This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Netflow chart problem

Hi all. I've been running NTA v3 SP1 for about a month now and haven't had any serious problems.  Last night I added a new node to Netflow and now I am seeing all sorts of weird data from this node, including a transferred bytes chart that shows negative:

 

I'm also receiving the infamous "Stacked Chart" error. My problems only seem to exist when I drill down to the new device using an IP Address Group filtered view.  The netflow source is a Cisco 4506, and here are the netflow config lines I"m using:

 ip route-cache flow infer-fields
ip flow ingress infer-fields
ip flow ingress layer2-switched
ip flow-export source <interface>
ip flow-export version 5
ip flow-export destination <orion host> 2055

 


 

  • This is very good information.  Thank you for documenting it in such detail.  Can you look through your details table for this new node and see if the TotalBytes column has negative values?  If so, then this would help rule out the web page code for being at fault.  For this chart, and from what you know of your network traffic, were you expecting the negative values to be high peaks of traffic maybe? 


    I have just done some code testing and if the device is reporting its NumberOfLayer3Octets with its highest bit set (of 32 bits), then I am seeing negative values.  And from looking at the range of your data, it appears that you probably are getting values above 2,147,483,647 bytes. 


    This is definately a bug and I think it is a fairly simple fix.  Can you call our tech support to log this, that way we can make this a priority to fix.


    Thanks!


     

  • By the way, if you don't which NetFlowDetails_x table to look in, tech support will be able to help you with that. 

  •  I ran the following query against the Node details table for the new node and it only returned one row. I'm not much of a SQL guru, so I might be missing something:

     select * from NetFlowDetail_7 where TotalBytes < 0;

     

    The one column that returned had a TotalBytes of -2.117455E+09.

     

    I just submitted a support request for this.

     

    Also, I was looking around and I found that I would receive the Stacked chart error even if I clicked on the Netflow Node name from the NTA summary page.

     

  • It probably is because you've had the service running.  The data in the details table, by default only stays there for 1 hour.  That fact that you found negative data in there indicates that the issue is with the NTA service (the collector) and not with the web page.  I am pretty confident that this is the issue that I was describing.  I've directed my dev team to enter a bug report for this issue.  I'll have tech support attach your ticket number to it.  This way it will get addressed sooner.  Unfortunately, at the moment, I can not think of a workaround though.

  •  Sounds good. Thanks for looking into the issue. Please let me know if you find a fix or release a patch of somekind.

     

    Thanks