Harvester is not processing data. java.lang.IndexOutOfBoundsException in Harvester wrapper logs

book

Article ID: 5177

calendar_today

Updated On:

Products

CA Network Flow Analysis (NetQos / NFA)

Issue/Introduction

Harvester stopped processing of data. NFA Admin page below "Repaer Timestamp" errors on harvester. Errors in harvester wrapper shows below errors:


INFO | jvm 1 | 2017/01/02 16:40:55 | 4:40:55 PM - [WARNING ] - Invalid flow! numFieldsSet=0 FLOW src=0.0.0.0:0 dst=0.0.0.0:0 bytes=0

INFO | jvm 1 | 2017/01/02 16:40:57 | java.lang.IndexOutOfBoundsException
INFO | jvm 1 | 2017/01/02 16:40:57 | at java.nio.Buffer.checkIndex(Unknown Source)
INFO | jvm 1 | 2017/01/02 16:40:57 | at java.nio.HeapByteBuffer.getShort(Unknown Source)
INFO | jvm 1 | 2017/01/02 16:40:57 | at com.ca.im.ra.util.ByteArrayUtility.getUShort(ByteArrayUtility.java:34)
INFO | jvm 1 | 2017/01/02 16:40:57 | at com.ca.im.ra.flow.netflow.NetflowParser2.parseV9OptionsTemplateSet(NetflowParser2.java:359)
INFO | jvm 1 | 2017/01/02 16:40:57 | at com.ca.im.ra.flow.netflow.NetflowParser2.parseFlowSet(NetflowParser2.java:242)
INFO | jvm 1 | 2017/01/02 16:40:57 | at com.ca.im.ra.flow.netflow.NetflowParser2.parse(NetflowParser2.java:126)
INFO | jvm 1 | 2017/01/02 16:40:57 | at com.ca.im.ra.flow.FlowParser.parseDatagram(FlowParser.java:198)
INFO | jvm 1 | 2017/01/02 16:40:57 | at com.ca.im.ra.flow.FlowParser.parseDatagram(FlowParser.java:168)
INFO | jvm 1 | 2017/01/02 16:40:57 | at com.ca.im.ra.flow.FlowParser.parseDatagram(FlowParser.java:151)
INFO | jvm 1 | 2017/01/02 16:40:57 | at com.ca.im.ra.flow.tools.FlowProcessor.execute(FlowProcessor.java:112)
INFO | jvm 1 | 2017/01/02 16:40:57 | at com.ca.im.ra.flow.tools.FlowProcessor.run(FlowProcessor.java:72)
INFO | jvm 1 | 2017/01/02 16:40:57 | at java.lang.Thread.run(Unknown Source)
INFO | jvm 1 | 2017/01/02 16:40:57 | 4:40:57 PM - [SEVERE ] - Parse Exception

Cause

The cause of this problem is because of options template not supported by NFA.

 

Environment

NFA 9.2.1 and 9.3.0.Distributed and standalone setup.

Resolution

This issue is fixed in 9.3.3 and later versions. Until you upgrade your environment to 9.3.3 or later to fix this, remove the command on router that enables options template.

A typical command on Cisco routers would look like:

option exporter-stats timeout 60

Remove this on all the routers that are sending options template.

You can check which routers are sending options template by running Wireshark on problematic harvester and decoding the packets as netflow fileds.

Following the below techdoc for details on how to decode packets in Wireshark:

https://www.ca.com/us/services-support/ca-support/ca-support-online/knowledge-base-articles.TEC597610.html

Additional Information

https://communities.ca.com/docs/DOC-1061

https://www.ca.com/us/services-support/ca-support/ca-support-online/knowledge-base-articles.tec1702146.html