This article describes the NfiQueuedPktsHigh - NPM buffer usage alarm and possible causes and areas of investigation.NPM buffer usage alarm is raised and NfiQueuedPktsHigh events appear in the log /var/log/messages:
The alarm is indicating a queuing condition during global new flow setup processing or during re-classification of existing flows. The alarm is generated when the buffer for packets for New Flow Initiation reaches the threshold value for the alarm.
When an NPM receives a packet for a New Flow, it goes through the "slow path" for flow setup. The New Flow Classification process begins and packets related to that flow are placed in the referenced NFI queue buffer of the NPM receiving the packets for the new flow before the flow is set up completely.
Buffer usage can increase due to unusual traffic arriving on the interface as described below. When there is no returning traffic, buffers won't be flushed and, because the usual traffic pattern of source/destination might not fall into same hash, the buffer usage alarm will not get cleared.
Threshold for the alarm can be calculated as percentage (87.5%) of "Configured number of packets". For example, when the "Configured number of packets" is 90551, the alarm is triggered when "Current number of buffers in use" passes 79232.
The following 7-tuple items are taken into account for an active flow table entry:
Possible causes and questions to investigate: