NTA Error: "You have not enabled NetFlow data export on the CISCO device"

I have recently added 2 6509s into Solarwinds for NetFlow monitoring. They are set up in VSS, so it appears as 1 physical device (not sure if this matters but I thought I would mention it just in case).

I have followed the configuration guides from Solarwinds and Cisco. Solarwinds is seeing the NetFlow traffic from this device, however, in the "Last 25 Traffic Analyzer Events" chart, I see the following:

1. The NetFlow Receiver Service stops.

2. Netflow Receiver Service Started

3. I receive the error: "You have not enabled NetFlow data export on the CISCO device"

This process repeats every few days. As far as I can tell, I am seeing all of the NetFlow data from the 6500. The show commands on the 6500 show that the data is being exported to the correct server and port. I do not see any failed exports from the 6500. I have checked and double checked the Cisco guides for NetFlow on a 6500 and I do not see anything out of the ordinary there. I have several other Cisco devices in NTA as well and I do not have any issues with them.

Should the NetFlow Receiver Service stop and start like this?

Why would I only receive an error for this device? Is there a hidden piece of config that is crucial for the 6500 that Solarwinds is looking for?

Find more posts tagged with

netflow_error

6500s

error

nta

Accepted answers

All comments

ktulu037

In checking with the other admins, the server was restarted during the times that I see the service drop. That now makes sense.

The issue I am still concerned with is the error about the data export is not set up on the 6500. Is this a normal error that I can just expect to see each time the service is restarted? If so, why do I not see this for the other devices sending NetFlow data?

wluther

ktulu037 Did you ever get an answer for this? I have been seeing this same error, yet, we are also receiving netflow data from our device.

stibi

Hi wluther, some of the devices sends flows where input and output interface have values 0 (usually in broadcast or multicast traffic). Best way to verify this would be capture the traffic from the device in Wireshark and look for flows where both interfaces have value 0.

If that is the case, you can ether ignore the message or try to set the device to send ID for input interface.

Petr

choly

Hello,

I see two issues here.

First: NetFlow service is restarting itself - definitely not intended behavior - please create a support ticket to find out the root cause of that.

Second: event telling you that "You have not enabled NetFlow data export on the CISCO device" - please check following documentation.