5 Replies Latest reply on Jun 12, 2008 1:22 PM by branfarm

    Netflow chart problem


      Hi all. I've been running NTA v3 SP1 for about a month now and haven't had any serious problems.  Last night I added a new node to Netflow and now I am seeing all sorts of weird data from this node, including a transferred bytes chart that shows negative:


      I'm also receiving the infamous "Stacked Chart" error. My problems only seem to exist when I drill down to the new device using an IP Address Group filtered view.  The netflow source is a Cisco 4506, and here are the netflow config lines I"m using:

       ip route-cache flow infer-fields
      ip flow ingress infer-fields
      ip flow ingress layer2-switched
      ip flow-export source <interface>
      ip flow-export version 5
      ip flow-export destination <orion host> 2055



        • Re: Netflow chart problem

          This is very good information.  Thank you for documenting it in such detail.  Can you look through your details table for this new node and see if the TotalBytes column has negative values?  If so, then this would help rule out the web page code for being at fault.  For this chart, and from what you know of your network traffic, were you expecting the negative values to be high peaks of traffic maybe? 

          I have just done some code testing and if the device is reporting its NumberOfLayer3Octets with its highest bit set (of 32 bits), then I am seeing negative values.  And from looking at the range of your data, it appears that you probably are getting values above 2,147,483,647 bytes. 

          This is definately a bug and I think it is a fairly simple fix.  Can you call our tech support to log this, that way we can make this a priority to fix.



            • Re: Netflow chart problem

              By the way, if you don't which NetFlowDetails_x table to look in, tech support will be able to help you with that. 

                • Re: Netflow chart problem

                   I ran the following query against the Node details table for the new node and it only returned one row. I'm not much of a SQL guru, so I might be missing something:

                   select * from NetFlowDetail_7 where TotalBytes < 0;


                  The one column that returned had a TotalBytes of -2.117455E+09.


                  I just submitted a support request for this.


                  Also, I was looking around and I found that I would receive the Stacked chart error even if I clicked on the Netflow Node name from the NTA summary page.


                    • Re: Netflow chart problem

                      It probably is because you've had the service running.  The data in the details table, by default only stays there for 1 hour.  That fact that you found negative data in there indicates that the issue is with the NTA service (the collector) and not with the web page.  I am pretty confident that this is the issue that I was describing.  I've directed my dev team to enter a bug report for this issue.  I'll have tech support attach your ticket number to it.  This way it will get addressed sooner.  Unfortunately, at the moment, I can not think of a workaround though.