DX Infrastructure Management

  • Private Community
Back to Library

NFA 9.1.2 Troubleshooting No Data In a Two Tier, Three Tier, and StandAlone environments 

Apr 17, 2013 05:47 PM

Verify Data Collection in a Two-Tier Distributed Deployment

 

Ensure that the appropriate data files are collected in a two-tier distributed deployment by verifying that Harvester servers have valid .tbn, .nfa, rpr.cmp, and .rpa15 files.

Note: If the .tbn, .nfa, rpr.cmp, and .rpa15 files files are not present, wait for an hour and check again.

Follow these steps:

  1. Verify that valid Time BIN (.tbn) files are present on the Harvester server:

    You know that the Harvester is receiving flow data when you see .tbn files that are larger than 0 KB.

    Note: If the Harvester is not receiving data, verify that it listens for data on the same port that was used to configure flow export from the Harvester interfaces. If the ports do not match, modify the NetflowPacketListenPort value in the Harvester database parameter_descriptions table (harvester.parameter_descriptions). For more information, see Set Up the Routers.

    1. Locate the following directory on the Harvester server: <NFA_install_path>\Netflow\datafiles\HarvesterWork.
    2. Verify that the HarvesterWork directory contains files that are named <numeric_value>-<port_number>_0.tbn.inc and that the files are larger than 0 KB.

      The directory also may contain files with a .tmp extension.

    3. Repeat these steps for any additional Harvester servers.
  2. Verify that valid NetFlow archive (.nfa) files are present on the Harvester server:
    1. Locate the following directory on the Harvester server: <NFA_install_path>\Netflow\datafiles\HarvesterArchive.
    2. Verify that the HarvesterArchive directory contains valid NetFlow archive files--that is, .nfa files that are larger than 0 KB in size.
    3. (Recommended) If you do not find valid .nfa files, complete the following troubleshooting tasks:

      To change the logging level for the harvester-wrapper.log, modify the harvester.properties file at <NFA_install_path>\Netflow\bin. Change enableDebugLogging=false to enableDebugLogging=true.

      • Verify that the CA NFA Harvester service is running. If the service is not running, start it.
      • Review the harvester-wrapper.log files in the following directory: <NFA_install_path>\NetFlow\Logs. If you consult with CA Support for a resolution, supply this log or refer to the errors in it.
    4. Repeat these steps for any additional Harvester servers.
  3. Verify that valid Compressed Reaper (.rpr.cmp) files are present on the Harvester server:
    1. Locate the following directory on the Harvester server: <NFA_install_path>\Netflow\datafiles\ReaperWork.
    2. Verify that the ReaperWork directory contains valid Reaper files--that is, .rpr.cmp files that are larger than 1 KB.

      The .rpr.cmp files are removed from the directory at 15-minute intervals.

    3. (Recommended) If you do not find valid rpr.cmp files, perform the following troubleshooting tasks:
      • Verify that the CA NFA Reaper service is running. If the service is not running, start it.
      • Review the Reaper log files (RealtimeReaperErrors<timestamp>.log files) in the <NFA_install_path>\NetFlow\Logs directory. If you consult with CA Support for a resolution, supply this log or refer to the errors in it.
        To change the logging level, modify the extended_Parameters_view of the harvester database. The logging level is set in the following property: RealTimeReaper/Error Logging_File Logging/Severity.
    4. Repeat these steps for any additional Harvester servers.
  4. Verify that valid Reaper archive (.rpa15) files are present on the Harvester server:
    1. Locate the following directory on the Harvester server: <NFA_install_path>\Netflow\datafiles\ReaperArchive15\<Router_IP_address>\<24-Hour_timestamp>.
    2. Verify that the directory contains valid Reaper archive files--that is, .rpa15 files that are larger than 0 KB in size.

      You know that the Harvester is aggregating 15-minute data when you see .rpa15 files that are larger than 0 KB.

<!---->

 

 

Verify Data Collection in a Three-Tier Distributed Deployment

Ensure that the appropriate data files are present in a three-tier distributed deployment by verifying that:

  • Harvester servers have valid .nfa and .rpr.cmp files.
  • DSA servers have valid .rpa15 files.
  • (Recommended) Excessive quantities of .rpr files have not accumulated on the servers for the Harvesters, the DSAs, and the NFA console.

