davidmaltby · Principal Architect

Bryan, Tech Support just gave me your diagnostics and sniffer trace file. I'm reviewing them and will either give you a call or do a GoTo meeting with you shortly. Thanks, David

Just based on what I'm reading in this thread, I believe that all you need to do to the database is drop the dbo.GetNetFlowDbVersion function. You can do that by running the following T-SQL: DROP FUNCTION [dbo].[GetNetflowDbVersion]Or you can delete it in the SQL Server Management Studio UI in the left pane under the…

So you're saying that you did not have this problem until you applied NTA 3.1 SP1?

Can you call Tech Support and open a ticket for this issue? After reviewing the diagnostics, it looks like we need to either get some specific performance counter readings or get a memory dump of the NTA service to investigate where the memory is being used up. Thanks,

Yes. That was all to the "maintenance" in previous versions. I don't believe, I'd have to check, but Orion's Maintenance didn't perform the SQL Server operation called "shrink" on the database file for the PRIMARY filegroup nor on the transaction log for the database. Yes, compression and retention settings are…

Yes, we've got something in development for you to try for IE6. I should have mentioned that directly.

So, how often does this occur for either of you? Does this happen to occur just right after you restart any of the SolarWinds services? Does it only happen when the view initially loads, or does it happen when you press F5 and/or when the page automatically refreshes? From the table counts that you provided, I wouldn't…

Ok, I've done some testing. When using NTA 3.0, I do see the following PerfMon counters at around 50 flows/sec: Logins/sec = ~180 User Connections = 9 Logical Connections = 9 So, in my case, yes, we're seeing lots of logins/sec, but that is because we are using connection pooling. The logins/sec is incremented every time…

Can you give me the URL to the UDP graphs? Honestly, I'm actually at a loss as to which Orion resource you are refering to by the picture and the URL when viewing it as a 'detached' resource would tell me. Or better yet, what is the name of the resource that you refer to as UDP graph? (When you edit the view, it tells you)…

Can you give us more background on the problem? Was it something that occured when you installed SP1? Thanks,

I understand. Since the FlowCorrelation is the table where the traffic is associated with its endpoints, I wouldn't be surprised if charting errors occured without them.

Yes, you should always apply service packs to both the service and web installs.

If you provide us with that information from my last post, we can check if your device is in our MIBs database. If not, we can add it to our database for a future product update. Please let us know. Thanks,

Right. We have identified a performance issue and corrected it for SP1. The changing of the thread count is a means to use extra CPU cycles to try to mitigate around the performance problem, but does not prevent the performance slow down. It took a code change in the service to fix that problem. Thanks,

Can you open Microsoft's PerfMon by going to the Start\Run and type in PerfMon. Then add a new counter called SolarWinds\Raw Packet Queue. Start the service and see it if keeps rising as the memory goes up. This will indicate if the NTA service is receiving so much flow traffic that it can't send it fast enough to the SQL…

Can you defragment both of the drives first? (The drive containing the database and the one with the transaction log) Then execute the following T-SQL on the NetPerfMon database and provide me with the results: DBCC SHOWCONTIG This shows us how fragmented all the indexes in all the tables are. I can look at this and…

You didn't notify me of the upload of your diagnostics dump. Did you get a chance to upload that to LeapFile?

Just a follow up question about different ports. What is the reason that you would like NetFlow to listen on more than one port? Even if you have multiple flows of different protocols (i.e NetFlow and sFlow), you can typically configure all the devices to send the traffic on the same port. Yes, by default NetFlow is sent…

We've seen this issue and here is one potential fix from one of our developers. Let us know if it helps. -----This issue is caused by an interaction between some Orion code and .NET Framework 3.5 SP1 (releasee August 11). You can fix it by making a small change to the website code: Edit…

This would be good to figure out for us after the Service Pack it out. We found a big issue that we addressed in the Service Pack that was thrashing the SQL Server. The Service Pack is in its final stages of testing and we hope to have it to you very soon. Thanks, David

Change of plan. The tech support lead for EOC suggests that you call this in so that we can address your issue quicker. Thanks, David

I believe that he meant Start->Settings->Control Panel->Add or Remove Programs (In Vista it is called "Programs and Features") Thanks,

Here is what I really suggest that you run on the NetPerfMon database instead of truncating the FlowCorrelation table.. DECLARE @CacheExpiration datetime SELECT @CacheExpiration = dateadd(second, 1, LastCacheExpirationCheck) FROM NetFlowCorrelationState UPDATE FlowCorrelation SET CacheExpiration = @CacheExpiration This…

NetFlow data still (including 3.5) is in the same database as Orion, but because it now lives in different FGs, can be stored on other disks. There is no SQL Server requirement that FGs must live on the same RAID array. Now, keep in mind that this technique is an advanced database topic and the ability is not provided…

No. Most of the tables should still live in the PRIMARY filegroup. Only the large sized NTA tables have been moved off into these new filegroups. The tables listed here are in their proper filegroups. Thanks,

So in NTA, we save the traffic if it is ingress traffic to one of the monitored interfaces that you have checked. The egress interface of the traffic is still stored (if the device is sending it in the flows) as long as that interface is managed in Orion. If it is not managed in Orion, then we drop the traffic altogether…

Are you using the latest service packs? If so, can you call Tech Support and get a diagnostics to them? We've addressed this type of issue in our service packs, but if you are up-to-date, then we'd like to investigate what your particular problem is. Thanks, David

Yes, I'm looking at the diagnostics right now. Do you have a backup of the database before the upgrade? It would help us a bunch if we recreate the issue while using SQL Profiler... Ahh... your tech support rep just called me. He is going to assist you in using SQL Profiler to accomplish this. Thanks,

Just to check, but if you go to the "Manage Applications and Service Ports" view, and select the "Disabled Applications" view, do you see any applications show up in the right-hand pane? It was fixed in a prior service pack of NTA 3.0, but we did have the issue where when selecting to monitor all ports, it would only add…

Now don't jump to any conclusions. The code in NetFlow is not going through the nodes on your networks and performing the search. All that NetFlow is doing is calling the Window 32 API called gethostbyaddr(). Here is an explaination the behavior that this Windows API produces.…