There has been a new technical document posted on support.ca.com addressing this problem and its solution.
Title: Flow Forensics Reports Failing in NFA 9.1 SP1 and 9.1 SP2
In NFA 9.1 SP1 and 9.1 SP2, a few of our customers have run into issues with running Flow Forensic reports.
The reports would fail with one of the errors below:
"Error executing Flow Forensics report on host x.x.x.x"
"Query was killed due to a report cancellation"
If you check the <Install_dir>\NFA\Netflow\logs\oursql_5.1_error.log (which is the log responsible for flow forensics), you may see some errors where it is trying to write to a log that doesn't exist.
"ERROR - NFA CSE could not access [D:\CA\NFA\\Netflow\logs\NFAStorageEngine.log]"
It then fails to write to the log and the NQmySql51 service stops (and the report fails to execute with one of the errors above).
1)Manually create the 'NFAStorageEngine.log' in each of the Harvester servers' \Netflow\Logs' directory.
2)Restart the 'NetQos NQMySql51' Service in Windows Services.
3)Then run the report again it should now be able to write what it needs to the log file and the report should now successfully execute.
4)If it does not run please review the newly created 'NFAStorageEninge.log' and the 'oursql_5.1_error.log' for any new errors.
See the tech doc TEC595660 for more details on this.
This document was generated from the following discussion: Flow Forensics Reports Failing in NFA 9.1 SP1 and 9.1 SP2