Jan.Krivanek

I am glad to hear that you found here an answer to your question. Regards Jan

ecklerwr1I am glad to hear that my answer helped you. Hopefully NTA will remain useful tool for you even despite these issues.JK

Hello tylerlucas, Do you still experience this behavior even after setting flow cache timeout to one minute? There is actually one internal bug in 3.6 (resolved in 3.7) that can rarely cause similar behavior. You can detect if this bug can cause this behavior by running following query (e.g. inside MS SQL Management Studio…

Unluckily NTA currently does not fully support Views limitations (this is going to be addressed in ongoing release), so you may experience described issues when setting up View limitations for NTA SummaryView

Yes, exactly as you wrote - NTA is just using DNS of the local machine (or machine of web server in case of 'on demand' resolution). So once you set-up resolution of well known names on that machine, NTA should start resolve external names correctly.

Hi ecklerwr1, According to the URL that you posted I guess you are trying to search application by port by "Search Application" feature on the SummaryView page - Is that true? There is really a bug in this feature in NTA 3.6 which will be addressed in future release (for internal gus, this was item #3534). Anyway, you…

Hi Braden, I'm glad to hear that you resolved your problem with NTA. Regarding the NCM problem - I would recommend posting on NCM thwack thread or/and open new support ticket.

Hello hjarriell,Yeah, overworked DB can also seem as cause of temporarily missing data.As to your original question to applications collisions - You can list all ports in collision along with applications that are defined for these ports by running following two queries (And then basically decide which of the applications…

Hi ecklerwr1, I also found that you have a problem with inconsistency between Ingress, Egress and Both Application Detail View. This is also really a bug in NTA 3.6 release, related to Application detail view and IP address groups detail view (for internal guys this was entered and solved as #3277, and related hotfix was…

Yes, as it seems as an issue I would definately recommend opening a support ticket. It would be also nice if you could add screenshots demonstrating the issue (not just resource, but whole view also with URL).

Yes, that’s also possible. But it’s too early for judgments now until we will go through SolarWinds diagnostics and packet capture. Regards Jan

Also just one more quick check - this can also be a symptoms of changing name resolution from DNS to NetBIOS. In such a case changing name resolution back to DNS would probably resolve the problem.

Hi rtjensen4, Actualy it is not currently possible to apply excluding filter for IP group - so if you will create IP groups for all your branches and one for your HQ location, you will not be able to filter out the communication to HQ location. So the solution in your case (as suggested by wrodenbusch) is to create IP…

In that case I will bring PM attention to this (if MarieB did not do that yet), to decide if they want to consider this for future releases. Anyway thanks for an interesting idea. Jan

Hello hjarriell, So If I understand it right, you were able to see problematic node in your Netflow Sources and it was continually updating time of last received flow, but when you clicked this node, you did not see any data? If the node (and its interface(s)) is visible in Netflow Sources and is updating “last received…

I understand your concerns. I ment, the fastest workaround until there will be officialy issued any hotfix addressing this problem. If you have any concerns, feel free to open support ticket for this case. For internal guys - we have this already in our list as item #26258. Thanks Jan

It most probably seems to be a performance problem (do you happen to have quite large environment managed?). I would sugest collecting diagnostics, also some wireshark packet capture (if it is possible for you) and opening support ticket so we can investigate your case more closely. Regards Jan

hanlu, exactly as you said - Endpoints should be everytime superset of Transmitters and Receivers (assuming thay all are shown on the same view - means same filters are applied).

Hi Biks, I am glad to hear that you was able to solve your problem quickly. If it would be possible for you, can you please locate your business layer log(s) and send it to my email in profile? I just want to see what was the exact cause of this problem. Thank you Jan

I would rather recommend trying reverse dns lookup (e.g. by nslookup) on that machine where you have NTA service installed and if you can confirm that you are able to find DNS name of the problematic endpoint from that machine then the best bet would be opening a ticket so that our support can assist you with addressing…

sFlow protocol can use sampling technology to lower the impact of high traffic monitoring. Then you actualy see just the sample of the traffic which can be used to spot top talkers etc. but you would need to multiply the numbers by sampling rate to get approximate results. Your issue seems that there can be sampling in…

Actually we just store one flow into our data, but then when querying for specified application (because of request from web UI), we try to match this stored NetFlow data with the definition of this application (and both mentioned application definitions can match the same row in our data).To specify this a little more –…

Hi Braden So in your case it should be located in C:\ProgramData\Solarwinds\Logs\NTA or C:\Users\All Users\Solarwinds\Logs\NTA (depending on OS). Or if you have a chance to past your case number here I could try to look directly in your uploaded diagnostics (if you already uploaded them).

That’s really weird. I haven’t heard about any similar behavior. If the router exports the data just after the reboot and then it stop exporting it seems like a device bug to me though. But I would probably recommend collecting diagnostics, packet capture (ideally showing the data coming from the router after reboot till…

Hi Ichance, Does the refresh of the View resolves this display problem? And if yes, would this be an acceptable workaround for you? Ragards Jan

Hi rickq, you are right, I just went quick over the message and times and beeing used to europien style of starting the day at 00:00AM I made to quick judgement. It seems to me that also the developer developing this made a same judgement about this situation - so I am creating bug for this (for internal folks, its FB case…

Once more from here - this problem is actualy caused by fact that the interface(s) is (are) not being managed by Orion at all, so you need to go to Orion settings, then Manage Nodes -> List resources and here select the interfaces that you want to manage. Regards Jan

Hello pyro13g, Does refresh of page resolve missing graph problem? Regarding utilization - did you by the chance set up a custom interface bandwidth? Anyway it would be interesting to investigate your diagnostics so if you are willing to submit support ticket for this please go ahead and also post your case number here.…

Hello adeimel, Currently there is no way how to define hierarchical IP groups as you describe. It means, all IP groups that matches the traffic will be counted and so in case of overlapping (or inclusive) IP groups you will see data multiplication. However you still should be able to drill down to some IP group traffic and…

Hi wfleitz, the most usual cause of a similar problems that we have seen was in MS or third party firewall in place which blocked the packets (wireshark operates on lower level then software firewall so it is still able to capture incoming packets). Try to disable any possible FW, or temporarily disable netflow on the…