My NFA Flow Forensics Reports are Stuck in Executing or Queued

Products

• Network Flow Analysis

Issue/Introduction

My NFA Flow Forensics Reports are Stuck in Executing or Report Queued:

The \CA\NFA\Reporter\Logs\ReportService*.log shows the message:

Report Service: Asynchronus Report limit hit

Environment

NFA 9.3.3 and newer

Resolution

If your reports are stuck in this state, recycle the Netqos ReporterAnalyzer Report service on the Console server and the Netqos NQMysql on the Harvester servers.

If the Netqos NQMysql service doesn't restart on its own, kill the mysqld.exe process associated with the Netqos NQMysql service from Task Manager. 

Additional Information

To prevent Flow Forensics from failing, avoid running unfiltered reports for more than a few minutes. Because these reports process raw flow data, broad queries (such as "All TCP Traffic") generate massive datasets that can overwhelm the Harvester.

Recommendation: Always apply a specific router or interface filter when querying long time ranges. If no filters are applied, keep the report duration extremely short, 5 min intervals and expand slow as needed.