27 Replies Latest reply on Jun 16, 2010 7:52 PM by berto

    Netflow Reports,... What's Up?!?

      Anyone else having trouble building netflow reports?  Even when I choose to only show the top 3 in my report, it times out.

      Selected Fields:

      Full Hostname

      Full Name
      SUM of bytes transfered.

      Filter Results:

      Full Name contains vlan40

      Top XX: 3 (I want 25, but that really blows the server up)

      Is it just me, or do the netflow reports totally ****, and are pretty much useless. 

      This is really bad, because us workers LOVE the netflow stats presented on the homepage, but MGMT isnt on the netflow homepage, or navigating the netflow pages of Orion, they just want to see reports.

      Netflow reports must be adressed in the next SP or full release.  The NF reports out of the box are useless. 

      Any custom report using the "Netflow historical" template just times out.

      A real shame too, because the wealth of info in the netflow stats would be great for MGMT to see.  Unfortunatly, they cant because of the current reporting capabilities.

      /end rant

        • Re: Netflow Reports,... What's Up?!?

          i've just upgraded to NTA 3.6 RC - the reports are faster but certainly not ideal yet. what took 20 minutes is down to 5 minutes.

          if Solarwinds NTA developers could match REPORT WRITER's Netflow reports to the Orion Netflow reports then our choices would improve.


          i need to do a Netflow report with only business hours for a week but this isn't readily available in Report Writer and i'm not nearly capable of using Advanced SQL for doing this...

          • Re: Netflow Reports,... What's Up?!?

            I must be missing something or you must have a much larger db than mine (I have 68 interfaces w/ netflow data.  I can run the query on top 50 and it's faily quick from report writer or from Orion web reports.  My guess is you must have hundreds or thousands of interfaces with netflow data or somethings different with hardware/server/storage setup.

            @lchance what's the difference between Report Writers reports and the ones on web under reports?  I'm guessing maybe your talking about the graphs and such we can't include in our reports from under the NTA module???  I completely agree with that.  Nice graphs on webpage but can't be run on scheduled reports seems kinda weak.

              • Re: Netflow Reports,... What's Up?!?

                Hi ecklerwr,

                please can you explain which problems you have with using Orion Report Scheduler an NTA pages? It works fine for me though.


                  • Re: Netflow Reports,... What's Up?!?

                    Thanks for asking Georgiy.  With my size network the reports for NTA run without issue (at least today).  I like the graphs on the webpages.  The only drawback with the reports under reports is that the graphs can't be included on them and scheduled (I know this is a requested feature).  My attempted solution to this has been saving the webpages as a xps file which retains the graphs but loses the colors in the legend boxes for some reason.  I have no idea why this is.  See below example below:

                • Re: Netflow Reports,... What's Up?!?

                  I may not have been specific enough when I created this thread.

                  Let me take some breathes and explain,...

                  We have about 12 netflow sources reporting to orion.  On the website, we can go to netflow sources, pick one particular source, and that pulls up a new page that has all the resource stats for that particular source.

                  So on the Website, there is a great resource called top endpoints.  It lists total bytes, and basically lets you know the top talker on that particular source.

                  I have tried for 3 weeks to create that in a scheduled report.  It seems impossible, as we are limited to only certain option on the report writer.

                  Can anyone (HELLO SW!!! Case 136347!!!) create a report that mirrors the "Top XX Endpoint resource on the web?

                  My reports, with the same time frame selected as the website, have WAAAAAYYY different results.

                  Netflow is pretty useless without good reporting.  MGMT does not look at the website, they could care less.  They would like a daily report though, that list the top talker on a specific Netflow source. 
                  Seems impossible. 
                  PLEASE HELP. 

                    • Re: Netflow Reports,... What's Up?!?

                      Hi Mike--

                      I'm trying to get you some help here. If you will stay tuned, I'll get back to you. It will be tomorrow.


                        • Re: Netflow Reports,... What's Up?!?

                          Hi Mike--

                          We have escalated you issue in support and they should be contacting you. Also, as an FYI, NTA development is working to resolve the report issue in the next release.



                            • Re: Netflow Reports,... What's Up?!?

                              Thanks, that is good to know.

                              I just dont understand how the website can parse the DB info and have pre-determined fields for "top convos, top enpoints, etc" but the report writer is limited in how it can parse the netflow DB info.

                              Doesnt really make sense, that I can get on the website, open the netflow page, and quickly see the top talkers on a given netflow source, yet the report writer, which all MGMT is interested in, can not perform this simple function.


