Why is Data in NFA is showing 1/10th, 1/100th, or 1/1000th of what it should be showing?

Products

• CA Network Flow Analysis (NetQos / NFA)

Issue/Introduction

NFA is showing data far less than expected.  For example data may be displayed as 1/10th, 1/100th, 1/1000th of what SNMP Statistics show.  

For example a report may be showing data rates in the kbps range when it should be in the mbps range. 

My device is sending sampled netflow. Is there a way to fix the sampling rate?

Cause

This can occur when a router is using a Sampling Rate when sending Netflow, meaning it sends 1 out of every x number of flows.  If NFA doesn't detect the sampling rate properly, data will be displayed as far less then expected.  

Environment

NFA 9.3.6 and Later

Resolution

• If you are running NFA 9.3.3 or earlier, you can upgrade to 9.3.6 in which several enhancements have been made to detect the Netflow Sampling rate using the new format Cisco uses.  Before upgrading to NFA 9.3.6, please review the NFA 9.3.6 Upgrade Guide.

 

• If you cannot upgrade to NFA 9.3.6 immediately you can work around the issue by manually setting the SampleRateOverride setting in the Harvester database by following this document: "How do I configure the sampling rate for a router device within NFA manually?"

 

• If the sampling rate is still not being detected in NFA 9.3.6 you can manually set the sampling rate in the Harvester.routing_engines table using commands like the example below on the Harvester server.  The example below uses 1000 as the sampling rate and 10.1.1.1 as the router address.  Once it is set, you will have to recycle the CA NFA Harvester service for the change to take effect. 

1. mysql harvester -unetqos -pnetqos -t -e "update routing_engines set samplerateoverride=1000 where routerid in(select routerid from routers where inet6_ntoa(router)='10.1.1.1');"

2. Restart the CA NFA Harvester Service.