Why is Data in NFA is showing 1/10th, 1/100th, or 1/1000th of what it should be showing?


Article ID: 6252


Updated On:


CA Network Flow Analysis (NetQos / NFA)


NFA is showing data far less than expected.  For example data may be displayed as 1/10th, 1/100th, 1/1000th of what SNMP Statistics show.  

For example a report may be showing data rates in the kbps range when it should be in the mbps range. 

My device is sending sampled netflow. Is there a way to fix the sampling rate?


This can occur when a router is using a Sampling Rate when sending Netflow, meaning it sends 1 out of every x number of flows.  If NFA doesn't detect the sampling rate properly, data will be displayed as far less then expected.  


NFA 9.3.6 and Later


  • If you are running NFA 9.3.3 or earlier, you can upgrade to 9.3.6 in which several enhancements have been made to detect the Netflow Sampling rate using the new format Cisco uses.  Before upgrading to NFA 9.3.6, please review the NFA 9.3.6 Upgrade Guide.



  • If the sampling rate is still not being detected in NFA 9.3.6 you can manually set the sampling rate in the Harvester.routing_engines table using commands like the example below on the Harvester server.  The example below uses 1000 as the sampling rate and as the router address.  Once it is set, you will have to recycle the CA NFA Harvester service for the change to take effect. 

1. mysql harvester -unetqos -pnetqos -t -e "update routing_engines set samplerateoverride=1000 where routerid in(select routerid from routers where inet6_ntoa(router)='');"

2. Restart the CA NFA Harvester Service.