Security camera not recording: a fleet checklist

A security camera that is not recording is usually still online: it answers on the network and shows a live view, while the path from the camera to stored footage is broken somewhere between the lens and the disk. That is why this failure costs more than a camera going dark. An offline camera gets noticed. A camera that streams live and stores nothing is found when someone asks for footage, and the footage is not there.

This checklist is for teams running a CCTV system of 100 to 500 cameras, typically Axis or Hanwha on a VMS or recorder, who want to find non-recording cameras before an incident does.

Live view and recording are different paths

Live view needs two things: a working camera and a network path to whoever is watching. Recording needs more. The recorder has to log in to the camera, pull the right stream, keep up with its bitrate, and write it to a healthy disk with free space, on a schedule that includes the current hour, with a clock that files the footage under the right time. Any one of those can fail while live view stays perfect.

Where the recording path breaks

Where	Cause	What it looks like	First check
Recorder login	Camera password changed and the recorder still has the old one	Camera shows live in its own web page; the VMS shows it unauthorized or offline	Credentials stored in the VMS for that camera
Disk	Disk or volume full, failed, or degraded	Recording stops, or the oldest footage disappears faster than policy	Volume status and free space on the recorder
Recorder	Camera count over the license, recording service stopped	New cameras never record; or every camera on one server stops	License count, service status
Schedule	Recording set to motion or event only, or a schedule that skips hours	Gaps that line up with quiet periods or with the clock	Recording mode and schedule for the camera
Motion trigger	Sensitivity too low, or a mask over the area that matters	Footage exists for the wrong areas; nothing for the incident	Motion zones against the live view
Stream	Stream profile, resolution, or codec changed; stream count limit reached	Recorder connects but gets no usable stream	Stream settings since the last firmware update or config change
Encoder	Encoder hang, same frame served repeatedly	Recording exists and shows one frozen image	Play back the last hour, not the live view
Network	Bandwidth or packet loss on the path to the recorder	Gaps, smeared frames, recordings in fragments	Interface errors and utilization on that path
Time	Camera or recorder clock wrong	Footage exists but is filed under the wrong time, so search finds nothing	Clock on the camera and the recorder
Memory card	Card missing, failed, full with overwrite off, or worn out	Edge backup missing for exactly the outage you needed it for	Card status in the camera’s storage settings

The recorder login row is the one most often caused by good intentions. Rotating camera passwords is right, and rotating them on the cameras without updating the recorder in the same change locks the recorder out of every camera touched. How to rotate camera passwords without breaking your VMS covers the sequencing.

The time row is the most confusing to diagnose, because the footage is there. A camera that drifted eleven minutes off, or reverted to its factory date after a power loss, files every recording in the wrong place. Camera NTP time sync problems covers the causes and fixes.

A daily check that scales to a few hundred cameras

A camera-by-camera playback check does not scale past a few dozen cameras. This sequence does, because each step narrows the list for the next.

1. Compare the camera list with the recording list. Every camera that should record appears in the recorder with recordings in the last hour. Anything missing from either list is the first group to look at.
2. Look for recorders, not cameras. If every camera on one server stopped at the same minute, it is the server: disk, service, or license. Fix that before looking at any single camera.
3. Check volumes on every recorder. Free space, failed drives, degraded arrays. A recorder nobody logs into is where a failed drive waits longest.
4. Pull the timeline gaps for the last 24 hours. Most VMS platforms show recording gaps per camera. Sort by total gap time and work down from the top.
5. Spot-check playback on the cameras that matter most. Entrances, cash handling, docks. Play the last hour back, not the live view. A frozen frame or a black image is only obvious in playback.
6. Check clocks. Any camera more than a few seconds off the recorder is filing footage in the wrong place.
7. Check memory cards on cameras that have them. Missing, failed, or full cards remove the backup for the next network or recorder outage.
8. Log what was found and fixed. A dated record of recording checks is evidence an auditor or insurer will ask for.

Steps 1 through 4 are fast in most VMS consoles. Steps 5 through 7 are where the time goes, and where camera-side failures hide.

Catching it across 500 cameras

By hand, the camera-side steps happen weekly at best, and a camera that stopped producing usable footage on a Monday is found on the following Monday, or by a request for footage.

MentatNOC watches the camera side of this list continuously across Axis, Bosch, and Hanwha fleets. A camera that goes offline, whose image freezes or goes black, whose clock drifts, or that is knocked off its aim raises an alert the same hour, with the site and the camera named. Memory cards are watched too: a card that disappears or reports a failure raises an alert, and on cameras that report card wear, so does a card near the end of its life. Credential rotation runs as staged waves that keep the recording tier in sync, so a password change does not quietly lock the recorder out. It monitors device health, not video. The recorder’s own timeline and volume status still answer whether the disk wrote the footage; MentatNOC makes sure the cameras feeding it are healthy, and says which ones are not.

For an integrator, the alert names the camera and site, so the tech arrives with a card or a replacement model as the alert implies and the first trip fixes it. See the fleet board and its alerts on the interactive demo.