Rule-stats counters reset to 0 after modifying network interfaces on Bare Metal Servers (BMS)

Products

• SSP

Issue/Introduction

• Rule-stats counters reset to 0 on Bare Metal Servers (BMS).
• Occurs when modifying the network interface topology (e.g., switching from physical to bond, adding a VLAN sub-interface on top of physical/bond, or vice versa). 
• Occurs during the upgrade process when BMS Agents upgrade from one release to another on any Linux distribution.

Environment

vDefend SSP 5.2 with Bare Metal Servers (Any Linux Distribution)

Cause

The agg-service is not available to cache the stats count; the system relies solely on the OpenFlow flow stats in the datapath. Modifying the interface topology causes a flow reset, clearing all stats associated with OpenFlow.

Resolution

This is expected behavior (working as designed) and not a defect.

Workaround:

Record or export rule-stats counters prior to modifying network interface topologies or upgrading BMS Agents if historical data is required.

Additional Information

Changing the bond mode (e.g., from active-backup to LACP) does not reset the counters because no datapath flow modification occurs, and vDefend SSP is unaware of the bond mode.