Updated: March 14, 2017
The NTA Flow Storage Service is crashing with the following error in a log: 2017-03-02 08:57:46,747 
ERROR SolarWinds.Netflow.FastBit.Server.Service.Program - NetFlowService will be abnormally terminated - UnhandledException was caught : System.AccessViolationException: Attempted to read or write protected memory.
This is often an indication that other memory is corrupt.
NTA 4.2.x and later
The issue can happen when a NetFlow enabled node is receiving Cisco Wireless LAN Controller (WLC) or Cisco Next Generation Network-Based Application Recognition (NBAR2) data. The issue is caused by a corrupted column index of the NTA Flow Storage database (FSDB) partition when WLC and non-WLC data or NBAR2 and non-NBAR2 data are mixed into the same data partition. The NTA Service crashes when the corrupted columns are queried to show NBAR2 or WLC related resource or when backup is triggered as it queries all columns.
The following error can be seen in a log:
ERROR FastbitCLR.FastbitIndex - appendInternal: Failed to index new data. Partition: TN#2016-10-23@11_0, column: AdvancedApplicationID. The column AdvancedApplicationID indicates NBAR2 related data issue and columns WtpMAC, ClientIP or PostDSCP indicate WLC related data issue.
To prevent further corruption of the NBAR2 related column indexes upgrade to NTA 4.2.1 HotFix 1 or later. For NTA version 4.2.0 and 4.2.1 without any HotFix, manual steps need to be done:
Change setting from enableUnsavedNullableColumns=”true” to enableUnsavedNullableColumns=”false” at a line beginning with flowStorageConfig.
Change setting from <enableUnsavedNullableColumns>true</enableUnsavedNullableColumns> to <enableUnsavedNullableColumns>false</enableUnsavedNullableColumns>.
To prevent further corruption of the WLC related column indexes manual steps need to be done on all NetFlow pollers.
There are some downsides of having this setting sendAllColumns set to true. One is higher network utilization as larger amount of data are sent from the NetFlow pollers to the Flow Storage. Other is higher disk space requirements for the Flow Storage database as larger amount of data are stored. The difference is typically about 15 percent.
The setting sendAllColumns is rewritten to the default value of "false" after each upgrade or repair of NTA installation and needs to be set again.
The FSDB partitions with already corrupted indexes need to be deleted manually. This has to be done for all partitions listed in the log files as failed to index new data. The NTA FastBit Studio command CheckIntegrity can be also used to identify corrupted partitions. Running the command BuildIndexes in the NTA FastBit Studio does not help to fix the corrupted indexes. Deletion of corrupted partitions should be done after index corruption measures are in place.
To delete FSDB partitions with corrupted indexes: