Cisco Nexus 9K: Troubleshooting 'No data being received' and Metric Collection Failures

Products

• VCF Operations for Networks

Issue/Introduction

Cisco Nexus 9000 (N9K) devices added as data sources report a "No data being received" error. Specific symptoms include:

• Missing interface data and metrics for Leaf switches.
• Data source search fails to return specific switch identifiers or hostnames.
• Logs may show SSH disconnects or certificate exceptions.

Environment

VCF Operations for Networks 6.14.X
VCF Operations for Networks 6.13

Cause

1. Insufficient Privileges: The TACACS account used to add the N9K device lacks the necessary roles (e.g., vdc-operator) to execute XML show commands without a password prompt.
2. Parsing Exceptions: Commands like show interface | xml | no-more prompt for a password during execution, causing the AON collector to fail while parsing the response.
3. Certificate Issues: Custom certificate exceptions or expired certificates on the Nexus switches prevent successful SSH handshakes.

Resolution

1. Verify TACACS+ Role and Privileges

Ensure the user account has the vdc-operator (or higher) role. The account must be able to run the following commands without a password prompt:

show interface | xml | no-more
show interface | no-more
show vrf interface | xml | no-more
show routing vrf all | xml | no-more
show routing vrf all | no-more
show forwarding ip route vrf all | no-more
show forwarding ipv4 route vrf all | no-more 
show fex | xml | no-more
show fex ${id} detail | no-more
show hsrp interface ${id} | no-more
show mac address-table | xml | no-more
show mac address-table | no-more
show running-config | no-more
show interface fex-fabric | no-more
show hostname | xml | no-more
show version | xml | no-more
show vlan brief | xml | no-more
show ip interface vrf all | no-more
show vrrp | no-more
show cdp neighbors | no-more
show inventory | xml | no-more
show hsrp brief | no-more
show glbp brief | no-more
show policy-map system type network-qos | grep . | section class-default | grep mtu
show feature | grep enable | no-more
show nve interface | no-more
show nve vrf | no-more
show bgp all summary vrf all | no-more
show bgp all summary vrf all | include local | no-more
show cdp neighbors detail | no-more
show fex ${id} transceiver | no-more
show forwarding route vrf all | no-more
show hsrp | no-more
show interface switchport | no-more
show ip arp vrf all | no-more
show ip route vrf all | no-more
show ip pim rp | no-more
show lldp neighbors | no-more
show lldp neighbors detail | no-more
show port-channel database | no-more
show running-config all | no-more
show spanning-tree detail | no-more
show spanning-tree inconsistentports | no-more
show terminal | no-more
show version | no-more
show vpc brief | no-more
show vpc role | no-more
show vrf | no-more
show vrf interface | no-more
show vrrp detail | no-more
show vrrpv3 detail | no-more

Test Command: Log in via SSH with the service account and run: show interface | xml | no-more

If the switch prompts for a password after entering the command, the collector will not be able to pull data.

2. Address Certificate Exceptions

Go to the Accounts and Data Sources page -> Edit the switch and re-enter password and submit.