Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Netflow application collision error message

For some reason NetFlow stopped reporting data on all but two of our routers for abou two hours. So far only errors at the times of the issue are like what is below, although these errors where happening even before data stopped. But haven't occurred since the issue seems to have cleared up. Anyone seen this type of message before. It's from the swdebug.log:

[STP SmartThreadPool Thread #45] ERROR SolarWinds.Orion.NetFlow.ApplicationManager - Single port application collision 100003 x 100007

Find more posts tagged with

Accepted answers

Jan.Krivanek

Hello hjarriell,

Yeah, overworked DB can also seem as cause of temporarily missing data.

As to your original question to applications collisions - You can list all ports in collision along with applications that are defined for these ports by running following two queries (And then basically decide which of the applications in collision should be defined by port in collision and change the settings of application in Netflow Settings)

SELECT DISTINCT a.*, ap.Port

FROM

(

SELECT Port, COUNT(Port) as cnt FROM NetFlowApps a

INNER JOIN NetFlowAppPorts ap ON a.AppID=ap.AppID

GROUP BY Port, a.UDP

HAVING COUNT(Port)>1 AND (a.UDP=1)

) as DATA

JOIN NetFlowAppPorts ap ON ap.Port=DATA.Port

JOIN NetFlowApps a ON a.AppID=ap.AppID AND a.UDP=1

ORDER BY ap.Port

SELECT DISTINCT a.*, ap.Port

FROM

(

SELECT Port, COUNT(Port) as cnt FROM NetFlowApps a

INNER JOIN NetFlowAppPorts ap ON a.AppID=ap.AppID

GROUP BY Port, a.TCP

HAVING COUNT(Port)>1 AND (a.TCP=1)

) as DATA

JOIN NetFlowAppPorts ap ON ap.Port=DATA.Port

JOIN NetFlowApps a ON a.AppID=ap.AppID AND a.TCP=1

ORDER BY ap.Port

All comments

Jan.Krivanek

Hello hjarriel,

The message in log is unrelated to your problem.

That application collision means that your NTA receiver received flow reporting packet going trough port for which there is not a unique application (in your case this packet can be interpretted as belonging to application with id 100003 or 100007, and will be in future interpreted just as a packet belonging to aplication with id 100003).

In your case, there could be a problem with firewall, unmanaging of node (e.g. due to IP address change) or something like this. Do you still see your nodes in Netflow Sources on Summary page? Arn't there some messages in Last 25 events about unmanaged nodes or unmonitored interfaces?

Regards
Jan

hjarriell

We did still see the nodes, and they were updating thier date and time of most recent flow, but when we clicked to see the info, it would show no traffic for that 2 hours. Yes, there were some messages about getting flow from unmanaged interfaces.

Jan.Krivanek

Hello hjarriell,

So If I understand it right, you were able to see problematic node in your Netflow Sources and it was continually updating time of last received flow, but when you clicked this node, you did not see any data?

If the node (and its interface(s)) is visible in Netflow Sources and is updating “last received time” it means that this node (interface) is managed, so this should not be a problem (only if you do not see problematic node/interface in Netflow Sources with Netflow enabled, you need to manage it first).

In your case I see one possible problem – currently we do not support scenarios with different times on service/ database/ web console – all these sites need to have same time, otherwise you can experience behavior similar to what you described.

If even this is not your case and you are under maintenance, then I would recommend opening support ticket, so that we can closer investigate your case.

Regards
Jan

hjarriell

I was mainly interested in the cuase of the error message in the original post.

I have had a ticket open before about Netflow data being collected but not displayed till later (although it was like 20 minutes delay before), could never recreate the issue since by the time support contacted us to investigate the data was showing up. They figured it's an overworked database.

I just looked for the time frame we where having issues before and it is showing data now.

Thanx again.