Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
lukral
New Contributor

Packet Capture can't be started

Recently all configured packet capture (in GUI) somehow lost all captured packets, and can't be started again. I can create new packet capture, but this can't be started as well. Status is still "Not Running" and clicking the "starting triangle" doesn't start capturing... Last week I used capturing with no problems and I'm not aware of no changes since then.

 

Fortigate 100D, firmware 5.4.3

 

Any ideas how to fix this will be appreciated.

4 REPLIES 4
MikePruett
Valued Contributor

Have you tried doing a live pcap via the CLI just to see if that portion functions?

Mike Pruett Fortinet GURU | Fortinet Training Videos
lukral

Yes, packet sniffer via the CLI works normally.

bermejal

Hi Lukral,

 

we are experiencing the same problem. Did you manage to fix the issue and make GUI packet capture work again? 

 

Thanks.

 

 

 

lukral

Hi Bermejal,

as I can remember, the problem was that the disk was set for WAN optimization and not for "Local Log". And I think that the change of the disk mode was made "spontaneously" during fw upgrade - I didn't change it intentionally. After changing it to "Local Log" and disk formatting, then the packet capture started to work again.

 

Labels
Top Kudoed Authors