IPFIX Processor is lagging due to excessive incoming flows error on Aria Operations for Networks Collector node

Products

• VCF Operations for Networks

Issue/Introduction

• Error message seen on the collector node is IPFIX Processor is lagging due to excessive incoming flows
• Refer to error screenshot as below

Environment

• Aria Operations for Networks 6.13.0
• Aria Operations for Networks 6.14.0
• Aria Operations for Networks 6.14.1

Cause

Ipfix flow processor consumes raw nfcapd files records and process them. These are maintained in a per minutes file on the collector.
These per minutes files are usually under 300-400 MB. Until and unless the per minutes files are under 300-400 MB the flow processor is healthy and it able to process the data.

This issue is seen when the raw nfcapd file goes far beyond 400 MB (5 times higher in size) E.g.: 1.5 to 2 GB per minutes.
Such high size files cannot be processed by the flow-processor in under a minute. A lag in IPFIX  flow processing is observed, resulting in the noted error error message.

Resolution

Configuration change:

Configure Collector's Brick Size from large or XL to 2 XL. This should mostly take care of the error seen "IPFIX Processor is lagging due to excessive incoming flows error"

• Refer to documentation System Recommendations and Requirements  for 2 XL Brick Size. 
• Refer to documentation Increase the Brick Size of Your Setup to 2 XL. 

 

If the issue is still seen then your VCF Operations for Networks environment needs to be evaluated for this situation to seek one of the below options:

Deployment Optimizations:

1. Splitting raw flows
2. Parallel processing to be configured on the collectors.
3. Setting up secondary Collector solution. (This configuration is behind a feature flag and can be achieved in Aria Operations for Networks 6.14 GA version.

Open a support case with Broadcom Support to review your Aria Operations for Networks deployment for optimizations and configurations as needed. For more information, see Creating and managing Broadcom support cases.