Automatically monitor IPFIX flows from VMware 8 in NTA

We are running NPM 2024.2 with NTA. We have vCenter/ESXi monitored in Virtualisation manager (NPM not standalone). We have our VMware distributed switches with dedicated IPs exporting IPFIX flows to NPM. The distributed switches are added in NPM with node status external and monitoring type ICMP.

Now when the flows are seen by the collectors we are getting hundreds of event sin NTA as follows

To get the flows to appear we have to manually add the interfaces. Now reading this guide VMware support in NTA it states

Reading this is would indicate that these interfaces should be monitored automatically regardless of SNM<P polling which is not possible against distributed switches

We have waited several days but the issue continues

Q: is it possible to have interfaces/flows from VMware distributed switches monitored automatically in NPM/NTA?

Find more posts tagged with

Accepted answers

jan.turon

The prerequisite for processing IPFIX from VMware is to identify the source node as a VMware. In other words, the vendor column needs to contain VMware, as shown here:

Suggesting to update the vendor column manually to VMware for external nodes that are VMware.

All comments

jan.turon

verwin_u

Hi @shocko

NTA validates the interface id of netflow source and netflow data. To get this interface indexes, You must add your hyper-v.

Then from here, NTA will automatically identify the interface indexes of these netflow data.

https://documentation.solarwinds.com/en/success_center/nta/content/nta-vmware-support.htm

shocko

So I logged to support and as stated by @jan.turon I had to manually update the Database to set the vendor for the external/ICMP monitored nodes that represent the dvSwitches to 'VMWare'

update nodes SET vendor='VMware'
where nodeid=

This is working now! I have asked support to:

Raise a requets to have the documentation for NTA updated to reflect this
See why this is even needed since Solarwinds is already monitoring vCenter and should be able to do this automatcially

The docuemntation is just wroing in this regard and misleading IMO.