Martin.Krivanek

Hi, In essence Orion.Netflow.Flows contain all flows. FlowsBy* entities offer different view over that data. Their main purpose is to provide easy way to query directional fields (e.g. SourceIP and DestinationIP) regardless of their direction (as if there is IP field and you don't care whether it was received as source or…

Hello, let me clarify few things around units in NTA, hopefully this will help to understand the values better. As for graphs in NTA - its unit can be selected in Edit page for given resource. Most common ones are rate (in bps - bits per second), data transferred (bytes) and percent of total traffic (%). The confusing bit…

NTA shows this message if interface indexes in flows doesn't match any interface indexes on the device (queried by SNMP). In your case NTA received flow with interface index 334, but no such interface existed in your NPM installation. Thus SNMP query was issued to check for that interface on the device - no such was found…

Hi, 1. When you set ingress in the interface details page, you will get only flows for traffic which entered that interface. But each flow has source and destination endpoint, so you will see both in Endpoints resource. If you want to see just transmitting or receiving endpoint you can use Top Transmitters/Receivers…

Hi, NTA 3.7 support NetFlow version 5 and 9. Best regards, Martin

Hello! Unfortunately I don't have good testing environment at the moment, but can you try this query and see if it's faster? SELECT VS.ShortName, VS.Connections, VS.Stats.DateTime FROM Orion.F5.LTM.VirtualServer VS WHERE VS.ShortName IN ('PORTAL_ADMIN_443_VS','PORTAL_CONSUMER_443_VS') AND Connections > 0 ORDER BY DateTime…

Have you enabled CBQoS also in NetFlow sources for those two routers? If so, go ahead and open support ticket. Regards, Martin

Is there any pattern when this happens? I'd check system events and NetFlow service logs (look for NTA.BusinessLayer.log). If there's nothing obvious I suggest to open support ticket. Regards, Martin

Hi searnhardt, if you choose a port not to be monitored, that traffic would go to 'Unmonitored traffic'. You can drill down to that traffic to see which ports compose that category. This applies to Top Applications resource only, other resources display traffic regardless of port. Regards, Martin

Hi vipriel, If you're looking to get total traffic instead of interface breakdown, then you can add port numbers directly into the filter as follows: SELECT ApplicationName, MapTo, TotalBytes, TotalBytesIngress, TotalBytesEgress FROM…

For QoS packet drops per class you can use cbQosCMDropPkt64. Regards, Martin

Hi, is it true that mentioned device doesn't support SNMP? One reason why you see these messages is when receiving flows from device which was added as ICMP into NPM and thus can't be queried via SNMP. But if it supports SNMP, the easiest solution is to change the node in NPM from ICMP to SNMP and discover any interfaces…

Hi Tim, most probably this means that NetFlow v9 template is missing some mandatory fields. Here's the list of required fields: Bytes, Packets, Protocol, Source Port, Source Address, Dest Port, Dest Address, InterfaceRx or InterfaceTx (ideally both). Optional fields are Type of Service, SourceAs, DestAS. Setup the device…

Hi, can you please post screenshot with what percentage utilization it shows currently? Interface speed should be polled automatically by Orion NPM, usually you don't need to configure it manually. Regards, Martin

Hi, I've never seen this before, can you please open support ticket for this case? It would allow us to investigate log files and better understand why it happens. Thanks, Martin

Hello tkelly, such issue can be caused by variety of different reasons and it's hard to identify without log files. I suggest you to open support ticket, so we can investigate this case more. Regards, Martin

This might indicate some performance issues for example, but it could be caused by variety of different reasons. I suggest to open support ticket, so we can investigate this case more. Regards, Martin

Hello aaron_daniels, to answer your questions: 1. Unfortunately this is not possible, we might consider this in future release. 2. Hierarchical (or nested) policies are not supported by current version of NTA, again this might be addressed by future release. 3. We've done a lot of improvements to CBQoS data polling in NTA…

Hello, there is just one installer of NTA 3.7 for all kinds of installation. It will detect installation type of Orion and use the same. So you can use normal 3.7 installer for Additional Web Console. Regards, Martin

nProbe takes two parameters (-u and -Q) to specify input and output interface index in flows it generates. For example -u 1 -Q 2 means that all flows will have 1 as input if index and 2 as output if index. From NTA perspective then all flows appear as ingress on first interface and egress on the other. Both interfaces on…