If you are not seeing netflow traffic

Question

I have SQL on a separate server, and both servers exceeding recommended specs.  The "Active netflow Sources" area was reporting NO active sources for the last 5 minutes.

I installed the netmon sniffer (an optional windows component) onto my Orion server, and saw several packets of port 2055 traffic coming in every minute.

When I edited the resource on the "Active netflow sources" section to show sources for the last 30 minutes, my sources showed up.

My conclusion is that there is a bug in the "last X minutes" section of the code, as I clearly observe data coming in.

savell · Answer

Just had the same (kind of) issue.
Added a new netflow source - but it didn't show up as an active netflow source.
Restarted the netflow service and the device and interfaces appeared.

Sav.

jsohotha · Answer

I had my netflow sources disappear off the active netflow sources also. Restarting the netflow service on the orion box solved my problem.

I am also using a seperate SQL server for the database storage.

jshepherd · Answer

I have a similar issue in that the default NetFlow page does not show up with the most recent data. The Orion pollers and web server are set to UTC as well as the monitored devices. The backend SQL Server is apparently set for local time (EST), since the difference in timing between the last Netflow data point and the current Orion time is 5 hours. So, are these apps (NetFlow and Wireless) getting their data time stamps from the SQL Server, or is there another app that needs to be adjusted?

Jim Shepherd
Network Services Project Manager -  IT
 
Swiss Reinsurance Company