                              Thanks for the heads up.

                                • Re: Netflow Reports,... What's Up?!?

                                  Hey Mike--

                                  Please know that your request is noted and I'll make sure the product manager sees it.


                                    • Re: Netflow Reports,... What's Up?!?


                                      ReportWriter is generic tool which is able to compose SQL queries dynamically according virtual db schema prodived by modules. So, it's able to use only items which is defined in this schema and it can combine only items if there is defined some relations between them.

                                      In opposite, web site uses direct access to DB, so there is no limitation or cooperation with ReportWriter. We are trying to keep ReportWriter to be sync with web, but ... .


                                      So for now you can use in ReportWriter two reports. Top XX Transmitters and Top XX Receivers. These two together are actually Top XX Endpoints.



                                        • Re: Netflow Reports,... What's Up?!?


                                          Thanks for the technical explination, but I dont believe you can use the report writer to get top recievers.

                                          When creating a new report using the Netflow Endpoint template, the only "traffic" field is for bytes transferred.

                                          There is no bytes recieved field.

                                          Has something changed with a the latest Netflow upgrade (3.5) because I am SURE that we used to have a report created, and emailed daily that listed the top talkers on a given netflow source.

                                            • Re: Netflow Reports,... What's Up?!?

                                              You need to add some fields from Receiver section in popu menu, so it will query Bytes and SourceIP for instance.

                                              Actually Top XX Receiver report is already predefined in NTA installation.

                                                • Re: Netflow Reports,... What's Up?!?

                                                  My Mistake ET,

                                                  I see what you are refering to now.  Not creating a new report using the netflow endpoint template, but using the report out of the box, "top XX receiveres".


                                                  Sorry about the confusion.  It would be nice if the report writer had the same DB parsing capibilities are the website. 
                                                  The top xx endpoints resource on the website would make an EXCELLENT report to send to MGMT.  

                                                  Thanks for the heads up 

                                                    • Re: Netflow Reports,... What's Up?!?

                                                      Hi Guys,

                                                      I still don't have 3.6 RC in my software portal

                                                      Can you help me with a link so that i can try this version? I am very keen in resolving CBQOS issues and have already seen a demo of this new version?




                                                      • Re: Netflow Reports,... What's Up?!?

                                                        Hi AlbanyNY,

                                                        let me mention that I understand your dissatisfaction with the current reports provided by Report Writer. This is something we are considering now for future release.

                                                        You've mentioned that requesting Web-pages through Orion Scheduled reports doesn't work for you, despite it should work flawlessly. Please can you describe what problems you have in this scenario, I know that many customers use it successfully (you even can create special view and put NetFlow resources there with No Chart style, so you can print only Top table, without chart)


                                                          • Re: Netflow Reports,... What's Up?!?

                                                            hi GZhytar,

                                                            Thanks for the tips.  For the record, we have dozens of schedule reports that get emailed daily and all works well for that.

                                                            The problem is specifically with Netflow reports.  Either custom ones that I create using the netflow endpoint template, or the default netflow reports.  When I try to run one of the default netflow reports (top 50 transmitters last 24 hours), it takes about 30 minutes to create, and sometimes just hangs and becomes unresponsive.  If I try to filter this report to only show from certain netflow sources, it times out.  If I try to limit to just top 5, it times out.  Only netflow reports.

                                                            I have tons of other reports that we created from scratch, and use the report scheduler to email to MGMT.  All is well there. 

                                                            All I want is to be able to send a report to MGMT that has the Top Endpoints on  specific netflow sources.  This is done very easily with the website, as all we need to do is select a netflow source, and it will show the top endpoints for that source. 

                                                            Also, a top convo for particular netflow sources would be great.  again, this is done very simply on the website, as the top endpoints and top convos are listed right there.
                                                            This is pretty much impossible to do with the report writer, and its a shame.

                                                            Unless Im missing something, which may very well be the case, but it is IMPOSSIBLE to get a report from report writer to give :

                                                            TOP CONVOS, and let us filter netflow source.

                                                            TOP ENDPOINTS, and let us filter netflow source.





                                                            Seems like it should be a no brainer, but it is infact extremly difficult.

                                                              • Re: Netflow Reports,... What's Up?!?


                                                                let me clarify a little bit. Orion report scheduler allows you to print/send via email web pages (basically any url from a Orion Web console), generated by Orion Web console. As I understood, NetFlow resources in a Web console work fine for you, so you can schedule this Web pages to be automatically generated and send to MGMT.

