Network Management

NetFlow Service High CPU after upgrade to 2025.4 and above

After upgrading to SolarWinds Platform 2025.4 or later, environments collecting NetFlow from firewall devices (e.g., Palo Alto, Cisco ASA) may experience higher CPU utilization by the NetFlowService.exe process compared to previous versions. Affected systems may be unable to process the expected volume of flows per second from firewall sources, resulting in degraded NTA performance and potential data loss.

First published date

3/10/2026 9:55 PM

Last published date

4/16/2026 5:25 PM

Overview

A known issue affects NTA performance when processing flows that originate from firewall devices. The NetFlow Service consumes more CPU resources than expected when handling firewall event data. This can result in the following symptoms:

  • Excessive CPU usage by NetFlowService.exe, even on well-provisioned servers

  • Dropped flows and data gaps caused by the system being unable to keep up with incoming flow volume

How to Confirm This Issue

  1. Open Task Manager on the affected polling engine and sort by CPU. NetFlowService.exe will typically appear as the top consumer, often utilizing 60% or more of available CPU.

  2. Navigate to NTA Settings → NetFlow Sources and review the average received flows per second. If FPS is well below expected capacity while CPU remains saturated, this issue is likely the cause.

  3. Review the NTA.BusinessLayer.log for entries such as:

    2026-02-03 06:17:36,699 [Flow Listener on port 2055] WARN  SolarWinds.Netflow.Processing.PacketListener - Packet queue threshold reached. Dropping packets. Memory Used: 102400 KB
2026-02-03 06:17:37,243 [Flow Listener on port 2055] INFO  SolarWinds.Netflow.Processing.PacketListener - Resume receiving packets. Dropped 91B of data, 1 packets.
2026-02-03 06:17:50,331 [Flow Listener on port 2055] INFO  SolarWinds.Netflow.Processing.Workflow.PacketQueueMonitor - Raw Packet Queue Length is over specified threshold (1) for more than last 60 seconds. Current value is 25043.

  4. Confirm that the flows being received include firewall event data from devices such as Palo Alto or Cisco ASA.

  5. Review the following SolarWinds NetFlow performance counters:

    • SolarWinds NetFlow Averages > PDUs Received Per Second

    • SolarWinds NetFlow > Packets Dropped: Insufficient performance

Differentiating From General High-CPU Scenarios

This issue is specific to firewall event processing. If your environment does not collect NetFlow from firewall devices and you are experiencing high CPU usage from NetFlowService, the cause is more likely related to general capacity or sizing.

Product section

Netflow Traffic Analyzer

Cause

A code change introduced additional processing overhead that is applied to every incoming flow containing firewall event data. Under sustained high flow volume, this overhead accumulates, leading to excessive CPU consumption by the NetFlow Service.

Resolution

This issue is fixed in NTA 2026.1.1. Consider upgrading your environment. If you can't upgrade, use the workarounds below.

Workarounds

There is no configuration-level workaround that fully resolves this issue. The following options can help reduce the impact while a fix is pending:

  1. Stop collecting NetFlow from firewall devices. If possible, disable NetFlow export on the affected firewall devices or unmanage those sources in NTA. This bypasses the affected processing path and restores normal CPU levels.

  2. Offload NTA to a dedicated polling engine. Move the NetFlow collection role to a dedicated Additional Polling Engine (APE) with sufficient CPU resources. This isolates the CPU impact from the main poller, preventing disruption to polling and web console performance.

  3. Reduce firewall flow volume. If disabling NetFlow entirely on the firewall is not an option, reduce the export rate or enable flow sampling on the firewall devices to lower the volume of flows reaching the collector.