Flow data not showing for some interfaces

Question

HI,

We did the upgrade of our Solarwinds environment to 2020.2. After the upgrade some of the interfaces in NTA are not showing flow data. 'Last Received' time for those interfaces are the time we stopped the services before upgrade.

I have checked the NTA logs and haven't seen anything unusual. We have raised a P1 issue with support and provided the diagnostics as per there request, but after that no update from them.

Some one please help on this.

@aLTeReGo @rschroeder @mesverrum

jdbrp · Answer

After our upgrade, I got a bunch of alerts saying "The NetFLow Receiver Service is receiving flow data from an unmonitored interface. The interface NTA Virtual Interface 0 on router is being added to NetFlow sources". However, the netflow traffic was still there but it couldn't hurt to check the alerts.

rschroeder · Answer

I'd be tempted to ask Support about past instances where this happened after an upgrade.  I seem to recall experiencing this exact symptom, and Support was able to find & correct the issue resulting from the migration.  Maybe suggest this to them?  They could look up my case number and see what they did (it was too many years ago for me to remember the details).

At the same they they're working on their research, I might take one of the nodes with less critical NTA data and remove it from Solarwinds entirely, then re-add it, and check to see if its NetFlow data begins to increment again.

I'd also review the NTA documentation with a fine-toothed comb to see if there are some new requirements with the latest version of NTA that need different config statements in your L3 equipment for them to provide NTA with information in the format it requires.  It would be unfortunate if this is the case, and tedious to correct if you have a large environment with many elements in NTA.

Let us know what Support comes up with, and what you find to be the fix.

Swift packets!

Rick Schroeder