cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 7

Netflow is killing my server, why?

It appears that way. But CPU and other metrics don't show the CPU pegged at 100% or even 50%.

Have orion 8.51sp3 with monitoring 162 nodes, 4,071 interfaces.

Netflow 2.2.1  is pulling data on  52 interfaces.

server is
Processor Name:Intel(R) Xeon(R) CPU 5160 @ 3.00GHz (Dual Core)
Memory Installed:

4,094.98 MB

have my sql 2000 database on another server is a 4 cpu box with 4gigs of ram.  netflow collection and sql are NOT on the same server. T

Trying to move around in an RDP session in npm  or even Cirrus is sluggish with netflow service running. But taskman cpu does not show high utilization. If I stop netflow service, the lag which is about 1-2 seconds is gone. 

The mystery here is I don't have the cpu getting crushed at 40-80%. The gigE interface is not even being pushed at 1%.

 Where do I start trying to narrow down where my issue is? I only keep netflow data for 24 hours.

Thanks

0 Kudos
18 Replies
Level 19

Hi d-moore,

how is memory doing with the Netflow service running? Sounds like you have the potential for a large flow rate which can eat up resources.

Andy

0 Kudos

Thanks for asking, but I dumped your netflow services for Scrutinizer.  It gives me more detail and I can run it on another lower powered server.  Since I don't need to keep NF data more than 24 hrs, it isn't an issue to me that the freeware version dumps the data after 24hrs.

I am still running old reliable Orion  8.5.1.  Plan to upgrade to 9.1 next year now that everyone has had a change to "debug it" on thier production systems.  🙂

0 Kudos
Level 11

NetflowService.exe is still a CPU hog on my SLX.

Even with 2 Xeon Dual core 3.00ghz, it is using 65% of the CPU.

It sure would be nice to move the process to another poller.

0 Kudos

Hi Bruce,

We are looking at some architecture changes that will allow a second collector to off load the work. No dates to share at this point but we understand this can be an issue and are addressing it. The additional collector available today is designed for reachability issues and won't help much for processor.

Andy

0 Kudos
Level 7

Question: what OS are you running your RDP session from?  I'm guessing Vista because I had the same problem the first time I ran RDP after a new Vista install.   This article saved my bacon.  Basically, Vista RDP uses a new feature called "auto-tuning for the TCP/IP receive window", and it is BROKEN!!!  As soon as I disabled it, all RDP slowness went away.  You disable it by Running a command prompt (cmd.exe) as an Administrator, and type "netsh interface tcp set global autotuninglevel=disabled".

 Let me know if that fixed it...  -Scott
 

0 Kudos

Vista? what is that? There are actually people who run the WindowsME of 2006? 😉


 WinXP all the way. Skipping VistaME and going to Windows7 when it is released.


Thanks for the article, till I read it, would have called you crazy saying RDP and vista have issues.


 Again, blame microsoft for release a product that wasn't read yet.


 My problem was solved by  purging my SQL database, shrinking it and limiting the growth of it.


0 Kudos
Level 13

Check your physical memory utilization on the box, maybe something's eating your RAM. 

0 Kudos

nope. not the issue.  About 800meg being used by all  53 services on the box. Avail physical "ram" is about 3gigs, with pagefile ram is about 6gigs


Netperfmon about 215megs, w3wp.exe (iis) about 110megs, netflow around 45-50megs, etc

0 Kudos

Something else has to be at work, then.  See if you get any more information using this tool:

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

0 Kudos

Could the issue be disk I/O on the SQL server? That's what killed us when we brought NTA online. We had to move the Orion database onto a 4GB Fibre Channel EMC SAN RAID 10 volume built on 15k drives to relieve the I/O bottleneck that was created by adding NTA.

How many other hosts are on the same san controller?


0 Kudos

How many other hosts are on the same san controller?


Who is this question for?

0 Kudos

aLTeReGo


We are having data problems with our san and I wondered how many other hosts are on the same controller the solarwinds database host is on?


Also, what has been the max disk write bytes/sec for the logical drive of the data drive?


 


0 Kudos

We are having data problems with our san and I wondered how many other hosts are on the same controller the solarwinds database host is on?

Also, what has been the max disk write bytes/sec for the logical drive of the data drive?



 I'm struggling a little to answer your question since I'm not sure I completely understand it. We have our Orion SQL Server on dedicated hardware, not virtualized, There are two host bus adapters "HBA's" in the machine running EMC's PowerPath for redundancy. The HBA's are connected to two different Brocade switches that are then connected to our EMC SAN.

Does any of that help to answer your question? If not I'm happy to answer any follow-up questions.

0 Kudos

Do you mean network I/O between the NTA collector and the SQL server?  That could definitely be the issue.  The NTA service is going to be pretty chatty when it comes to communicating with the SQL server. 

0 Kudos

Do you mean network I/O between the NTA collector and the SQL server?

No, I was referring to the Disk I/O. Writes while the data is being collected, and I/O reads when viewing the information on the web.

0 Kudos

Fair enough; however, neither of those should be affecting the box that the NTA collector lives on.

0 Kudos

Thanks, that is what I am going to check next.  The box is running Win2k with Sp4, but it is a beefy box.

0 Kudos