Submit a ticketCall us

Putting Your Logs Where They Belong with the New SolarWinds Log Manager for Orion

The new SolarWinds® Log Manager for Orion® finally puts your log data right where it belongs, in the heart of your Orion console. Gain insight into the performance of your infrastructure by monitoring your logs in a unified console allowing you to see a wealth of information about the health and performance of your network and servers.

Reserve a Seat for Wednesday May 23rd 11am CDT | Reserve a Seat for Tuesday May 22nd 10:30am GMT | Reserve a Seat for Tuesday May 22nd 1pm SGT / 3pm AEST

Home > Success Center > Netflow Traffic Analyzer (NTA) > NTA 4.2.3 Administrator Guide > NTA Troubleshooting > Chart issues

Chart issues

Created by Lori Krell_ret, last modified by Alexandra.Nerpasova on Oct 25, 2016

Views: 512 Votes: 0 Revisions: 6

Below are the most common issues encountered on SolarWinds NTA charts.

Duplicate flows

If your devices are configured to export NetFlow on both ingress and egress interfaces, you might see duplicate traffic in your resources.

Duplicate flows can occur in the following cases:

  • You have both ip flow ingress and ip flow egress applied for all interfaces on a device.
  • You have set ip flow ingress on some interfaces and ip flow egress on other interfaces.
  • On your serial interfaces with subinterfaces, you have NetFlow export enabled on both the physical and logical interfaces.

Resolving Duplicate Flows

  • If your device configuration contains both ip flow ingress and ip flow egress commands, make sure NetFlow is enabled only for ingress interfaces.
  • If you have NetFlow enabled for both physical and logical subinterfaces, remove the NetFlow export commands from the physical serial interfaces and only have the subinterfaces enabled for the export.

Double rate in Top XX Endpoints and Top XX Domains

The Top XX Endpoints and Top XX Domains resources display double data by design. Each flow has two distinct endpoints. To display statistics for top endpoints, SolarWinds NTA disregards that one endpoint is the source and the other endpoint is the target of flows, and treats both as endpoints only. This effectively doubles the total amount of data displayed by the Top XX Endpoints resource.

Example

Let us take two flows and look at what you see in most resources and in the Top XX Endpoints resource.

Most Resources

Flow Source IP Destination IP Protocol Bytes Transferred
Flow 1 IP1 IP2 TCP 50
Flow 2 IP2 IP3 TCP 40
Total bytes transferred: 50+40=90

Top XX Endpoints resource

Endpoint Bytes Transferred
IP1 50
IP2 50+40=90
IP3 40
Total: 50+90+40=180

No data

If your resources show the "no data" message, it can be caused by one of the following:

No data to be displayed

There are no data to be displayed for the current time and flow direction settings.

To resolve the issue, check the time settings for both the resource and the view.

Too long time period selected for the view

If SolarWinds NTA needs more than one hour to process data that you want to see in the resources, the query times out and the resources show the "no data" message.

To resolve the issue, define a shorter time period for both the view and the resource.

Devices

Unexpected spikes in CBQoS post-policy charts

If you remove a shaping policy from a class, post-policy charts with the chart type set to % of Class Utilization may display unexpected spikes.

This is normal behavior, because devices affected by the policy change temporarily report huge amounts of data, which is reflected by the post-policy spike.

 

 
Last modified

Tags

Classifications

Public