Hide this message
Welcome to the NEW Success Center. Search all resources (documentation, videos, training, knowledge base articles) or browse resources by product. If you are unable to find what you are looking for, please contact us at firstname.lastname@example.org
When you setup Orion NTA to run NetFlow collections through the NetFlow Service with the On Demand DNS option, the software writes IP addresses into the Orion database where they are referenced in the event that an Orion NTA module needs addresses resolved in order to display its relevant statistics.
Currently, if you switch from On Demand to Persistent DNS, the Orion NTA software does not seek DNS answers for any IP that already exists in the Orion database. Any new IP address is automatically resolved, however.
Orion NTA 3.6 and 3.7
There is no permanent resolution of this issue and the workaround has an important caveat. The workaround is to to run a database script (below) against the Orion database each time you switch the Orion NTA software from the On Demand to the Persistent DNS configuration. The result of the script is that the NetFlow Service immediately begins to resolve every IP address currently listed in relevant table of the Orion database.
This DNS work is resource intensive in the short run, and can seriously impact the performance of your overall Orion network management implementation, since it resolves the usually large existing list of IP addresses in the database. Also, after the big job of resolving the existing IP addresses is finished, the NetFlow Service may permanently command intensive resources to keep up with the DNS work involved in routinely processing incoming flow data.
Assuming your system is up to the task, to prepare for the switch from On Demand to Persistent DNS configuration in Orion NTA, run the following database script:
DECLARE @RC INT
SET @RC = 1
WHILE (@RC > 0)
INSERT INTO NetFlowAddressToResolve
SELECT TOP 50000 e.IPAddressSort, 1, GETDATE()
FROM NetFlowEndpoints e
LEFT JOIN FlowCorrelationPostDNS p ON e.IPAddressSort = p.IPAddressSort
LEFT JOIN NetFlowAddressToResolve r ON e.IPAddressSort = r.IPAddress
WHERE p.IPAddressSort IS NULL AND r.IPAddress IS NULL
SELECT @RC = @@ROWCOUNT