Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

netflow v3 stops resolving dns names

I am having an issue with netflow resolving dns names. This started after upgrading netflow from v2 to v3. I am running Orion v8.5.1 w/ SP3 and Netflow v3. All my nodes in Orion show up in netflow with the correct name, reverse lookups work fine. About a month after the upgrade, all the names disappeared and netflow only showed IP addresses. Also, the nslookup button on the endpoint details screen would do nothing. I verified reverse lookups work fine on my orion server, as far as windows is concerned. Restarting netflow and rebooting the server had no affect.... So I opened a support ticket... thier answer:

"If you truncate the FlowCorrelation table within the NetperfMon database, all netflow endpoints should be resolved to their DNS names again."

I did this, and after wating 2 days for NTA to automatically lookup hostnames, everything was back to normal. I expressed concern with Solarwinds support this was not an acceptable fix. Truncating this table everytime netflow looses it mind, is not a fix. Well... it has been about a month, and gues what, netflow has stopped resolving dns names again.... I can fix this by truncating the table again, but would like to find a REAL solution. Anyone have this same problem, or have a fix for it?

Thanks,

Gary Sample

Find more posts tagged with

Accepted answers

All comments

andrew

I am having the exact same issue. Did you ever find a solution?

How do you "truncate the FlowCorrelation table within the NetperfMon database". Are you talking about just removing all the records from that table? Is that going to cause any data loss?

mcbridea

Hi Guys,

This is a known bug in 3.0 and we are addressing it. The flow correlation table will rebuild so no history lost.

Andy

andrew

So, that means it is safe to run "TRUNCATE TABLE FlowCorrelation"?

davidmaltby

It is safe in that the FlowCorrelation table only keeps a resolution of DNS resolutions. Once you delete it, of course, the IP addresses will not have a way to resolve in your graphs, until new NetFlows come in with those IP addresses in them. Then the service will see that they are not in the FlowCorrelation table and will make new DNS queries. The history will be retained, but if no new NetFlows come in for a particular IP address, then since the graphs join on the FlowCorrelation table, I believe that they won't show up until a new DNS query is made on them. Let me come up with a better way to do this instead of truncating the table. I should have some T-SQL for you to run instead this evening that will do the same thing in effect, but doesn't have this type of side-effect.

Thanks,

brianburnett

I have fought with this for a long time and posted an answer for this in another topic... It is not a complete solution, but it is a valid workaround and requires no server-side scripting. Hope it works for you!