Dropped flows and dropped packets in NFA Harvester logs.

Products

• CA Network Flow Analysis (NetQos / NFA)

Issue/Introduction

Harvester logs shows both dropped flows and dropped packets. 

Client is interested in knowing the difference between these two.

Harvester wrapper logs may show the contents as below:

""INFO | jvm 1 | 2017/08/30 13:28:33 | HarvesterFlowProcessor Statistics 

INFO | jvm 1 | 2017/08/30 13:28:33 | ---------------------------------- 

INFO | jvm 1 | 2017/08/30 13:28:33 | Total Received Packets : 24370 

INFO | jvm 1 | 2017/08/30 13:28:33 | Max Buffer Used Size : 58164 

INFO | jvm 1 | 2017/08/30 13:28:33 | Processed Packets : 24274 

INFO | jvm 1 | 2017/08/30 13:28:33 | Processed Flows : 76352 

INFO | jvm 1 | 2017/08/30 13:28:33 | Processed Flows/Minute : 11442 

INFO | jvm 1 | 2017/08/30 13:28:33 | Dropped Packets : 96 

INFO | jvm 1 | 2017/08/30 13:28:33 | Parsing Failure : 0 

INFO | jvm 1 | 2017/08/30 13:28:33 | No Flow Found : 96 

INFO | jvm 1 | 2017/08/30 13:28:33 | Pre-Process : 0 

INFO | jvm 1 | 2017/08/30 13:28:33 | Header Errors : 0 

INFO | jvm 1 | 2017/08/30 13:28:33 | Invalid Version : 0 

INFO | jvm 1 | 2017/08/30 13:28:33 | Duplicate Packets : 0 

INFO | jvm 1 | 2017/08/30 13:28:33 | Router Reboot : 0 

INFO | jvm 1 | 2017/08/30 13:28:33 | Dropped Flows : 0 

INFO | jvm 1 | 2017/08/30 13:28:33 | Map Failure : 0 

INFO | jvm 1 | 2017/08/30 13:28:33 | Bin Failure : 0 

INFO | jvm 1 | 2017/08/30 13:28:33 | ---------------------------------- 

INFO | jvm 1 | 2017/08/30 13:28:33 | Connection Pool Stats 

INFO | jvm 1 | 2017/08/30 13:28:33 | ---------------------------------- 

INFO | jvm 1 | 2017/08/30 13:28:33 | Max Connections : 200 

INFO | jvm 1 | 2017/08/30 13:28:33 | Active Connections : 0 

INFO | jvm 1 | 2017/08/30 13:28:33 | Idle Connections : 1 

INFO | jvm 1 | 2017/08/30 13:28:33 | ---------------------------------- 

INFO | jvm 1 | 2017/08/30 13:28:33 | " 

 

What is the difference between dropped flows and dropped packets in NFA Harvester wrapper logs?

Environment

NFA 9.3.x

Resolution

Dropped Flows is actually the flows harvester would get drop eventhough the flows are proper. This may be perhaps, if the router reboot is defected and it is not polled. NFA Harvester would drop the flows from that specific router/device. 

Packets drop is because of invalid/undetected flow packets like header errors, invalid netflow versions.