Note: If the .nfa, .rpr.cmp, and .rpa15 files are not present, wait for an hour and check again.

Follow these steps:

  1. Verify that valid NetFlow archive (.nfa) files are present on the Harvester:
    1. Locate the following directory on the Harvester server: <NFA_install_path>\Netflow\datafiles\HarvesterArchive.
    2. Verify that the HarvesterArchive directory contains valid NetFlow archive files--that is, .nfa files that are larger than 0 KB in size.

      You know that a Harvester is receiving flow data when you see .nfa files that are larger than 0 KB.

    3. Repeat these steps for any additional Harvester servers.
  2. If valid .nfa files are not present on the Harvester servers, complete the following troubleshooting tasks:
    • Verify that the CA NFA Harvester service is running. If the service is not running, start it.
    • (Recommended) If a Harvester is not receiving data, verify that it listens for data on the same port that was used to configure flow export from the Harvester interfaces. If the ports do not match, modify the NetflowPacketListenPort value in the Harvester database parameter_descriptions table (harvester.parameter_descriptions). For more information, see Set Up the Routers.
    • Review the harvester-wrapper.log file in the following directory: <NFA_install_path>\Netflow\Logs. This log contains .nfa file generation statistics and records the number of flows that are collected and processed each minute.
      1. Check the harvester-wrapper.log for either of the following problems:

        All of the following four sections are present: Collection Stats, FlowArchiver Stats, Binning Stats, and HarvesterFlowProcessor. If the Harvester is running correctly, the log includes all four sections.

        The log indicates that the CA NFA Harvester service is not running.

      2. If you find either problem, restart the CA NFA Harvester service, repeat Step 1.
  3. Verify that valid Compressed Reaper (.rpr.cmp) files are present on the Harvester server:
    1. Locate the following directory on the Harvester server: <NFA_install_path>\Netflow\datafiles\ReaperWork.

      The .rpr.cmp files are removed at 15-minute intervals.

    2. Verify that the ReaperWork directory contains valid .rpr.cmp files--that is, .files that are larger than 1 KB in size.
    3. Repeat these steps for any additional Harvester servers.
  4. Verify that valid Reaper archive (.rpa15) files are present on the DSA server:
    1. Locate the following directory on the DSA server: <NFA_install_path>\Netflow\datafiles\ReaperArchive15\<Router_IP_address>\<24-Hour_timestamp>.
    2. Verify that the directory contains valid Reaper archive files--that is, .rpa15 files that are larger than 0 KB in size.

      You know that the DSA is receiving aggregated 15-minute data when you see .rpa15 files that are larger than 0 KB.

    3. Repeat these steps for any additional DSA servers.
  5. (Recommended) Verify that the Reaper files on the Harvester server are picked up as expected:
    1. Locate the following directory on the Harvester server: <NFA_install_path>\Netflow\datafiles\NFMInput.
    2. Verify that the NFMInput directory does not contain an excessive number of .rpr files.

      The .rpr files accumulate at a rate of 8 per minute and are typically removed within a minute of their creation. If you see 50 or more .rpr files in the NFInput directory, the NFA console has not picked up the files for a few minutes. If the problem continues, the number of files increases.

    3. If the .rpr files continue to accumulate for an extended time, perform the following troubleshooting tasks:

      If you consult with CA Support for a resolution, supply these logs or refer to the errors in them.

      • Verify that the CA NFA File Server service is running on the Harvester server. If the service is not running, start it.
      • Review the fileserver-wrapper.log file in the following directory on the Harvester server: <NFA_install_path>\Netflow\logs.
      • Review the pumpservice-wrapper.log file in the following directory on the NFA console server: <NFA_install_path>\Netflow\logs.
  6. (Recommended) Verify that the NFA console server does not have excessive quantities of Reaper files:
    1. Locate the following directory on the NFA console server: <NFA_install_path>\reporter\datashare\data\<DSA_ID>.
    2. Verify that the directory does not contain an excessive number of .rpr files. If you see 50 or more .rpr files in the directory, the DSA has not picked up the files for a few minutes. If the problem continues, the number of files increases.
    3. If the directory contains an excessive number of .rpr files, perform the following troubleshooting tasks:
      • Verify that the CA NFA Pump service is running on the corresponding DSA server. If the service is not running, start it.
      • Review the pumpservice-wrapper.log file in the <NFA_install_path>\Netflow\logs directory on the DSA server. If you consult with CA Support for a resolution, supply this log or refer to the errors in it.
  7. (Recommended) Verify that the DSA server does not have excessive quantities of Reaper files:
    1. Locate the following directory on the DSA server: <NFA_install_path>\Netflow\datafiles\loaderInput.
    2. Verify that the loaderInput directory does not contain an excessive number of .rpr files.
    3. If the loaderInput directory contains an excessive number of .rpr files, perform the following troubleshooting tasks:
      • Verify that the NetQoS ReporterAnalyzer DSA Loader service is running on the DSA server. If the service is not running, start it.
      • Review the dsaLoaderErrors-<timestamp>.log file in the <NFA_install_path>\Netflow\logs directory on the DSA server. If you consult with CA Support for a resolution, supply this log or refer to the errors in it.

