This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Packet Queue size reached its maximum value [600 MB]. Incoming packets will be dropped.

Not sure what to make of this.  I'm seeing it every few hours.

  • That is the default max size value for the queue that is in NTA queue.  This means that the service can't keep up with the NetFlows that it is receiving.  For this release, we have some performance issues and are continuing to address them.  There are two things that you can do, in an attempt to midigate this issue, if you don't want to loose packets.  You can either:


    1. Increase the amount of memory that the queue size can use.  (This approach will probably still in end up in you loosing packets, it will just take longer before that the queue max is reached.)


    2. Increase the amount of CPU that the NTA service is allowed to use to consume the queue.


    Both values are located in the following file on a default install:


    C:\Program Files\SolarWinds\Orion\NetFlowTrafficAnalysis\NetFlowService.exe.config


    In order to make changes, first stop the NTA service called 'SolarWinds NetFlow Service'.  Then open the file and look for the following line:


      <processingPool threadsPerProcessor="30" packetQueueSize="600" />


    The 30 represents the number of threads that can consume the queue.  Raising this value will allow the service to use more CPU to process the queue and get its values into the database.  Raising this value has prevented other customers from experiencing your issue of the queue reaching its max size.  I've seen a customer raise this as high as 70 threadsPerProcessor. 


    The 600 represents the size in MBs that the queue can grow to.


    If you want to monitor the number of items in the queue, then you can open Microsoft's program called PerfMon.  In it you can add a counter to monitor the number of items in the NTA service's queue.  When adding a counter, you'll see a dialog, in the dialog select "SolarWinds" in the "Performance Object" dropdown combo box, then select "Raw Packet Queue Length" in the listbox, and finally click the "Add" button.  Hopefully, as you raise the number of threads that can process this queue, and monitor the queue in PerfMon, you'll see that the queue size gets to a point where its value stablizes and at times even goes down.  Due note, that the CPU utilization for the whole computer will increase.  You probably should also monitor this in the Task Manager as the same time.


    Please note, we still working on addressing the performance issue here.  We are in the midst of Service Pack 2 and are continuing to research this issue. 


     Thank you for your patience here,


     


  • Thanks for the heads up - i`ve recently applied SP1 and still experiencing BAD performance to the point im considering disabling the Netflow module completely.

  • Hang in there a little longer - SP2 will be coming down the pipe soon and it deals w/ performance.

  • Yes, we're not suprised on this end.  We didn't have much time in SP1 to address the performance and as a result the performance was still about the same.