ifType Rejection in NFA 9.3 and 9.3.6 and Cleanup Procedure

Products

• CA Network Flow Analysis (NetQos / NFA)

Issue/Introduction

In CA Network Flow Analysis prior to version 9.3.0, NFA would perform a SNMP Discovery on a device and would insert every interface on a device into NFA.

In NFA 9.3.0 we introduced ifType Exclusion.  This was done to limit the amount of interfaces to be inserted into NFA.  The idea behind this new feature is that if the Interface on a device does not support Netflow that it is of no concern to anyone using NFA.

Prior to NFA 9.3.0 we would poll a device and insert thousands of unnecessary interfaces into NFA.  This would cause performance issues throughout the system because of the hundreds of thousands of extra and unnecessary interfaces being in the databases.

The ifType Exclusion feature introduced in NFA 9.3.0:

Object ifType

OID 1.3.6.1.2.1.2.2.1.3

 

Value     Type

1         Other

18        DS1                                    

37        ATM

100       voiceEM

101       voiceFXO

102       voiceFXS

103       voiceEncap

104       voiceOverIP

134       atmSubInterface 

Environment

NFA 9.3.0+

Resolution

Going forward after upgrading to NFA 9.3.0 - NFA 9.3.6, NFA will ignore these types of interfaces during SNMP discovery and refresh processes.  However interfaces that were discovered prior to NFA 9.3.0 - NFA 9.3.6 will still be in the database.

Here is a cleanup method you can use to remove these unnecessary interfaces from the databases.  This method should only be used if on NFA 9.3.0 - NFA 9.3.6 or if you are running NFA 9.2.1 with the ifType Rejection Patch Applied.

Run these commands in this EXACT ORDER ONLY for a complete cleanup:

For 9.3.0 - 9.3.3:

1. Mysql poller

   delete p.* from persistent_map p inner join interfaces_snmp i on p.routerid=i.routerid and p.ifindex=i.ifindex and i.iftype in (18,37,100,101,102,103,104,134);

   delete from interfaces_snmp where iftype in (1,18,37,100,101,102,103,104,134);

2. Mysql reporter

  delete from interfaces where iftype in (18,37,100,101,102,103,104,134);

  delete from interfaces where iftype=1 and lastflow=0;

For 9.3.6:

1. Mysql harvester

   delete p.* from persistent_map p inner join interfaces_snmp i on p.routerid=i.routerid and p.ifindex=i.ifindex and i.iftype in (18,37,100,101,102,103,104,134);

   delete from interfaces_snmp where iftype in (1,18,37,100,101,102,103,104,134);

2. Mysql reporter

  delete from interfaces where iftype in (18,37,100,101,102,103,104,134);

  delete from interfaces where iftype=1 and lastflow=0;

 **Note we do not delete the ifType of 1 in the reporter.interfaces or the poller.persistent_map as Devices that have not had a successful SNMP poll will have a default iftype of 1 for all of its interfaces.  It is however safe to delete the ifType 1 results in the poller.interfaces_snmp as this table will only be populated after a successful SNMP poll.**