Flow export contains many rows that contain mostly blank data, with only the hit count field containing data

Products

• VCF Operations for Networks

Issue/Introduction

The export of the query "NSX Policy Firewall Rule order by Hit Count" query shows many "blank" rows that contain only hit count data or no data at all.

For example, you can see Hit Count metrics in the screenshot below:

In the export of this data, you can see rows with Hit Count (in red) containing no Name, Status, Rule ID, or Action, which is an example of the issue seen as those rows should not exist in the export.

You may also see a mismatch when searching for a particular firewall rule by name between the number of results and the actual records displayed. 

In the example below, you see "9 results" (circled in red) and "9 entities" (circled in red) yet only 3 records in the list.

 

Environment

VMware Aria for Operations 6.13.0
VMware Aria for Operations 6.14.0

Cause

This issue is seen when the Aria Operations for Networks was migrated multiple times to underlying infrastructure with more storage and then upgrade activity is performed from current to next version (back to back upgrades in a single day).

During this process, the elasticsearch process was down for some time and when the upgrade was complete, the cleanup did not happen properly resulting in "duplicate rows" in the database.

Resolution

The duplicate rows will need to be removed using a script provided by Broadcom Support. If you suspect you are experiencing this issue, please contact Broadcom Support for further investigation. For more information, see Creating and managing Broadcom support cases. and provide the following information:

1. 1. An export from CSV showing the empty rows (as shown in the Introduction above)
   2. A screenshot of the query "NSX Policy Firewall Rules" (as shown in the Introduction above)