IBM Support

IBM PCAP appliance stops capturing after 10 minutes



IBM PCAP Appliance will not continuously capture data if the PCAP license key is missing, or incorrect.


After clicking the Start Capture button, the status will switch back to Stopped after 10 minutes.


This behavior can be caused by a missing, or incorrect, license.

Diagnosing The Problem

To check the status of your licensing, log into the IBM PCAP appliance using SSH, and run the following command:

cat /dev/shm/cs_captures.ini

The following is an example of the output:

"BeginTime":"2016-05-27 15:11:07",
"EndTime":"2016-06-06 17:46:52",

Notice that the output includes a License field, that contains the value Permanent. If this field is missing, or if the value is not Permanent and you have purchased and entered the license previously, then you are likely experiencing Licensing issues.

Resolving The Problem

  1. Log into the web UI of the IBM PCAP appliance.

  2. Navigate to the Help menu in the upper right corner of the screen.

  3. Click Update Master License.

  4. Enter the license key for the PCAP appliance into the License Key field.

  5. Then, click Update Master License.

In most cases, entering the license key will resolve the issue. If you do not know your license key, contact Product Distribution for assistance, using the following email address:

Where do you find more information?

[{"Product":{"code":"SSMU35","label":"IBM QRadar Network Packet Capture Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Licensing","Platform":[{"code":"PF016","label":"Linux"}],"Version":"Version Independent","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
28 October 2020