Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Stacked Chart Error in Netflow 3

bbusbey

I thought Netflow 3 was going to fix this.

"Stacked Chart Error: There must be at least one row...."

Find more posts tagged with

Accepted answers

All comments

SamuelB

I am also running NTA 3 and am getting the same error.

The entire error reads "Stacked Chart Error: There must be at least one row and one numeric column, and data should be all positive or negative."

I have seen this error specifically when selecting a protocol or application and then selecting a Named Time Period that is greater than 2 Hours.

mark_wiggans

I believe that is still a known issue. If you have not already submitted tickets for this error please do so.

Version 3.0 includes the following fixes:

Resolved issue where IP Address Groups Chart would periodically show as a red "X"
Fixed issue where the NetFlow Sources - NetFlow "Exporters Only" option does not display all available exporters.
Removed limitation where users would not have rights to NetFlow views if the views were created prior to the latest Netflow install.
Fixed issue where "Exception: error occurred during packet processing. Object reference not set to an instance of an object." errors would appear in the Event Log.
Resolved issue where the Top XX IP Address Groups resource only listed 1 group.
Updated Charting component to resolve issue related to dips in data.
Resolved issue where Orion NetFlow Traffic Analyzer ignored the “Keep compressed data for x days” setting and retained all compressed data resulting in a larger than desired database size.
Note: Now that this issue has been fixed, data older than 90 days will be removed from the database after upgrading.
Fixed issue where in certain specific situations, the times below the graphs would repeat.
Restarting the NetFlow service to view NetFlow data on recently added Netflow interfaces is no longer required.

SamuelB

That list of fixes is great. However, I personally never saw this error until I upgraded to NTA v3.

davidmaltby

I'm unable to reproduce. From the NTA home page, I selected an interface and from that interface page, I selected a protocol listed in the Top 5 Protocols. I changed then changed the Named Time Period to 24 hours and could not reproduce. Further from that page, I then then selected one of the Applications on the Top 5 Applications and changed its Named Time Period to 24 hours. I then set its Named Time Period to "Today". Finally I set it instead to a Relative Time Period of Last 2 days.

Does this occur maybe only when viewing data for a particular interface? Can you provide me with more detailed steps on what you do to see this issue?

Thanks,

kweise

I am also receiving this error. Currently, we only have routers configured for NetFlow. I've seen it on a few of the nodes detail pages as well as ethernet interface details page. I'm not sure if this is related or not, but on one node, I've also received an error on the nodes detail page under Top 5 Converstaions (Last 2 Hours) stating "Failure retrieving data - refresh your browser (F5) to try again. If the problem persists, see C:\InetPub\SolarWinds\OrionWeb.log for detailed information." We're still in the process of implementing NTA, so we're still configuring nodes for NetFlow. The only recent change made (aside from adding nodes) is I increased the retention time for uncompressed yesterday morning. I increased it from 1 hour to 2 hours. I began seeing the stacked chart errors yesterday afternoon. I opened a support case this morning (#51197). The details from the OrionWeb.log are in the case ticket.

kweise

Support told me this afternoon that this software bug will be fixed in SP3, tentatively due out at the end of next week. They have a pre-release version that you can get from support if you can't wait for the final release.

jbaulsir

Just applied SP 3 and still get the error.

Since the readme states "Note: This service pack does not fix incorrect data that is already in the database." would it be advisable to truncated the FlowCorrelation table?

mcbridea

The SP does not clean up the old data so you could truncate to get rid of it or just let it age out.

Andy

davidmaltby

Its not the FlowCorrelation table that is causing the issue. It is the data in the NetFlowDetail_X and NetFlowSummaryX tables. If you look at the values in the TotalBytes column, for all of these tables, you'll see that some of them are negative. That is the cause of the problem.

To find out which tables have these negative number do a

SELECT Count(*) FROM NetFlowDetail_6 WHERE TotalBytes < 0

Where NetFlowDetail_6 is the name of the table to check in. You can fix the values in the TotalBytes field with the following:

UPDATE NetFlowDetail_6 SET TotalBytes = 4294967296 + TotalBytes WHERE TotalBytes < 0

NOTE: This is an untested fix, so using it may invalidate the value of the TotalBytes field. I did some basic testing myself which looked good. So backup your database before doing this UPDATE in case you need those values later.

Unfortunately, I don't have time at the moment to write some T-SQL to enumerate all the Details tables for you, but hopefully it won't be too much work for you to find and fix these values. If nothing else, this should get you started in the right direction.

Let us all know how it turns out for you.

Thanks,