Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Netflow from unmanaged and invalid interfaces

Hi everyone,

We are getting a netflow event saying that Solarwinds server is receiving netflow data from unmanaged interface Fastethernet 3/2. Click "Add this interface" or " Edit this device" to manage interface and process its flow data and the interface name could be also an index such as unmanaged interface # 3345.

when we look into the interfaces on the device some of them are unmanaged and disabled from the Cisco node or the interface indexes are not matching on the existing interface index on the DB which makes them invalid interface index.

The question is how the Orion server get flow from disabled interfaces ? From where the invalid interface index flow data coming ?

please share your experience if you encounter similar problem ,thought for understanding and resolving the triggering of such events.

Find more posts tagged with

Accepted answers

All comments

mbilgrav

The interface info is within the Netflow info, so it just informa you that the interface is not managed within Orion.

I am runing with the setting in "NetFlow Traffic Analyzer Settings"

Enable automatic addition of NetFlow sources
Allow monitoring of flows from unmonitored ports (666 of xxx PDU(s) have been received from unmonitored port(s) in last minute. Last update was in 6/10/2020 12:55:08 PM)
Allow monitoring of flows from unmanaged interfaces. Flow data associated with at least one Managed source or destination interface will be processed and visible in NTA.
Allow matching nodes by another IP Address. Checking this option enables Orion NTA to associate a flow with an appropriate NPM node if that node has multiple IP addresses and is sending flows from a non-primary address.

This would clear your alerts

mestasew

Thanks for your response and suggestion.

However our NTA is already configured and match your suggested settings.

mbilgrav

have you tried to upgrade ?

mestasew

our upgrade is on hold and planned at some point in the future for hosting environment needs an upgrade.

But what I want to understand is how a disabled interface is listed sending a flow data ? why some of the flow data used an interface index number like # 4567.

is this somthing a known NTA flaw ?