How do I configure the sampling rate for a router device within NFA manually?

Products

• CA Network Flow Analysis (NetQos / NFA)

Issue/Introduction

 

NFA is showing data far less than expected.  For example data may be displayed as 1/10th, 1/100th, 1/1000th of what SNMP Statistics show.  

For example a report may be showing data rates in the kbps range when it should be in the mbps range. 

My device is sending sampled netflow. Is there a way to fix the sampling rate?

Environment

NFA 9.3.6 and Later

Cause

This can occur when a router is using a Sampling Rate when sending Netflow, meaning it sends 1 out of every x number of flows.  If NFA doesn't detect the sampling rate properly, data will be displayed as far less then expected.  

Resolution

 

• If the sampling rate is still not being detected in NFA 9.3.6+ you can manually set the sampling rate in the Harvester.routing_engines table using commands like the example below on the Harvester server.  The example below uses 1000 as the sampling rate and x.x.x.x as the router address.  Once it is set, you will have to recycle the CA NFA Harvester service for the change to take effect. 

1. mysql harvester -unetqos -pnetqos -t -e "update routing_engines set samplerateoverride=1000 where routerid in(select routerid from routers where inet6_ntoa(router)='x.x.x.x');"

2. Restart the CA NFA Harvester Service.