CAPC is only showing historical NFA data for some interfaces

Products

• CA Network Flow Analysis (NetQos / NFA)

Issue/Introduction

CAPC is only showing historical NFA data for some interfaces, but NFA shows current data for the same interface.

When looking at data in CAPC you can see that data stops around the same time it starts showing data in NFA.

For example, below you see data stop in CAPC around mid March:

When looking at NFA, you can see the data starts in mid march:

   

Environment

NFA 9.3.x

Cause

This may occur after a hardware change is detected.

When NFA detects a hardware change on a router, it will mark all existing interfaces with the "OLD*" prefix and stop collecting data on those interfaces, and create a new interface for that ifindex and only collect flows on the new interface.

In cases where the existing interface had a name like "Interface xxx" instead of a true named retrieved from SNMP, these interfaces will simply be renamed to "OLD" like below:

 

When this happens CAPC will have two versions of the interface with the same ifindex and global sync may not consolidate the correct new interface and will still be querying for the old.

 

Resolution

1. Go to the Admin->Physical & Virtual page in NFA.

2. Search for the device and Interface that is having the issue and make note of the ifindex.

3. You should find at least two interfaces with the same ifindex, one with a real name and one with name just like OLD  like below:

4. Verify that the current one is still receiving flow.

5. To get data to show in CAPC you will need to either delete the OLD interfaces with the same ifindex from the Physical & Virtual page or merge the OLD interface into the current interface.  If you merge the OLD interface into the new one, make sure to check the box for "Delete source interface after merging data".

6. Wait for the merge to complete and for the OLD interface to be deleted, which may take some time.

7. Once the OLD interface is deleted, go to CAPC->Admin->Data Sources and click resync on the NFA Data Source, and check the box for "Perform a Full Resynchronization".
The full resync may take some time, and after that completes you will have to wait for CAPC to complete its Global Sync.  Once both complete you should be able to see current data in CAPC for that interface again.