Not sure what to make of this. I'm seeing it every few hours.
Not sure what to make of this. I'm seeing it every few hours.
That is the default max size value for the queue that is in NTA queue. This means that the service can't keep up with the NetFlows that it is receiving. For this release, we have some performance issues and are continuing to address them. There are two things that you can do, in an attempt to midigate this issue, if you don't want to loose packets. You can either:
1. Increase the amount of memory that the queue size can use. (This approach will probably still in end up in you loosing packets, it will just take longer before that the queue max is reached.)
2. Increase the amount of CPU that the NTA service is allowed to use to consume the queue.
Both values are located in the following file on a default install:
C:\Program Files\SolarWinds\Orion\NetFlowTrafficAnalysis\NetFlowService.exe.config
In order to make changes, first stop the NTA service called 'SolarWinds NetFlow Service'. Then open the file and look for the following line:
<processingPool threadsPerProcessor="30" packetQueueSize="600" />
The 30 represents the number of threads that can consume the queue. Raising this value will allow the service to use more CPU to process the queue and get its values into the database. Raising this value has prevented other customers from experiencing your issue of the queue reaching its max size. I've seen a customer raise this as high as 70 threadsPerProcessor.
The 600 represents the size in MBs that the queue can grow to.
If you want to monitor the number of items in the queue, then you can open Microsoft's program called PerfMon. In it you can add a counter to monitor the number of items in the NTA service's queue. When adding a counter, you'll see a dialog, in the dialog select "SolarWinds" in the "Performance Object" dropdown combo box, then select "Raw Packet Queue Length" in the listbox, and finally click the "Add" button. Hopefully, as you raise the number of threads that can process this queue, and monitor the queue in PerfMon, you'll see that the queue size gets to a point where its value stablizes and at times even goes down. Due note, that the CPU utilization for the whole computer will increase. You probably should also monitor this in the Task Manager as the same time.
Please note, we still working on addressing the performance issue here. We are in the midst of Service Pack 2 and are continuing to research this issue.
Thank you for your patience here,
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.