4 Replies Latest reply on Jul 28, 2008 10:38 AM by Andy McBride

    Unmonitor All not working??


      Does the "Unmonitor all" function work in NetFlow v3?

      When I check the box, a window opens saying that all port monitoring will be discontinued if I click on the button below. But, the button says "Monitor All TCP/UDP Ports". That doesn't make sense anyway!

      Regardless of whether I click on this button or click Cancel, the monitored port totals don't go to zero and the "Monitor All" button remains checked.

      Is this a bug?

        • Re: Unmonitor All not working??
          mark wiggans

           This looks like a bug. Unmonitor All is going back to the default and not zero.

          • Re: Unmonitor All not working??

            The "Monitor All TCP/UDP Ports" button is misworded.  Also the "Monitor All" button icon is just an icon and doesn't represent the current state (i.e. being checked or not).  Both of these just need to be changed.  The first just being wrong and the second causes confusion.

            As for the monitored port totals, the changes made here to monitor or unmonitor, doesn't modify existing data.  It only affects how the NTA service collects and stores data from that point onward.

            Lastly, there is a behavior in NTA that when a user clicks to monitor all TCP/UDP ports then new applications are added but disabled applications don't become enabled.  (We intend of changing this behavior in a future version)



              • Re: Unmonitor All not working??

                Thanks for the replies folks. Let me see if I can piece together what "normal" operation is for this functionality.

                As I recall, after initial installation, there are a certain number of ports (number?) enabled for monitoring by default. I noticed that if I click on the "Unmonitor All" button, open the ServicePorts table in the DB Manager, I see that ports -1 and 0 are enabled and no others. If I then go back to the NetFlow Settings and select "Monitor All", then it adds many additional unmonitored ports with the format "Port X" and inserts them into the table. I also noticed that the total of ports monitored listed on the "Manage Application and Service Ports" pweb page is something like 80000 ports or thereabout.

                Does all this constitute "normal" operation for NetFlow v3?

                What determines the list of enabled ports that are set up as default at installation?

                  • Re: Unmonitor All not working??
                    Andy McBride

                    Hi freemen,

                     Yes - what you described is normal behavior. I would recommend monitoring only the ports/apps you are concerned with. Monitoring all does make a very large number of ports and can cause you to have a very large NetFlow db. The default list is one we have instituted as commonly applied ports. These can be different in different environments which is why we supplied the flexibility to add and remove ports.