Flow Forensics Reports Failing in NFA

Document ID : KB000020577
Last Modified Date : 21/11/2018
Show Technical Document Details
Introduction:

Description:

In NFA, a few of our customers have run into issues with running Flow Forensic reports.

The reports would fail with one of the errors below:

"Error executing Flow Forensics report on host x.x.x.x"

Figure 1

Or:


Figure 2

"Query was killed due to a report cancellation"

If you check the <Install_dir>\NFA\Netflow\logs\oursql_*_error.log (which is the log responsible for flow forensics), you may see some errors where it is trying to write to a log that doesn't exist.

For example:

"ERROR - NFA CSE could not access [D:\CA\NFA\\Netflow\logs\NFAStorageEngine.log]"


Figure 3

It then fails to write to the log and the NQmySql service stops (and the report fails to execute with one of the errors above).

 

Instructions:
  1. Manually create the 'NFAStorageEngine.log' in each of the Harvester servers' \Netflow\Logs' directory.
  2. Restart the 'NetQos NQMySql' Service in Windows Services.
  3. Then run the report again it should now be able to write what it needs to the log file and the report should now successfully execute.
  4. If it does not run please review the newly created 'NFAStorageEngine.log' and the 'oursql_*_error.log' for any new errors.