aware of no changes since then.

Fortigate 100D, firmware 5.4.3

Any ideas how to fix this will be appreciated.

[MikePruett]

Have you tried doing a live pcap via the CLI just to see if that portion functions?

[lukral]

Yes, packet sniffer via the CLI works normally.

[bermejal]

Hi Lukral,

we are experiencing the same problem. Did you manage to fix the issue and make GUI packet capture work again? 

Thanks.

[lukral]

Hi Bermejal,

as I can remember, the problem was that the disk was set for WAN optimization and not for "Local Log". And I think that the change of the disk mode was made "spontaneously" during fw upgrade - I didn't change it intentionally. After changing it to "Local Log" and disk formatting, then the packet capture started to work again.