With Flexible Netflow becoming more prominent in Cisco IOS Netflow Configurations, we are starting to see a common issue in configurations that causes a major issue with CA Network Flow Analysis.
If there are interfaces configured to use Flexible Netflow on a device, you absolutely can NOT have a Standard Netflow configuration set up as well as it will result in 2 separate Netflow flow streams being generated from the router. NFA will look at this as that the router is constantly rebooting and it will start to add thousands of bogus interfaces.
- These thousands of interfaces will cause an assortment of issues ranging from the Harvester to the Console server.
- Slow performance throughout the GUI due to hundreds of thousands of BOGUS interfaces being generated into the databases.
- Interfaces will be named "Interface xxx" and will not have a valid ifIndex.
- .FLT file processing issues on the NFA Console causing a backup of .FLT files and .RPR files due to the Pump Process clogging up. (Console Server Backup: D:/CA/NFA/reporter/datafiles/input & D:/CA/NFA/reporter/datafiles/Staging and on the Harvester: D:/CA/NFA/Netflow/Datafiles/NFMinput)
- Last Flow times will not process, EOV data will stop processing, and 15 minute data will stop processing (on 3-Tier only).
- Java errors in the Harvester logs: WrapperSimpleApp Error: java.lang.OutOfMemoryError: Java heap space
- Harvester process can stop pulling in new data all together.