Hide this message
Welcome to the NEW Success Center. Search all resources (documentation, videos, training, knowledge base articles) or browse resources by product. If you are unable to find what you are looking for, please contact us at email@example.com
If the active flow cache timer on each flow exporter is not set correctly, NetFlow Interface resource(s) can show utilization peaks higher than NPM utilization or higher than the interface bandwidth.
Flow exporters may store active flows for longer than the default NTA reporting period of 1 minute. When long duration flows are exported the data is reported as occurring in same minute the export is sent to NTA. The result may cause reporting of data rates larger than the actual rate for that minute.
The active flow cache timer on each flow exporter should be set to 1 minute to match the NTA reporting period.
ip flow-cache active 1in the device global configuration.
ip flow cache timeout active 1in the device configuration.
set polling interval 60Exact syntax may vary by vendor implementation. See your vendor’s configuration guide for details.
mls aging long 64in the device global configuration. 64 seconds is the minimum allowed value.
ip flow-cache timeout active 1in the device configuration.
There is a known issue in Orion NTA 3.6 (resolved in 3.7) that can rarely cause similar behavior. You can determine if this issue is causing this behavior by running the following query using MS SQL Management Studio when connected to your Orion database:
SELECT (nodeId * 4096) | interfaceIndex as hash, InterfaceIndex, InterfaceName, NodeId, interfaceid
ON A.hash = ((i.nodeId * 4096) | i.interfaceIndex)
AND NOT(a.interfaceindex = i.interfaceindex AND a.nodeid = i.nodeid)
INNER JOIN Nodes n1 on i.NodeID = n1.NodeID
INNER JOIN Nodes n2 on a.NodeID = n2.NodeID
n1.NodeID < n2.NodeID
If the query returns results, then the results indicate nodes (and their interfaces) where you will see incorrect traffic results. In this case, please upgrade to 3.7.