Flow Forensics Reports Failing with "Query was killed due to a report cancellation"

Products

• CA Network Flow Analysis (NetQos / NFA)

Issue/Introduction

We have a customer trying to run a forensic report in NFA. It works for older than 24 hours, but anything more recent, for last 24 hours, fails with "Query was killed due to a report cancellation".

I see the error captured on console server ConsoleErrorsLog:

14:48:33 -1 - : This log contains errors and warnings from all console services. These messages are also sent to Event Manager.
14:50:03 1 - ReportService::Report Service: 
NetQoS.ReporterAnalyzer.i18n.i18nException: Query was killed due to a report cancellation. ---> System.Exception: CancelledQuery ---> MySql.Data.MySqlClient.MySqlException: Error writing file 'C:\windows\TEMP\MYF4D5.tmp' (Errcode: 28 - No space left on device)
   eport(FlowForensicsReport flowForensicsReport)

Environment

NFA All versions

Resolution

The error message:

Errcode: 28 - No space left on device

Occured because the Temp directory for the NetQos NQMySQL service was defaulting to:

C:\windows\TEMP\

 

We do not recommend storing MySQL's temp files on the C: drive. Please see the following doc for steps to redirect MySQL's temp files to another location:

How do I change the MySql tmp directory in NFA to a different directory? (broadcom.com)

Windows:

1. RDP to the Harvester and find the \<Install Directory>\NFA\Netflow\bin\netqosmy.ini file

2. Edit the file and add the line below in the [mysqld] section of the file using the path where you would prefer the files be moved to:

tmpdir=E:/CA/NFA/MySql/tmp2

3. Create the new folder used as the tmpdir in step 2.

4. Save the file and recycle the 'Netqos NQMysql' Service.