7 Replies Latest reply on Jun 11, 2010 11:14 AM by Jan.Krivanek

    Netflow application collision error message

    hjarriell

      For some reason NetFlow stopped reporting data on all but two of our routers for abou two hours.  So far only errors at the times of the issue are like what is below, although these errors where happening even before data stopped.  But haven't occurred since the issue seems to have cleared up.  Anyone seen this type of message before.  It's from the swdebug.log:

      [STP SmartThreadPool Thread #45] ERROR  SolarWinds.Orion.NetFlow.ApplicationManager - Single port application  collision 100003 x 100007

        • Re: Netflow application collision error message

          Hello hjarriel,

           

          The message in log is unrelated to your problem.

          That application collision means that your NTA receiver received flow reporting packet going trough port for which there is not a unique application (in your case this packet can be interpretted as belonging to application with id 100003 or 100007, and will be in future interpreted just as a packet belonging to aplication with id 100003).

          In your case, there could be a problem with firewall, unmanaging of node (e.g. due to IP address change) or something like this. Do you still see your nodes in Netflow Sources on Summary page? Arn't there some messages in Last 25 events about unmanaged nodes or unmonitored interfaces?

          Regards
          Jan 

            • Re: Netflow application collision error message
              hjarriell

              We did still see the nodes, and they were updating thier date and time of most recent flow, but when we clicked to see the info, it would show no traffic for that 2 hours.  Yes, there were some messages about getting flow from unmanaged interfaces.

                • Re: Netflow application collision error message

                  Hello hjarriell,


                  So If I understand it right, you were able to see problematic node in your Netflow Sources and it was continually updating time of last received flow, but when you clicked this node, you did not see any data?


                  If the node (and its interface(s)) is visible in Netflow Sources and is updating “last received time” it means that this node (interface) is managed, so this should not be a problem (only if you do not see problematic  node/interface in Netflow Sources with Netflow enabled, you need to manage it first).


                  In your case I see one possible problem – currently we do not support scenarios with different times on service/ database/ web console – all these sites need to have same time, otherwise you can experience behavior similar to what you described.


                  If even this is not your case and you are under maintenance, then I would recommend opening support ticket, so that we can closer investigate your case.


                  Regards
                  Jan

                    • Re: Netflow application collision error message
                      hjarriell

                      I was mainly interested in the cuase of the error message in the original post. 

                      I have had a ticket open before about Netflow data being collected but not displayed till later (although it was like 20 minutes delay before), could never recreate the issue since by the time support contacted us to investigate the data was showing up.  They figured it's an overworked database.

                      I just looked for the time frame we where having issues before and it is showing data now.

                       

                      Thanx again.

                        • Re: Netflow application collision error message

                          Hello hjarriell,

                          Yeah, overworked DB can also seem as cause of temporarily missing data.

                          As to your original question to applications collisions - You can list all ports in collision along with applications that are defined for these ports by running following two queries (And then basically decide which of the applications in collision should be defined by port in collision and change the settings of application in Netflow Settings)

                          SELECT DISTINCT a.*, ap.Port

                          FROM

                          (

                                SELECT Port, COUNT(Port) as cnt FROM NetFlowApps a

                                      INNER JOIN NetFlowAppPorts ap ON a.AppID=ap.AppID

                                GROUP BY Port, a.UDP

                                HAVING COUNT(Port)>1 AND (a.UDP=1) 

                          ) as DATA

                          JOIN NetFlowAppPorts ap ON ap.Port=DATA.Port

                          JOIN NetFlowApps a ON a.AppID=ap.AppID AND a.UDP=1

                          ORDER BY ap.Port

                           

                          SELECT DISTINCT a.*, ap.Port

                          FROM

                          (

                                SELECT Port, COUNT(Port) as cnt FROM NetFlowApps a

                                      INNER JOIN NetFlowAppPorts ap ON a.AppID=ap.AppID

                                GROUP BY Port, a.TCP

                                HAVING COUNT(Port)>1 AND (a.TCP=1) 

                          ) as DATA

                          JOIN NetFlowAppPorts ap ON ap.Port=DATA.Port

                          JOIN NetFlowApps a ON a.AppID=ap.AppID AND a.TCP=1

                          ORDER BY ap.Port