AnsweredAssumed Answered

Harvester Dropping Flows

Question asked by J_Hanley on Feb 11, 2015
Latest reply on Feb 18, 2015 by J_Hanley

Hello Community,


I have set up NFA 9.2.1 in a VM lab environment.

I have a standalone installation (Console + Harvester) on Windows 2008, and also a separate Linux Harvester.


I've configured a couple of real routers to send NetFlow v5 data to the standalone system, and I've also experimented with various software-based NetFlow simulation tools to generate v5 or v9 flows to either the standalone NFA instance, or the Linux Harvester.

Flows are sent to UDP port 9995 and Wireshark can see and decode the NetFlow packets on the standalone system.

All NFA services are running.


My issue is that I only ever as far as getting '.nfa' files generated in the HarvesterArchive folder, and '.flt' files in the NFMInput folder, for both Harvesters.

None of the other folders under the datafiles folder have any files created, and no interfaces appear in the NFA Console.


Looking at the log file 'harvester-wrapper.log' reveals entries like this:

INFO   | jvm 1| 2015/02/11 15:22:28 | 3:22:28 PM - [INFO] - Dropped Flows      : 18240
INFO   | jvm 1| 2015/02/11 15:22:28 | 3:22:28 PM - [INFO] -     Map Failure    : 18240
INFO   | jvm 1| 2015/02/11 15:22:28 | 3:22:28 PM - [INFO] -     Bin Failure    : 0


I've run the NASTv13.exe tool and the report that it generates shows flow statistics and no 'red line' errors.


Has anyone run across this situation?