<!---->

 

Verify Data File Collection on a Standalone Configuration

Ensure that the appropriate data files are collected on a standalone system by verifying that valid tbn, .nfa, .rpr.cmp, and .rpa15 files are present.

Note: If the .tbn, .nfa, .rpr.cmp, and .rpa15 files are not present, wait for an hour and check again.

Follow these steps:

  1. Verify that valid Time BIN (.tbn) files are present:

    You know that the standalone system is collecting flow data when you see .tbn files that are larger than 0 KB.

    1. Locate the following directory: <NFA_install_path>\Netflow\datafiles\HarvesterWork.
    2. Verify that the HarvesterWork directory contains files that are named <numeric_value>-<port_number>_0.tbn.inc and that the files are larger than 0 KB.

      The directory also may contain files with a .tmp extension.

  2. Verify that valid NetFlow archive (.nfa) files are present:
    1. Locate the following directory: <NFA_install_path>\Netflow\datafiles\HarvesterArchive.
    2. Verify that the HarvesterArchive directory contains valid NetFlow archive files--that is, .nfa files that are larger than 0 KB in size.
    3. (Recommended) If you do not find valid .nfa files, complete the following troubleshooting tasks:
      • Verify that the CA NFA Harvester service is running. If the service is not running, start it.
      • If the Harvester is not receiving data, verify that it listens for data on the same port that was used to configure flow export from the Harvester interfaces. If the ports do not match, modify the NetflowPacketListenPort value in the Harvester database parameter_descriptions table (harvester.parameter_descriptions). For more information, see Set Up the Routers.
      • Review the harvester-wrapper.log files in the following directory: <NFA_install_path>\NetFlow\Logs. If you consult with CA Support for a resolution, supply this log or refer to the errors in it.

        To change the logging level for the harvester-wrapper.log, modify the harvester.properties file at <NFA_install_path>\Netflow\bin. Change enableDebugLogging=false to enableDebugLogging=true.

  3. Verify that valid Compressed Reaper (.rpr.cmp) files are present:
    1. Locate the following directory: <NFA_install_path>\Netflow\datafiles\ReaperWork.
    2. Verify that the ReaperWork directory contains valid Reaper files--that is, .rpr.cmp files that are larger than 1 KB.

      The .rpr.cmp files are removed from the directory at 15-minute intervals.

    3. (Recommended) If you do not find valid rpr.cmp files, perform the following troubleshooting tasks:
      • Verify that the CA NFA Reaper service is running. If the service is not running, start it.
      • Review the Reaper log files (RealtimeReaperErrors<timestamp>.log files) in the <NFA_install_path>\NetFlow\Logs directory. If you consult with CA Support for a resolution, supply this log or refer to the errors in it.
        To change the logging level, modify the extended_Parameters_view of the harvester database. The logging level is set in the following property: RealTimeReaper/Error Logging_File Logging/Severity.
  4. Verify that valid Reaper archive (.rpa15) files are present:
    1. Locate the following directory: <NFA_install_path>\Netflow\datafiles\ReaperArchive15\<Router_IP_address>\<24-Hour_timestamp>.
    2. Verify that the directory contains valid Reaper archive files--that is, .rpa15 files that are larger than 0 KB in size.

      You know that the standalone server is collecting aggregated 15-minute data files when you see .rpa15 files that are larger than 0 KB.

<!---->

Statistics
0 Favorited
1 Views
0 Files
0 Shares
0 Downloads

Related Entries and Links

No Related Resource entered.