Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Installed NTA 2.2.1 last week and I have some of the problems listed in this forum.

Hello all. I need some help.

I just installed NTA 2.2.1 on our polling engine last week and started to export data from our datacenter router to it. I already have the issue alluded to in the "unmonitored traffic" thread as well as the issue in the "application log error" thread. Additionally, I am having issues with some IP address groups I created. All issues seem to center around any changes I make (addition or edit of monitored TCP ports and changes to IP address groups). Am I doing something wrong in how I edit this suff? Also, how do I get this fixed. I am not logging traffic on the ports I have added or edited and the IP address groups are totally hosed.

I have opned a case about the port issues yesterday but have not had a response from anyone competent yet. I need some help.

Vital stats on my installation:

HP Proliant DL380, dual Xeon 2.4GHz, 3.71 GB RAM

MS Windows Server 2003 SP1

SQL 2000 Enterprise on a seperate server

Orion NPM 8.5 with hotfixes.

472 nodes, 3005 interfaces, 663 vaolumes.

NTA 2.2.1

1 node exporting 1 interface: Cisco 7206 VXR, ATM DS3 45MB pretty highly utilized.

Find more posts tagged with

Accepted answers

All comments

achrich

Hi,

Im having a very simlair issue. Im runnning Orion 8.5.1 sp2 with NTA 2.2.1 with hotfix2.

Most things are working fine however I`ve noticed that the application that I had to create a port for in the settings page is missing - rather annoyingly - everything else ( i.e standard ports ) are fine.

In order to prove its not the Cisco hardware, ive checked its going into the flow cache on the router and also used Netflow Realtime ( a solarwinds standalone package ) to capture it and its works 100%, therefore I conclude its something in the NTA DB.

Im assuming a bunch of fixes are due soon for the outstanding issues with regards errors in the event log related to NTA, can someone let us know when this fix will be with us and if it relates to the above symptons ?

Regards

floyd.may

Not sure I'm understanding what your particular problems are, but I will offer this tidbit of advice:

Any change you make in the Admin section of NTA will only apply to new traffic as it comes in. If NTA receives traffic and marks it as "Unmonitored", that traffic will remain "Unmonitored" until it gets dropped out of the database after 30 days (or wherever you have your data retention settings set). The same is true of IP address groups.

HTH.

achrich

I think this relates to software versions as this application I was interested was previously monitored in NTA no problem. The error in the event logs is not down to configuration either and has only appeared after an update...cheers anyway.

achrich

Sorry i`ve not made clear the problem we are having :

Any flows which contain a TCP port manually defined in the NTA configuration are saying "no data to display", All other traffic is working and being displayed as expected.

3litre

I have case #29239 open about this issue. It has screenshots and stuff in it that are a bit more illuminating.

In a nutshell: I am NOT seeing any traffic on the ports I have added or edited. I WAS seeing it as "unmonitored" BEFORE I edited the ports. Now it doesn't show up at all. This is A HUGE amount of traffic.,,, the single highest percentage of traffic. It was 26GB in the fist night I had the module installed. It is for our enterprise disaster recovery backups so I am POSITIVE it being generated each day.

I saw (and still see) the flows in the cache on the router for (on port 1500 for example). I saw the conversations get logged as "unmonitored" to "random high port." When I added or edited 1500 through the website I expected to see that traffic to show up under that port and for the unmonitored to drop off. But... it just disappeared.... when I do a search for the traffic the endpoint of the server.... it simply isn't there. Not as unponitored or anything else.

This worked perfectly in eval.... I'm a little worried. I'm getting drilled by my management. They are asking about competitors products already.... and it's just been a week. Help!

floyd.may

Does running this query fix the issue? If not, get with your support rep and I'll see if we can get started on some more advanced troubleshooting.