Troubleshooting
Problem
When attempting to start capturing packets on a PCAP device, it might not pass the Ramping Up status.
Cause
It has been seen that having partition /extraction1 at 100% of the capacity may cause problems updating the license.
Resolving The Problem
However, if after attempting to reload the license key the issue persist it has been seen that having partition /extraction1 at 100% capacity prevents the license from being correctly loaded.
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/VolGroup-lv_root
50G 3.3G 44G 8% /
tmpfs 64G 56K 64G 1% /dev/shm
/dev/sda1 477M 27M 425M 6% /boot
/dev/mapper/VolGroup-lv_home
73G 281M 69G 1% /home
/dev/sdc 37T 819G 36T 3% /storage0
/dev/sdb1 3.5T 12G 3.3T 1% /extraction1
In that case, make sure you free some space from the /extraction1 partition, move any files older than the ones on the /storage0 partition to an external source.
Once space is available on /extraction1, attempt to update the license key again and start capture.
Should you require help with this maintenance process please contact QRadar Support.
For more information look at this Article IBM PCAP appliance stops capturing after 10 minutes
Where do you find more information?
Was this topic helpful?
Document Information
Modified date:
28 October 2020
UID
swg22002544