After upgrading to NFA 9.5 Sampling Rate is not getting detected automatically.

Document ID : KB000116094
Last Modified Date : 29/10/2018
Show Technical Document Details
Issue:
After upgrading to NFA 9.5, from 9.3.6 or 9.3.8, Sampling Rate is not getting detected automatically for some devices.

This results in seeing 10x, 100x, or 1000x less data then expected in NFA.

For example a report may show data in a kbs range instead of mbs range, or mbs instead of gbs.
Environment:
NFA 9.5.0
Cause:
Some Cisco devices such as ASR 9k devices are sending their sampling rate data included in their "Options" Netflow template instead of the standard "Data" Netflow templates.

The sampling rate will show up as samplerRandomInterval in the Netflow data. 

This was originally a feature added in NFA 9.3.6 to better detect sampling rates, however a change in the 9.5 code undid this change.
Resolution:
NFA Harvester side:
  1. Download the patch from the link below and unzip the file from the patch: NFA_9.5.0_Cumulative_Patch.zip
For Windows Harvesters unzip:
9.5.0_Windows_Harvester_Cumulative_DE320627_DE386567.zip
For Linux Harvesters unzip:
9.5.0_LINUX_Cumulative_DE320627_DE386567.zip.zip
  1. Stop all CA NFA* Services.
  2. Backup the files below:
\CA\NFA\Netflow\bin\com.ca.im.ra.harvester.jar
\CA\NFA\Netflow\bin\com.ca.im.ra.poller.jar
  1. Copy the new com.ca.im.ra.harvester.jar and com.ca.im.ra.poller.jar files from the patch folder to the \CA\NFA\Netflow\bin\ directory on the Harvester.
  2. Start the all CA NFA* services.
  3. Allow data to collect for several minutes, then you can verify that you are seeing more data then previously by viewing an interface report over the last hour.

NFA Console side:
  1. Unzip NFA_9.5.0_Console_Cumulative_DE43953_DE373591_DE367156.zip
  2. Stop all Console Services and CA NFA RibSource service.
  3. Backup following directories/files: [$INSTALL_DIR == The directory where CA NFA is installed, default C:\CA\]
            $INSTALL_DIR\NFA\BIN
            $INSTALL_DIR\NFA\REPORTER\NetQoS.ReporterAnalyzer.LegacyInterop\bin
            $INSTALL_DIR\NFA\REPORTER\NetQoS.ReporterAnalyzer.ManagerService\bin 
            $INSTALL_DIR\NFA\REPORTER\NetQoS.ReporterAnalyzer.PumpService\bin
            $INSTALL_DIR\NFA\REPORTER\NetQoS.ReporterAnalyzer.ReportService\bin
            $INSTALL_DIR\NFA\REPORTER\NetQoS.ReporterAnalyzer.WatchdogService\bin
            $INSTALL_DIR\NFA\REPORTER\NetQoS.ReporterAnalyzer.WebService\bin
            $INSTALL_DIR\NFA\REPORTER\NetQoS.ReporterAnalyzer.WebSite\bin
            $INSTALL_DIR\NFA\RIB\webapps\NFARS\WEB-INF\classes\com\ca\im\rib\sources\reporteranalyzer
        Note: These files will be required in future if you wish to uninstall the patch.
  4. Extract the contents from the file NFA_9.5.0_CP_001_CONSOLE.zip in a clean directory.
  5. Copy the "BIN" to "$INSTALL_DIR\NFA\BIN".
  6. Select "Replace the files in the destination" when prompted so that it replaces the jar file in bin directory of BIN that was backed up in Step 2.
  7. Copy "NetQoS.ReporterAnalyzer.LegacyInterop" to "$INSTALL_DIR\NFA\REPORTER"
  8. Select "Replace the files in the destination" when prompted so that it replaces the files that were backed up in Step 2.
  9. Repeat the same steps 6-7 for all other folders in the zip starting with NetQos.
  10. Copy "reporteranalyzer" to "$INSTALL_DIR\NFA\RIB\webapps\NFARS\WEB-INF\classes\com\ca\im\rib\sources\"
  11. Select "Replace the files in the destination" when prompted so that it replaces the files that were backed up in Step 2.
  12. Restart all the Console Services along with CA NFA RibSource service which were stopped in step 1.

 
Additional Information:
You can work around this issue by setting samplerateoverride to the value set on the router as per kb below if you just have one or two devices:
https://comm.support.ca.com/kb/why-is-data-in-nfa-is-showing-110th-1100th-or-11000th-of-what-it-should-be-showing/kb000006252

The KB article above will also help with other device types that may still send a sampling rate that NFA doesn't yet detect as well.