2 Replies Latest reply on Dec 12, 2016 1:38 PM by jxchappell

    Receiving Netflow From unmanaged interfaces with extremely high index numbers

    scubadvr

      NTA 4.2.0, NPM 12.0

       

      I'm receiving thousands of NTA error messages from a handful of routers with the unmanaged interface numbers being bogus (i.e., extremely high interface numbers.)

       

      Here are a couple of instances from one of the nodes where this is currently happening:

       

      12/9/2016 7:43 AM    NetFlow Receiver Service [STLWSOLPOLPRD09] is receiving flow data from unmanaged interface '#1936291840' on Router1 and it does not support SNMP. Click the "Add this interface" to manage interface and process its flow data. 
      12/9/2016 7:43 AM    NetFlow Receiver Service [STLWSOLPOLPRD09] is receiving flow data from unmanaged interface '#543977327' on Router1 and it does not support SNMP. Click the "Add this interface" to manage interface and process its flow data. 
      12/9/2016 7:43 AM    NetFlow Receiver Service [STLWSOLPOLPRD09] is receiving flow data from unmanaged interface '#1634299424' on Router1 and it does not support SNMP. Click the "Add this interface" to manage interface and process its flow data.

       

      In the case of this router alone, these error messages will number in the mid- 6,000s for the day.  Multiple this by at least 6 nodes for which I've noticed this, and it's a lot of processing that the system is doing for what appear to be bogus interfaces in the Netflow data.  This also causes the Windows Application Event log to roll several times per day, as each of these events is logged.  Also, the Netflow service on the poller is dying and restarting multiple times per day, which may or may not be caused by this issues (separate case open for that already).

       

      The only thing I can find common to these nodes is they are all Cisco ISR 4351s.  I could find nothing in Cisco's bug reports related to Netflow and interface indexes, so hoping someone else has encountered this and knows of a fix/workaround.

       

      Many thanks!