NFA - RA - No Network Flow Analysis data available.

[d.pereyra]

Hello everybody, Im having an issue seeing netflow graphs into Report Analyzer.

I have a 2tier configuration servers, 1) where netflow traffic arrive 2) reporting

I take a look on these logs:

• poller-wrapper: normals logs, no errors.
• fileserver-wrapper: INFO logs, of getting files and do things on NFMInput folder
• harvester-wrapper: Many "FlowArchiver Stats" and an ERROR

INFO | jvm 1 | 2020/01/16 12:34:37 | 12:34:37 PM - [SEVERE ] - Error adding interface 10.xxx.xxx.254 ifIndex -873988096 to table
INFO | jvm 1 | 2020/01/16 12:34:37 | com.mysql.jdbc.MysqlDataTruncation: Data truncation: Out of range value for column 'EphID' at row 1

• dataretention-wrapper: to many info logs moving bytes
• RealTimeReaperErrors2020-01-15: server up

In the reporting server:

• dataretention-wrapper: Its like the log of the other server but empty.

TosConversation datastore End Time : 0

INFO | jvm 1 | 2020/01/16 12:41:36 | 12:41:36 PM - [INFO ] - TosConversation datastore Current Size In Bytes: 0

• pumpservice-wrapper: to many : " [WARN] - Loaded 0 channels"
• oursql_5.1_error: Ok
• dsaLoader:

Errors-2020-01-1612:40:47 Severity 2 - Unable to retrieve DSA Id. Aborting load.

12:40:47 Severity 2 - Load aborted. We'll try to connect to the console again in a minute.

12:40:47 Severity 2 - The list of interfaces for this dsa isn't available. Aborting load of data.

There is data with graphs in "Flow" not in others views (overview, Protocols, Tos, hosts, etc)
This happend in two hours timeframe or more.
Also there is information in /npc

[Christopher Walsh]

What version of NFA are you running?

Is this a two tier environment or three tier?

[d.pereyra]

Hi Christopher, this is a two tier enviroment.

[Christopher Walsh]

What version of NFA is this?  The error below is not something I have seen in later versions.

• fileserver-wrapper: INFO logs, of getting files and do things on NFMInput folder
• harvester-wrapper: Many "FlowArchiver Stats" and an ERROR

INFO | jvm 1 | 2020/01/16 12:34:37 | 12:34:37 PM - [SEVERE ] - Error adding interface 10.xxx.xxx.254 ifIndex -873988096 to table
INFO | jvm 1 | 2020/01/16 12:34:37 | com.mysql.jdbc.MysqlDataTruncation: Data truncation: Out of range value for column 'EphID' at row 1


It may be best to open a support issue so you can upload the full logs, and also get a pcap taken from the harvester filtered to the device IP in the error message and port 9995

[d.pereyra]

Christopher, the version is:

Version: Network Flow Analysis 9.2.1 (build113)
Licensed Devices in Use: 644
License Utilization: 1288%

And here is see the 1288%, that is a little to much, no ?

Thanks
Diego

[d.pereyra]

Hello, I found something weird in interfaces count.. so I delete everything from GUI and wait.

[Christopher Walsh]

9.2.1 is a really old version at this point and full of defects that have since been resolved.

Being that you just deleted everything from the GUI, can you just reinstall the latest version 10.0.2 instead of staying on this older version, I don't believe you will run into the Harvester error messages you were referencing above.

The high interface count from your screenshot was due to an issue in earlier versions of NFA that is now resolved in 10.0.2 as well.

[d.pereyra]

And after delete all irouter with interfaces and enable again each interface now is working back to normally.
Yes I need to update it. I will planned it, thanks !  =)
Diego