NCM Host configuration fails with SPC-OCC-10747: Error Capture Configuration for the host in CA Spectrum

Products

• Spectrum
• Network Observability

Issue/Introduction

When attempting to capture a device configuration the following error is seen (or similar):

SPC-OCC-10747: Error Capture Configuration

Environment

Spectrum all releases

Cause

Here is a suggested troubleshooting checklist for device captures as normally Spectrum NCM is working fine and its a device or network issue.

Resolution

 

1. Confirm the DCM Timeout is not set too low for a high latency device. Go to the information tab for the device and expand "CA Modeling Information"
   Default value is 3000, Max value is 60000.  This value should be increased to find that "happy medium" before contacting Broadcom Support.
   
   
   
   
2. Confirm that the device has R/W Community string.
   
   
3. Confirm that the user being used to log into the device has highest level privileges,  On Cisco that would be Privilege 15.
   
   
4. Confirm that (if using SNMP/TFTP) that the TFTP server has R/W privileges on the directory.
   
   
5. Also confirm that we are seeing proper traffic via Sniffer/Wireshark capture.
   
   When using SNMP/TFTP Spectrum will send an SNMP Packet to the device to trigger the capture.  At this point it is in the devices hands to prepare the configuration and send it to the TFTP server configured.  Once the device finishes sending the configuration to the device it notifies Spectrum and we grab it from the TFTP server.
   
   Most problems seen are at the Device -> TFTP server portion of this process.
   
   
6. If using SSH/SCP then the device needs SSHv2 enabled.
   
   
7. Also if using SSH/SCP then the device needs to have SCP enabled on it.
   
   If the device checks out and the network is not an issue (no firewalls blocking ports, etc) then contact Spectrum Support at Broadcom.
   Provide support with a copy of the sniffer/wireshark capture if possible when opening the ticket.
   
   Debug should also be turned on:
   
   Navigate into $SPECROOT/NCM/
   Open the config.xml file.
   Change the debug line to "max"
   Save the file and exit.
   
   Note the tag <diff-largefile type>. In 10.4.1 and lower, this value is defaulted as "on". In some cases, a NCM capture may fail due to attempts to diff a file which is too large.
   Set this to "off" - save the config.xml and restart ncmservice.exe process.
   This value is set to "off" by default in 10.4.2.0 and higher: <diff-largefile type="java.lang.String">off</diff-largefile>
   

   

   
   
   Attempt the capture again with the sniffer on and debug in place. Debug will output to both the $SPECROOT/NCM/NCMSERV.OUT and the $SPECROOT/NCM/logs/debug directories
   
   Send Support any files in that directory zipped up and the sniffer trace.

Additional Information

The following entries in the NCM debug logs indicate firewall\port blockage for SSH:

 (grpc-default-executor-2426) - getSSHMajorVersion for host : x.x.x.x, on Port : 22 failed, Exception : Connection refused (Connection refused)