                                                                Please let me know if you need guidelines on how to do that.


                                                                  • Re: Netflow Reports,... What's Up?!?


                                                                    Is there link in thwack somewhere to how to email the netflow webpage graph urls in scheduled email for netflow reports?  I thought some of the netflow graphs were built on the fly so wouldn't show up... for example the ones from the traffic builder graphs.

                                                                      • Re: Netflow Reports,... What's Up?!?


                                                                        not sure about thwack, but you can read this in Orion Administration Guide - Chapter 11 Creating Reports - Scheduling Reports.

                                                                        You are right, traffic builder creates graphs on a fly, but all needed information is encapsulated into URL, so it can be scheduled via Report Scheduler.

                                                                        When you pick up link in Report Scheduler, window with Orion Web Console is opened, so you can log in into Web console, build needed View with Traffic builder and save it by clicking Use Current URL. I've attached a screen shot that should help you here.


                                                                          • Re: Netflow Reports,... What's Up?!?

                                                                            The reports i created from this method have missing pictures and the hyperlinks are not working.

                                                                            I have multiple websites and they cant consolidate into a single mail.

                                                                            My preference is actually to export into pdf and mail as attachment rather than embedded it into the email.

                                                                      • Re: Netflow Reports,... What's Up?!?

                                                                        I thought I was onto something but it does not match what I see on the webpage top talkers... not even close:

                                                                        this ran with following filter:

                                                                        I share ur pain Mike

                                                                  • Re: Netflow Reports,... What's Up?!?

                                                                    Those "out of the box" netflow reports (top transmitters , top receievers) are epic fails.

                                                                    Report writer times out, hangs, and just doesnt work.  I tried changing it from top 50 to top 25 to top 10 to top 5.  No luck.

                                                                    I tried applying a filter.  No luck.

                                                                    I think we are just going to go with out netflow and give up.

                                                                    The netflow views on the website are GREAT for us network techs, but MGMT doesnt look at that.  

                                                                    in order for us to initally purchase netflow, we had to sell MGMT that we would be able to send them daily reports for top talkers on a given network. 

                                                                    Now that does not seem to be the case, MGMT surelly will not update maintenace. 

                                                                    Thanks to everyone who tried to assist, and SW still has the best network monitoring suite in the game.
                                                                    They jsut fell a little short on the reporting, in the netflow portion.


                                                                    Oh, my netflow report finally generated.  It only took 23 minutes to get the top 5 transmitters on one of our netflow sources.   now I just need to generate the same report for receivers on this netflow source.
                                                                    After that, only 14 more netflow sources (28 reports) to go. 

                                                                    This should be fun!


                                                    • Re: Netflow Reports,... What's Up?!?

                                                      I have to do a weekly report about endpoints, receivers and  transmitters for every site, but take infinite amount of time to complete my manager are claim their reports but y can generate it. Helpppp!!!!!!!!

                                                        • Re: Netflow Reports,... What's Up?!?

                                                          Once again, If only report writer could parse the netflow data the same way the website does.

                                                          I can pull up my top convos, apps, transmitters, and recievers for a given netflow source in seconds on the website.  i DARE you to create that report in report writer.  You cant, its impossible.

                                                          Yes, we can grab the website URL and paste it into the report scheduler, but as another poster pointed out, the email looks horrible with broken links / missing pics, etc. Plus, you would need a seperate report for each NetFlow source, as you cannot have the 2 webpages on one report.

                                                          I am aware there are some very deep and involved methods of getting this to work, (creating a webpage in Orion, and plugging in the 'portlets' desired, copying that new URL into report scheduler, etc...

                                                            • Re: Netflow Reports,... What's Up?!?

                                                              I would also like to see some improvement / development on both Netflow reporting and the Report Scheduler.

                                                              I followed the suggestion to use Report Scheduler as a workaround after being frustrated with Netflow reporting. I was then frustrated with some of the authentication integration setup which is probably more of a windows task scheduler "issue" with Report Scheduler.

                                                              I don't necessarily like how users can click on the links and consume resources when these reports take a while to generate anyways.  The square icons indicating the color codes also don't seem to show up for me. The image that it wants to download when it works via the actual http address is called ColorImageGenerator.jpg  Am I missing something here?

                                                              The Netflow side of reporting doesn't feel "enterprise" and requires too many workarounds. I definitely vote for this to be considered more thoroughly in the next couple revisions, please. :)