IPFIX Processor is lagging due to excessive incoming flows error on Aria Operations for Networks Collector node

Products

VCF Operations for Networks

Issue/Introduction

Error message seen on the collector node is IPFIX Processor is lagging due to excessive incoming flows.
Refer to error screenshot as below:
This is seen on one of the Collector node where multiple vCenter and NSXT Managers are added as datasources which are to heavy on the flows counts.

Form Collector logs at location /var/log/arking/flow-processor/latest.log we see below entries

flow-processor.STDOUT-2025-11-03-20.44.06.log.error:303272:2025-11-06T21:39:46.419Z INFO ipfix.v2.FiveTupleProcessingTask NFCAPD_vds processFilesAtTs:656 files [/var/flows/vds/nfcapd/nfcapd.202511062119, /var/flows/vds/nfcapd/nfcapd.202511062119] process time 88488 ms 4T=596272 5TBefore=9974438 5TAfter=10000000 ipv4Ids=0 ipv6Ids=0 infServiceTuples=0

flow-processor.STDOUT-2025-11-03-20.44.06.log.error:302646:2025-11-06T21:32:28.521Z INFO ipfix.v2.FiveTupleProcessingTask NFCAPD_vds processFilesAtTs:656 files [/var/flows/vds/nfcapd/nfcapd.202511062112, /var/flows/vds/nfcapd/nfcapd.202511062112] process time 65020 ms 4T=684385 5TBefore=9832619 5TAfter=9656942 ipv4Ids=0 ipv6Ids=0 infServiceTuples=0

flow-processor.STDOUT-2025-11-03-20.44.06.log.error:302845:2025-11-06T21:34:56.255Z INFO ipfix.v2.FiveTupleProcessingTask NFCAPD_vds processFilesAtTs:656 files [/var/flows/vds/nfcapd/nfcapd.202511062114, /var/flows/vds/nfcapd/nfcapd.202511062114] process time 84205 ms 4T=618413 5TBefore=10000000 5TAfter=9966861 ipv4Ids=0 ipv6Ids=0 infServiceTuples=0

flow-processor.STDOUT-2025-11-03-20.44.06.log.error:302932:2025-11-06T21:36:02.955Z INFO ipfix.v2.FiveTupleProcessingTask NFCAPD_vds processFilesAtTs:656 files [/var/flows/vds/nfcapd/nfcapd.202511062115, /var/flows/vds/nfcapd/nfcapd.202511062115] process time 66658 ms 4T=618283 5TBefore=9966861 5TAfter=9994375 ipv4Ids=0 ipv6Ids=0 infServiceTuples=0

From above we see that few flows have breaches of process time beyond 1 minute i.e. 1.2 to 1.42 to 1.49.
You can calculate this by converting process time value which is in second to minute.

Environment

Aria Operations for Networks 6.13.0
Aria Operations for Networks 6.14.0
Aria Operations for Networks 6.14.1

Cause

Ipfix flow processor consumes raw nfcapd files records and process them. These are maintained in a per minutes file on the collector.

The alert is triggered even if a single raw flow data file exceeds the process time of 60 seconds and is cleared only if no such threshold breach takes place for the next 60 minutes. This makes the alert stay persistent even if there is no apparent lag.

Resolution

To over come the alert seen perform below steps:

Configuration change: Configure Collector's Brick Size from large or XL to 2 XL. This should mostly take care of the error seen "IPFIX Processor is lagging due to excessive incoming flows error"

Refer to documentation System Recommendations and Requirements for 2 XL Brick Size. Refer to documentation Increase the Brick Size of Your Setup to 2 XL.

If you still see the Alert then see proceed with step 2 onwards.
Redistribution of the added datasources to other existing collector.
Redistribution the load of the added datasources by deploying new XL collector(s) depending on the number of heavy datasources on the flows counts.
To validate the flow count from Accounts and datasource page for the datasources and Identify the heavy datasources.
On you have identified the heavy vCenter and NSXT Managers and redistribute the load by follow below steps:

a) On the existing collector, edit the respective heavy vCenter datasource and uncheck the option NetFlow and submit the datasource. Wait for 15 minutes for back up clean up to happen.
b) On the existing collector Edit added NSX-T datasource and uncheck the option DFW IPFIX and Enable latency and submit the datasources one by one, Wait for 30-35 minutes for clean up of the DFWIPFIX and Latency profiles.

You can login to the respective NSXT Managers to validate if the profile is gone or not:

For DFW IP Fix : On NSXT UI Select Plan and Troubleshoot>IPfix, here you will see 2 Tab DFW Firewall IPFIX and Collector Tab, under these tab's you will see 1 profile each.

For latency metrics: on NSXT UI select Inventory>Groups and in search bar on far right you need to search with vRNI-Node_ Here you should see 2 profiles as well.

c) Repeat, steps a and b for all the vCenter and NSXT Mangers and once the profiles are gone wait for 30-35 for each NSXT manager.

d) Once the Netflow (for vCenter) and DFWIPFIX and Enable latency (For NSX-T ) options are unchecked for all the added VCs and NSXT managers and you have waited for the above said time, proceed to disable data collection and then delete the datasource form the existing collector.

e) Add the respective vCenter datasource and then the respective NSX-T managers as datasource in the Newly Deployed collector node.

f) Once all the vCenters and NSXT Managers are added successfully, go ahead and edit the datasource and check Enable Netflow for all the 4 vCenter Datasource(s) and Click submit the datasource button.

g) Now edit the NSX-T Datasource and checkmark/enable DFWIPFIX and Enable latency check boxes and Click submit the datasource button.
Validate the profile getting created as per Step b.

h) After all the vCenters and 4 NSXT managers are added in Newly Deployed collector.

Allow 1-2 days for data collector to happen from the respective 4 VC and 4 NSXT managers added in Newly Deployed collector.

If the alert on collector is still seen on the GUI then your VCF Operations for Networks environment needs to be evaluated further.
Open a support case with Broadcom Support to review your Aria Operations for Networks deployment for optimizations and configurations as needed. For more information, see Creating and managing Broadcom support cases.

Additional Information

Refer to below documentation on how to deploying a new collector

Setting up VMware Aria Operations for Networks Collector (OVA)