IPFIX Processor lagging due to excessive incoming flows error on Collector node

Products

• VCF Operations for Networks

Issue/Introduction

• In the GUI, on the Infrastructure and Support page, in the Collectors section the following error message is seen for a collector node:
  
  IPFIX Flow Data Provider (Collect_########)
IPFIX Processor is lagging due to excessive incoming flows.

Resolution: Please contact VMware support to know more and to fix the problem.
  
  

 

Environment

• VCF Operations for Networks 6.13.0
• VCF Operations for Networks 6.14.0
• VCF Operations for Networks 6.14.1

Cause

Ipfix flow processor consumes raw nfcapd files records and process them. These are maintained in a per minutes file on the collector.
These per minutes files are usually under 300-400 MB. Until and unless the per minutes files are under 300-400 MB the flow processor is healthy and it able to process the data.

This issue is seen when the raw nfcapd file goes far beyond 400 MB (5 times higher in size) e.g.: 1.5 to 2 GB per minutes.
Such high size files cannot be processed by the flow-processor in under a minute. A lag in IPFIX  flow processing is observed, resulting in the noted error message.

Resolution

Configuration change:

Configure Collector's Brick Size from large or XL to 2 XL. This should mostly take care of the error seen "IPFIX Processor is lagging due to excessive incoming flows error"

• Refer to documentation "System Recommendations and Requirements" for 2 XL Brick Size. 
• Refer to documentation "Increase the Brick Size of Your Setup" to 2 XL. 

 

If the issue persists, the VCF Operations for Networks environment requires evaluation to determine the appropriate solution:

Deployment Optimizations:

1. Splitting raw flows
2. Parallel processing to be configured on the collectors.
3. Setting up secondary Collector solution. (This configuration is behind a feature flag and can be achieved in VCF Operations for Networks 6.14 GA version.

Open a support case with Broadcom Support to review the VCF Operations for Networks deployment for optimizations and configurations as needed. For more information, see Creating and managing Broadcom support cases.