You can check several things here:
1- There is not enough space on the filesystem, usually set to 4Gb.
2- The packet headers of all traffic are written to the /nqtmp/headers RAM disk for consumption by the nqmetricd process. The full packets that the TIM needs for TIM processing are written to the /nqtmp/tim RAM disk for consumption by the TIM engine. The file format of /nqtmp/tim is standard PCAP. Make sure that the disk size for this directory is adequate. It can fill up with out-of-order packets.
3- Tim cannot deal with packets arriving, making the incoming files be more faster than the analyzed (purged from directory), when it is filled up, TIM crashes and restarts. Check the Watchdog log for further details.
4- Nqcapd writes packets to /nqtmp/tim when packets meet the following criteria:
- A logical port for which TIM monitoring is enabled receives the packets. The TIM is limited to only monitoring one logical port (feed).
- If any web server filters are configured in the CEM console, the packet matches a web server filter definition
5- Check if was any network adapter card changed recently or there is data from an old configuration that was not removed.
6- Disable full TIM logging if enabled.