Using embedded packet capture on an ISR 4000

[jmcgrady1]

I am trying to capture traffic on an ISR4000. I have the capture setup as:

monitor capture mycap access-list SUBNETS
monitor capture mycap interface gi0/0/3.200 both
monitor capture mycap limit duration 60
monitor capture mycap buffer size 40

monitor capture mycap start
monitor capture mycap export flash:my.cap

When i look at the size of the capture file my.cap it ends up very small.

When i analyse the file in wireshark, i can see that the right traffic is being recorded.

However its only a few seconds worth rather than 60 seconds.

Why might the capture not be running for the specified length?  My flash: partition has plenty of space

EDIT: I see the issue. I have to let the capture complete before i run the 'export' command!

[balaji.bandi]

Try remove duaration and buffer size, make sure  you offload from the router. to any other outside source.

may be due to time, increase and see if you get more data.

check below syntax :

https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-embedded-packet-capture/116045-productconfig-epc-00.html